Jump to content

MBAM Browser guard identifying malware but MBAM not removing malware


Recommended Posts

 

I ran MBAM quarantined some threats, ran it again and got 0 threats detected

FD3pNly.png

 

But MBAM's extension in Forefox says (rightly) that there is a hijacking going on

 

6k83alX.png

 

And I see that if  I type something in the address bar then a moment before it goes to bing to search it, it goes to mysearchengine.co  So it ends up on bing but just before, it goes to that junk URL.  

Link to post
Share on other sites

Hello :welcome: 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review.   This is a report only.

Please download MALWAREBYRES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

  • Please attach  mbst-grab-results.zip    to your reply
  • The IP block actions by Malwarebytes are keeping the machine safe from potential threats.
  • We do need the support zip reports to see more detail  ( the screen grabs just do not have full details + those screens give no clue as to what processes are running.
Link to post
Share on other sites

The problem at hand is on the FIREFOX browser's setting for "new tab" {otherwise referred to as New Page}
on your Firefox it is set to  mysearchengine[.]co

See this guide on this link https://www.tenforums.com/tutorials/113198-change-new-tab-page-firefox.html

"How to Change New Tab page in Firefox in Windows"
Change it to either "Blank page" or
change it to a custom link like https://bing.com or https://google.com

Link to post
Share on other sites

Short answer.. That setting didn't help, so what fixed it was I uninstalled firefox, removed the old profile and then installed firefox letting it create a new profile, and then it was fine.

Longer answer-

it was the case that in pref.js I had

user_pref("browser.newtab.url", "https://mysearchengine.co/homepage?hp=1&bitmask=9996&pId=BT171001&iDate=2021-08-02 01:33:44&bName=");

and
user_pref("browser.newtabpage.url", "https://mysearchengine.co/homepage?hp=1&bitmask=9996&pId=BT171001&iDate=2021-08-02 01:33:44&bName=");

It wasn't showing in that place.  settings..home It was set to Firefox default.

I changed it to blank ,t still went to mysearchengine.co

I tried editing prefs.js manually to comment out the mysearchengine.co line and have google.com instead.  

The prefs.js file has a "warning" written at the top not to edit it while firefox is running or it gets overwritten..

Anyhow even without the mysearchengine.co in there firefox still went there.

There's also a file in my profile called AlternateServices.txt  that has stuff about mysearchengine.co in there.

In the end I just uninstalled Mozilla Firefox, and renamed the parent of the parent of the directory of my profile folder, so C:\Users\User\AppData\Roaming\Mozilla to C:\Users\User\AppData\Roaming\oldmozilla (equivalent to deleting the folder)

And I reinstalled FireFox

So now firefox doesn't have that error.

I was thinking about doing something like that though I wanted to make sure that the malware wasn't anywhere else..

Thanks

Link to post
Share on other sites

I got your reply. As a follow-up, I would urge you to run this scan. 

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  FULL scan  .

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
  • Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
  • We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply. We will do more later.

Link to post
Share on other sites

thanks, I should have started it last night but i've started it now.. To say it's taking a long time is an understatement.

EDUGBwN.png

 

The hard drive in the computer, which is a laptop, is a 1TB SSD drive  with only about 30GB free. So nearly full.  It shouldn't be a slow hard drive 'cos it's an SSD.

The CPU in it is really slow.  2.60 gigahertz Intel Core i5-3230M    Rated performance of 2515 on https://www.cpubenchmark.net/cpu_list.php

I do have a Mini PC with a really fast processor.  AMD Ryzen 5900HX  Rated performance of 23,000 there.

Maybe it's possible to run Microsoft Safety Scanner on an image of a drive? e.g. I could even mount an image of a drive, put it on the Mini PC(with the fast processor), and see if it scans that fast.

Anyhow for now i'll let this run. Might take a month if the progress bar is anything to go by, who knows.. i've no idea how long it's going to take but seems like at least a few days if not at least a week.

Thanks

Link to post
Share on other sites

It was slowing my computer down so I stopped it for now.. I also found my computer ran slow i think from MBAM.. So I quit and uninstalled MBAM..

I plan to give microsoft safe scanner another go at some point but one concern I have is if it thinks something is malicious it looks like it will just try to remove it without giving me the option to have a look at it and decide. There could be false positives. Can I get it to ask me first before trying to take some removal action?

 

 

Link to post
Share on other sites

  • 2 weeks later...

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.