Adware.Chromeloader.Generic

[WLenny]

I recently got a virus that I believe keeps reinstalling itself despite me quarantining it everytime. I downloaded a game that turned out to be a virus and immediately deleted the game and ran a scan and quarantined it. The next day my chrome window closed then reopened and after that my google autocomplete feature was turned off and it won't let me turn it back on as well as my google searches redirected to Bing. I again ran a scan and quarantined. That fixed everything except the autocomplete feature was still not working. About a week later my chrome window again shut down and reopened but with a new tab asking me to download TenBrowser. I scanned and quarantined again. Then a week later, again, my chrome window closed, but this time it just reopened a new window with none of my existing tabs open. I scanned a quarantined again. It happened again last night. After checking the detection history, they all have the name of Adware.Chromeloader.generic. How can I get rid of this virus for good?

[MKDB]

Hello @WLenny  and 

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please attach all log files into your post.
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting and removing malware isn't instantaneous and there is no guarantee to repair every system.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Please be patient and stick with me until I give you the "all clear".
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed. If you are away for a longer time, please let me know.

 

 

 

Step 1

• If you already have Malwarebytes Anti-Malware installed, then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed or if you don't run the newest version yet, please download it from here and install it.
• Once the MBAM dashboard opens, click on Settings (gear icon).
• Click on Security tab and make sure that all four Scan options are enabled.
• Close Settings and click on the Scan button on the dashboard.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
• If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run, then please skip to the next step and let me know in your next reply that the scanner would not run.

 

 

Step 2

Please download AdwCleaner and save it to your desktop.

• Double-click to run it.
• Accept the End User License Agreement.
• Click Scan Now.
• When finished, if items are found please click Next / Quarantine.
• Maybe your PC will be rebooted, AdwCleaner will be opened automatically.
• Click View Log File.
• AdwCleaner will open one log (AdwCleaner[Cxx].txt).
• Please attach the log to your next reply.

 

 

 

Step 3

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Check the box in front of Shortcut.txt.
• Press the Scan button.
• FRST will create three logs (FRST.txt + Addition.txt + Shortcut.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

[WLenny]

Is Microsoft OneDrive sufficient for external backup of private data?

[MKDB]

I would prefer an external HDD instead of OneDrive.

But if you have no external drive, you "have to" use OneDrive I guess.

If there is only this Adware on your system, it should be ok.

 

For the future: Make sure that you backup your private data in regular basis, for example once a week.

 

Waiting for your next answer with those logfiles. 🙂

[WLenny]

I apologize for all the questions before I get started with the instructions. I am not very familiar with this type of thing, so I just want to make sure I am doing everything properly. When you say temporarily disable your anitvirus and other security software, does that include malware bytes? Also I am not finding Microsoft SmartScreen, but am finding Microsfot Defender Antivirus. This is all my antivirus programs

[AdvancedSetup]

18 minutes ago, WLenny said:

Is Microsoft OneDrive sufficient for external backup of private data?

Not in my opinion.

How much and how well you back up your data depends on how critical it is to you. If it's critical you should have at least 3 different copies of it. If it's not critical perhaps one could use one or two copies.

Ask yourself how it would affect you if you woke up and found ALL your data was encrypted or deleted by mistake and act accordingly to protect it.

 

Edited November 4, 2022 by AdvancedSetup
Updated information

[MKDB]

7 minutes ago, WLenny said:

I apologize for all the questions before I get started with the instructions. I am not very familiar with this type of thing, so I just want to make sure I am doing everything properly. When you say temporarily disable your anitvirus and other security software, does that include malware bytes? Also I am not finding Microsoft SmartScreen, but am finding Microsfot Defender Antivirus. This is all my antivirus programs

There is no need to disable Malwarebytes, it works well with FRST.

Here are some information about SmartScreen.

[WLenny]

14 minutes ago, AdvancedSetup said:

Not in my opinion.

How much and how well you back up your data depends on how critical it is to you. If it's critical you should have at least 3 different copies of it. If it's not critical perhaps one could use one or two copies.

Ask yourself how it would affect you if you woke up and found ALL your data was encrypted or deleted by mistake and act accordingly to protect it.

 

I'm confused, if I have a virus potentially in my files, but I backup all my files to an external hard Drive, wouldn't I also be backing up the virus? I guess the same could be said for OneDrive.

Also, would a thumbdrive be sufficient?

[MKDB]

6 minutes ago, WLenny said:

I'm confused, if I have a virus potentially in my files, but I backup all my files to an external hard Drive, wouldn't I also be backing up the virus? I guess the same could be said for OneDrive.

Also, would a thumbdrive be sufficient?

In your case, I don't expect malicious files in your private data... more in special system directories... and your private data is not encrypted as well. But malware can encrypt or delete private files.

So it is important that you do backups in a regular basis (as a prevention) and not only if your system is infected... because as you noticed... it could be too late, of course.

A thumbrive would be ok as well.

[WLenny]

44 minutes ago, MKDB said:

I would prefer an external HDD instead of OneDrive.

But if you have no external drive, you "have to" use OneDrive I guess.

If there is only this Adware on your system, it should be ok.

 

For the future: Make sure that you backup your private data in regular basis, for example once a week.

 

Waiting for your next answer with those logfiles. 🙂

I'm confused, if I have a virus potentially in my files, but I backup all my files to an external hard Drive, wouldn't I also be backing up the virus? I guess the same could be said for OneDrive.

Also, would a thumbdrive be sufficient?

[MKDB]

Please see my last post here.

[WLenny]

41 minutes ago, MKDB said:

Please see my last post here.

Ok, I believe this should be my last question. When backing up my private data to a thumbdrive, do i just backup all of my files on my computer or just the ones I wan to keep?

 

[MKDB]

Usually, if you want to make a simple backup of your private files (documents, pdfs, exel, powerpoint, pictures, videos, etc.) you do NOT backup all files from your whole system... you just copy those private files onto your external drive that you want to keep or let's say that are important for you... as a prevention... just to be safe.

I run a backup once a week with all my private files. I save my private files on two different external drives... if one get's damaged, I have the second one as well. My private files are important for me that's why I save them twice. AdvancedSetup would save it on three different drives.

Some other people run special backup software that stores a backup (image) of the whole system and save this backup on an external drive.

 

All in all, it's up to you, but you should do backups on a regular basis, because if your system get's for example infected with ransomware, all your private files will be encrypted and are usually lost. That's what AdvancedSetup meant with his post. You always have to act proactively.

"Adware.ChromeLoader" does not infect privat files as far as I know, but changes windows system configurations and google chrome... so regarding your private data, you should be lucky this time... but who knows what it will look like next time your machine get's infected?

 

I hope you understand us better now @WLenny.

 

 

[WLenny]

Thank you so much, I definitely understand a lot better now. I’ll be able to get those log files either tonight or tomorrow morning 

[MKDB]

You're welcome @WLenny.

Looking forward to those log files in order to review them.

Edited November 4, 2022 by MKDB

[WLenny]

When I scanned Malware Bytes I got no Detections, but didn't see a Save Report option, so I clicked View Report then Export to Txt

MalwareBytes.txt AdwCleaner[C00].txt FRST.txt Addition.txt Shortcut.txt

[MKDB]

Thank you @WLenny.

Please give me some time to review your logfiles.

[MKDB]

First, we will run a fix with FRST @WLenny.

 

 

Step 1

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\willl\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the FIX button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
• Please note: This Fix will remove all temporary files and empty recycle bin.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.
• FRST will create a .zip file like < Date_Time.zip >, for example 20.02.2022_11.33.52.zip, on your desktop as well. Please attach that .zip file with your next answer as well.

 

Thank you!

 

 

fixlist.txt

[WLenny]

FRST is currently frozen and says not responding, should I still just let it be or close out and restart?

[MKDB]

Do nothing... just wait. Do not interfere the process.

Thank you @WLenny.

Edited November 5, 2022 by MKDB

[WLenny]

Here is the FixLog. I can't attach the zip file because it says it is too large

Fixlog.txt

[WLenny]

My Zip file is 110.353 MB

[MKDB]

Thanks @WLenny.

Can you upload the zip file here and send me the link, please?

https://www.file.io/ or https://easyupload.io/

 

Moreover, I would like you to run a fresh FRST scan to check the results.

 

Step 1

• Run FRST again.
• Do not change any settings.
• Press the Scan button.
• FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

[WLenny]

https://easyupload.io/tsqf61

[MKDB]

Thank you @WLenny.

Please go on with a fresh FRST scan.