dots/periods filling in all search boxes on their own including this one

[sync]

For the last 2 weeks, any and all search boxes are being automatically filled in with periods/dots. It also fills in notepads and sometimes address bars. I have tried many things but nothing is found or works. Even typing this was torture.

[1PW]

Hello @sync and welcome back:

 If the computer in question has a keyboard that can be unplugged, please try that or exchange with another and reply with the result. Otherwise, continue below.

 While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run one or more of its following procedural steps, please carefully follow the instructions within the following:

I am infected - What do I do now?

 Remember, please be certain to attach (not Copy and Paste) the three (3) resultant report files in your next reply to this topic.

 Also, please remember to turn-on the "Follow topic" toggle switch, near the lower-left corner of your next reply.

Thank you.

Edited November 14, 2022 by 1PW

[Maurice Naggar]

Hello @sync Do do as suggested above. Do attach the report files. What you did not mention: Which "search box" or boxes are these? Is the Windows taskbar search ? Or is this on a web browser ? on all web browsers? Is it a "google" search ? Or some other search engine?
+ which version of Windows ? Does this pc have Malwarebytes Premium ? what are results from Malwarebytes scans?
 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Beyond the reports mentioned above......Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

ADDITIONAL NOTE: Clear / Delete all Cache & Temporary files on all web browsers, PLUS, do one Windows RESTART so that machine is into a fresh restart. 

I simply would like to offer some remarks about Chrome & web browsers & Windows.

As to Chrome, insure it is the latest release from Chrome
https://support.google.com/chrome/answer/95414?
On some periodic basis, suggest to delete all Cache content on Chrome for "all time" period. That will help keep Chrome running more snappy.
open Chrome.
At the top right, click More .
Click More tools and then Clear browsing data.
Choose the time range All time.
Select the types of information that you want to remove.
Click Clear data.

By the way, the same principle applies to the Edge browser in Windows 11 / 10. Clearing all cache helps.

The section for EDGE browser how-to https://forums.malwarebytes.com/topic/286888-few-malwares-were-failed-to-removed/?do=findComment&comment=1517006
 

Edited November 14, 2022 by Maurice Naggar

[sync]

OK, I went and bought a new (Logitech) keyboard and am using it from here on out. It is(now WAS) populating dots on all search boxes, anywhere. I use Microsoft Edge with Windows 10 Home 64 bit and it has done this in the Bing search box, the Windows taskbar, Google, the search box on Outlook, and any search box in any place or any program. In terms of other browsers, I hadn't tried other browsers before now, but, EMBARRASSINGLY, it is NOT doing it now with the new keyboard and I have tried it vigorously on Edge, Firefox, and Chrome. I checked time and time again to see if the period(>) key was stuck or even slightly depressed on the previous keyboard and I was convinced that it wasn't. How did it "know" to put in periods on its own?
Among many things, I ran Malwarebytes Free Edition and it found nothing (as many other programs also found nothing). I have to conclude that it is now fixed with the new keyboard alone. Here are the attached files anyway.

FRST.txt Addition.txt MBytes.txt

[Maurice Naggar]

Malwarebytes found 1 adware that you did not TICK so that it can be removed. Please do as listed here. 

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes scan.

Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[sync]

So, I ran another Malwarebytes Scan and quarantined the one found item and have attached the report. I cleared the caches on Edge, Firefox and Chrome AFTER I ran the scan as I did not understand at first (I am learning). Also, when using the other keyboard, when I tried to open START from the upper left icon, it would open the icon next to it for search (magnifying glass at 45-degree angle icon) and then the dots would aggressively populate the search box. I thought that this behavior is more indicative of Malware than a stuck key. However, the problem has gone away with the new keyboard.

MbytesScanReport.txt

[Maurice Naggar]

Per the Farbar FRST ...Windows is reporting issues about the integruity of the disc system on this machine

Error: (11/14/2022 03:01:58 AM) (Source: Ntfs) (EventID: 55) (User: NT AUTHORITY)
Description: A corruption was discovered in the file system structure on volume Windows.
	The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x300000001793e.  The name of the file is "<unable to determine file name>".

There is a real need to run a CHKDSK run.

please do the following. First, CLOSE all your open apps, programs.

Click on START and type in CMD.EXE and when it shows on the menu right-click and select "Run as administrator" and type in or copy and paste the following exactly. Then press the Enter key and restart the computer. Let the DISK CHECK run. Do not touch any keys while booting.

ECHO Y|CHKDSK C: /F

 

Let me know if there are any errors shown from the disk check. This run necessitates doing a system Restart in order to begin the run.

[sync]

I put the Echo...etc in an administrative command prompt and it said it will run it at the next restart, so I restarted, and it ran. No error messages popped up. I googled does chkdsk leave a log file and it led to the pasted one below.

chkdsk mbytes.txt

[Maurice Naggar]

Thanks. This next custom-fix is mainly intended to run Windows' SFC & DISM to check the system for integrity. To clear temporary cache on Edge & Chrome & Firefox. To attempt to check the system with Microsoft Defender antivirus. It will also attempt to remove some restriction on Windows Update.

This is not a cure-all. Rather, it is meant as general check & cleanup.

This custom script is for  Sync  machine  only / for this machine only.

• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt <<< - - - - -

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRST64.exe  on the Downloads folder    to run a custom script .    The system will be rebooted after the script has run. 

Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

•    If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.
• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start. Lots of patience.  Please attach the Fixlog.txt with your next reply. 

[sync]

Ran as Admin. Rebooted. Attached.

Fixlog.txt

[Maurice Naggar]

Thank you for the log. That custom-fix run is beneficial. 

Malwarebytes had ( earlier ) found & removed an adware........ OpenSUpdate.Adware.Advertising.DDS

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run. 

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.  That is, once it is under way, you should leave it running.  It will run for several hours.

• At screen "Detections occured and resolved" click on blue button "View detected results"
• On next screen, at lower left, click on blue "Save scan log"
• View where file is to be saved. Provide a meaningful name for the "File name:"
• On last screen, set to Off (left) the option for Periodic scanning
• Click "save and continue"
• Please attach the report file so I can review

QUESTIONS for clarification
Is Bitdefender Total Security a trial install ? or is it a paid-for license ?
Did this machine have Avast Antivirus ? Did you uninstall it ? when ?

[sync]

The Bitdefender is a 14-day free trial. The Avast Antivirus Free Edition is what I had when I first started having the period fill in problem, but I removed it so it wouldn't interfere with other antivirus programs I tried, as I tried a few (which found nothing (and which led me to Bitdefender)) before I got to you. The Avast uninstall was ABOUT 5 days ago or so.

I notice that Dokan Library Bundle is now in my programs. Should I remove it? Should I remove Bitdefender? What other programs should I remove?

ESET for Mbytes Forum.txt

[Maurice Naggar]

Tell me. Is the issue of unexpected dots or periods on search box gone away?
When does the BitDefender trial expire?

as to this machine havaing had Avast antivirus, we need to run the Avast cleanup tool to insure all traces of it are gone. ( You gotta do something like this each time you switch from a non-Microsoft-branded antivirus ).
get & first SAVE & then run the AVASTCLEAR tool
Get, Save & Run the Avast clear tool.
https://support.avast.com/en-us/article/Uninstall-Antivirus-Utility/Save the tool first; then run it.

[   2   ]
Then do a Windows RESTART  from the Start menu.

You mentioned Dokan Library. If the system has a installed application that is not familiar to you, Uninstall it.
SEE how-to uninstall https://bit.ly/3XfK1j4

[sync]

  The dots/periods filling in the password boxes, search boxes, etc. has   completely gone away.                                                                                             The Bitdefender trial is 30 days, not 14 as I mis-said before and it has 14 days left as of today, Sat. Nov. 19, 2022. I only downloaded it to try to fix the problem and did so before I reached out to you at Malwarebytes forum. I am going to remove it now. Malwarebytes is still active as of now.                                 I removed the Avast by using Revo Uninstaller 2.1.0 (see below screenshot), BUT apparently is still showing so I will remove via the tool you provided.            I will remove Dolkan Library.

[AdvancedSetup]

You don't need Bonjour either. That often causes networking issues on Windows computers.

 

[sync]

Avast removed. Bitdefender removed. Protected now by MBytes trial. Dolkan Library gone. Dots/periods problem gone. 

[Maurice Naggar]

It is great to know that the original problem is gone. 

I would recommend getting a readout report as to update status of some key apps.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[sync]

Ran as Admin.SecurityCheck.txt

[sync]

Again, as I am not sure what happened.

SecurityCheck.txt

[sync]

I don't know how to read the SecurityCheck.txt but why is anything related to Avast still in there??  i.e. AvastWscReporter (AvastWscReporter) - The service has stopped 

[Maurice Naggar]

Let us first cover the status of out-of-date applications, per SecurityCheck. 

Microsoft OneDrive v.22.225.1026.0001    Warning! Download Update

Zoom v.5.11.1 (6602)    Warning! Download Update

Bonjour You do not need that add-on. Uninstall it.

Google Toolbar for Internet Explorer v.1.0.0 << Hidden   Warning! Browser's toolbar. It can slow down the working of your browser and have violation privacy problems.

This next fix-script is an attempt to remove leftovers of Avast antivirus.

This custom script is for  Sync  machine  only / for this machine only.

• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt <<< - - - - -

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRST64.exe  on the Downloads folder    to run a custom script .    The system will be rebooted after the script has run. 

Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

•    If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.
• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start. Lots of patience.  Please attach the Fixlog.txt with your next reply. 

[sync]

Microsoft OneDrive and Zoom, Updated.                                                                Bonjour and Google Toolbar for Internet Explorer, Removed.                                                Ran above as Admin.. Attached is Fixlog.txt                                                                      All clear?

Fixlog.txt

[Maurice Naggar]

Windows System File Checker Windows Resource Protection found corrupt files and successfully repaired them.

This system should be good to go. I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

[sync]

All done. I learned so much in this amazing and stimulating process. All that is left to say to Maurice Naggar and Malwarebytes Support Forum is

thank-you

[Maurice Naggar]

This here is for tools cleanup.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log may open in Notepad titled kprm-(date).txt.  I do not need it. Just close Notepad if it shows up.

Your system is good-to-go. I am marking the case for closure. 

Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

SAFETY TIPS:

Backup is your best friend.  Keep backups of your system on a regular basis to offline storage & keep those safe. https://forums.malwarebytes.com/topic/136226-backup-software/

It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use.

Best  practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html

Only using the Standard-access-level user account when surfing and downloading / installing would have been a tremendous way to prevent the infections of this machine.

Don't remove ( or change )  your current login. Just use the new Standard-user-level one for everyday use while on the internet.

 

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"  

I would recommend that you get a Malwarebytes license for all your devices.

Stay safe. I wish you well. 😎