Genepoz01 Posted October 4, 2022 ID:1536456 Share Posted October 4, 2022 I accidentally installed Chromnius despite a warning ("Suspicious site"? I don't recall exactly) by Malwarebytes. As far as I can tell, it reroutes all queries made in browsers running from Chrome (Google, DuckDuckGo) to Yahoo. MS Edge is unaffected. I used Uninstall, which deleted Chromnius.exe and I reset Chrome, but virus effects are still there. Malwarebytes does not detect this virus, and there is nothing in the database or forums on it. I don't see anything suspicious in MSCONFIG. Please advise. Thanks! Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 4, 2022 ID:1536464 Share Posted October 4, 2022 Hello @Genepoz01 I will guide you along on looking for remaining malware. Lets keep these principles as we go along. Removing malware can be unpredictable Please don't run any other scans, download, install or uninstall any programs while I'm working with you. Only run the tools I guide you to. Do not run online games while case is on-going. Do not do any free-wheeling web-surfing. The removal of malware isn't instantaneous, please be patient. Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure. Please stick with me until I give you the "all clear". If your system is running Discord, please be sure to Exit out of it while this case is on-going. I would like a report set for review. This is a report only. Please download MALWAREBYTES MBST Support Tool Once you start it click Advanced >>> then Gather Logs Have patience till the run has finished. Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop. Please attach mbst-grab-results.zip to your reply Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 4, 2022 ID:1536479 Share Posted October 4, 2022 (edited) @Genepoz01 I would not necessarily consider "Chromnium" as a virus. If it perhaps was "pushed" onto your machine without your actual consent, one may call it a P U P. But Chromnius is said to be a browser that is based on Google's Chromium project code. Note that Chromnium browser is by Dragon Boss Solutions LLC in United Arab Emirates. added NOTE: This page at Wikipedia lists many web browsers that are also based on Google Chromium code.https://bit.ly/3ElaSDo Microsoft Edge browser is one of them. So are Brave browser, Opera browser, & Comodo Dragon browsers. Each of these 5 I have used at some point. Edited October 4, 2022 by Maurice Naggar added note Link to post Share on other sites More sharing options...
Genepoz01 Posted October 4, 2022 Author ID:1536494 Share Posted October 4, 2022 Maurice: Thanks for your quick response. Report attached. mbst-grab-results.zip Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 5, 2022 ID:1536510 Share Posted October 5, 2022 Hi. Thanks. Here are what to do next. Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article Please use this Guide { Step 2 } Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center Click the Security Tab. Scroll down to "Windows Security Center" Click the selection to the left for the line "Always register Malwarebytes in the Windows Security Center". { We want that to be set as Off .... be sure that line's radio-button selection is all the way to the Left. thanks. } This will not affect any real-time protection of the Malwarebytes for Windows 😃. Close Malwarebytes. After these steps, Microsoft Defender antivirus will be enabled to run side by side with Malwarebytes. { Step 3 } The custom script below is aimed to do some cleanups & housekeeping, and to run some scans with Microsoft Defender antivirus. This job will run exclusively and also at the end, it will do a Windows Restart ( reboot). Please be sure to Close any open work files, documents, any apps you started yourself before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app. We will use FRSTENGLISH.exe on the Downloads folder to run a custom script. The system will be rebooted after the script has run. This custom script is for Genepoz01 only / for this machine only. Please save the (attached file named) FIXLIST.txt to the Downloads folder Fixlist.txt <<< - - - - - Then, Start the Windows Explorer and then, go to the Downloads folder. RIGHT click on FRSTENGLISH.exe and select RUN as Administrator and allow it to proceed. Reply YES when prompted to allow to run. If the tool warns you the version is outdated, please download and run the updated version. IF Windows prompts you about running this, select YES to allow it to proceed. IF you get a block message from Windows about this tool...... click line More info information on that screen and click button Run anyway on next screen. on the FRST window: Click the Fix button just once, and wait. PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Please attach the FIXLOG.txt with your next reply later, at your next opportunity. 😉 There is actually very little remains of "chromnius" ( this run will remove it). Link to post Share on other sites More sharing options...
Genepoz01 Posted October 8, 2022 Author ID:1536973 Share Posted October 8, 2022 Cleanup failed. Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 8, 2022 ID:1536976 Share Posted October 8, 2022 Do you mean the Fix run using FRSTENGLISH ? Was there some sort of Error message ? Did it even start ? Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 8, 2022 ID:1536978 Share Posted October 8, 2022 Hi. Please look for a file named FIXLOG.txt on the Downloads folder. Link to post Share on other sites More sharing options...
Genepoz01 Posted October 8, 2022 Author ID:1537009 Share Posted October 8, 2022 Maurice: Well, THAT's weird. I had left the computer running, playing music on Youtube, all night, and when I did a Google search this morning, Yahoo was gone. Same when I used DuckDuckGo. Searching using both DDG and Google are back to normal. 🤨 So...success...I guess! 😂 Regarding your question about FRSTEnglish, it was after running the Scan that I manually rebooted. Then I ran Fix and it worked fine, no errors. You should already have recieved Fixlog.txt by now. Thank you so much for your help! I appreciate it. :-) Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 8, 2022 ID:1537014 Share Posted October 8, 2022 You did not attach Fixlog.txt which should be on Downloads folder. Please attach Fixlog.txt so that I can review. Link to post Share on other sites More sharing options...
Genepoz01 Posted October 8, 2022 Author ID:1537017 Share Posted October 8, 2022 Maurice, I had sent Fixlog.txt in a private msg to you but here it is again. Thanks for your patience. Fixlog.txt Link to post Share on other sites More sharing options...
Solution Maurice Naggar Posted October 8, 2022 Solution ID:1537018 Share Posted October 8, 2022 The Windows System File Checker ( SFC )-Windows Resource Protection found corrupt files and successfully repaired them. Tell me, have the I P block notices gone away? Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed. It will not take much time, First download & save itguide & download link Then be sure to close all web browsers after the download & before launching the tool. Then go to where the EXE file is saved. Start Adwcleaner. Then do a scan with Adwcleaner Guide article Attach the clean log from Adwcleaner when all completed. Link to post Share on other sites More sharing options...
Genepoz01 Posted October 8, 2022 Author ID:1537032 Share Posted October 8, 2022 Maurice: Yes the IP block notices have not shown up. The scan found 5 pups and quarantined them. Log attached. Everything looks good. Thanks for all your help! :-) AdwCleaner[C00].txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 8, 2022 ID:1537041 Share Posted October 8, 2022 Thank you. That is a good cleanup by Adwcleaner. Tell me, is there anything you need help on at this point? Link to post Share on other sites More sharing options...
Genepoz01 Posted October 8, 2022 Author ID:1537044 Share Posted October 8, 2022 Nothing that I can think of (unless you know why Youtube suddenly mass-demonetized all channels that cover the Ukraine War last night. Some sources are calling it a software glitch or hacking, but I doubt that very much. :-/ ) Thanks again, Maurice! :-) Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 8, 2022 ID:1537047 Share Posted October 8, 2022 This system is good-to-go. This here is for tools cleanup. Please download KpRm by kernel-panik and save it to your desktop. right-click kprm_(version).exe and select Run as Administrator. Read and accept the disclaimer. When the tool opens, ensure all boxes under Actions are checked. Under Delete Quarantines select Delete Now, then click Run. Once complete, click OK. A log may open in Notepad titled kprm-(date).txt. I do not need it. Just close Notepad if it shows up. Delete mb-support-1.8.7.918.exe Delete mbst-grab-results.zip on the Desktop Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware. I am marking this case for closure. I wish you all the best. Stay safe. Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 8, 2022 ID:1537048 Share Posted October 8, 2022 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following to help you better protect your computer and privacy Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts