Jump to content

WebNavigator Browser hijacker is not detected by MBAM Premium

takosan007
 Share

Recommended Posts

takosan007

takosan007

Posted
Posted

Greetings.

Last night my friend called with his trifecta of browsers (Chrome, Firefox, & EDGE) each reporting that they couldn't get a secure connection to, what I currently know is only this college sports website www.on3.com. MBAM Premium on his laptop was also blocking the website so two red flags confirming each other. I noticed the word "outbound" in the window thrown up by MBAM so I figured it is his laptop and not a deprecated TLS/SSL version issue at the webserver.

The last 16 hours has been fun (not!) and I'm still stuck with WebNavigator respawning itself. Running out of things to throw at. Is there a way for MBAM Premium to clean it, like a parameter/switch to force it to clean WebNavigator? Do I have to reinstall MBAM on his laptop?

Below are things I've thrown at. I always restart/reboot in-between.

  • MBAM Premium didn't catch WebNavigator. Over the 16 hours, it picked up PUP but not WebNavigator.
  • "SCP /scannow" found corrupt files the first time I ran and it fixed them. Over the 16 hours, I've ran it seveal times in-between and all was successful.
  • Task Scheduler (I read this online but never found an entry related to WebNavigator).
  • Various tools from Bleeping Computer.
    • adwcleaner
    • FRST64
    • esetonlinescanner
    • RogueKiller
    • HitmanPro_x64
  • Interestingly, all above caught something *but* the only tool that caught WebNavigator was HitmanPro_x64. Running HitmanPro_x64 after restart/reboot is where I learned that WebNavigator was respawning.
  • Regedit ... I used teh Find & Find Next function with the search term "WebNavigator" repeatedly. When I found an entry, export the section of the hive, & delete. If the hive was not exclusive to Webnavigator, I will export and then delete only the WebNavigator entry.

Another observation is where after cleaning with HitmanPro_x64 of the three WebNavigator entries, if the first browser after reboot to load www.on3.com is Firefox it loads - temporarily (I'll explain this later). If the first browser is Chrome or EDGE (Chromium plumbing), it will get blocked. The Firefox that loaded this website normally, after some time, will get blocked by FireFox and MBAM after certain time has elapsed.

Thank you for any help or ideas to try.

Takosan007

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted

A quick update. Now HitmanPro_x64 won catch the respawned WebNavigator 😫 This was the first time after regedit & reboot that I was able to confirm Chrome & EDGE & MBAM blocked on3.com website; firefox loaded on3.com fine but we shall see if that changes like the earlier pattern. 

Link to post
Share on other sites
1PW

1PW

Posted
Posted

Hello @takosan007 and :welcome::

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

  1. Download the Malwarebytes Support Tool.
  2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
  3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
  4. Run the MBST Support Tool.
  5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
  6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
  7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have sent.

Thank you.

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted

Attached is the zip.

It's a little fuzzy since I've gone through the routine of scan, reboot, repeat too many times but:

  • HitmanPro_x64 stopped picking up WebNavigator hijacker *but* the same symptom of hijacker malware infection is still there so is it some other hijacker malware now?
  • Yesterday I reported that Firefox, after some time, although initially load the website without warning or block from MBAM but when refreshed will show the same symptoms. Since that last post, Firefox, even after refreshing, continues to be fine going to that website while Chrome & EDGE browsers show warning & MBAM blocks.  

mbst-grab-results.zip

Link to post
Share on other sites
Porthos

Porthos

Posted
Posted

The user has also posted here. https://www.bleepingcomputer.com/forums/t/784974/cant-eradicate-hijacker-malware-webnavigator/

@takosan007 You need to choose ONE forum for assistance.

Posting to multiple forums

There have been several occasions where we have found people seeking help here, who are also asking for help at other forums.

  • You should only seek help at one forum.
  • If you have multi-posted, we ask that you select one forum from those where you sought help and ask the others to close your topics.


Although we understand you wish your problems to be addressed as soon as possible, there are reasons why multi-posting causes problems.

 

  • By Multi Posting you are utilizing the time of two (or more) trained helpers.

    Helpers take a long time to train. They need a great deal of expertise and knowledge to be able to safely remove Malware from your computer and because of this are in short supply. We wish to use them to help the maximum number of people, and if they are researching the log of someone who is already being helped, then their time and effort is going to waste.

    Understandably this causes a certain amount of bad feeling.
    • From the helper who has needlessly spent time researching your log and compiling and posting instructions.
    • From others who have to wait longer for their problems to be addressed.

 

  • Advice from two separate helpers can cause problems.

    Different helpers may use different methods to combat your infection. Whilst each in isolation is safe, that may not be so if you follow the advice of both together. Some of the tools we use are very powerful and have to be used in a specific way and in some cases do not combine well with others. By using advice from two different sources, it is possible that tools may be used that do not combine well and you may severely damage your computer, even rendering it inoperable in some circumstances.

 

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted

Oh, I am so sorry. No, I wouldn't want dual efforts either.

If I can ask, does MalwareBytes Forum also try to help eradicate an infection using any tools and not only MBAM? If so then I will request the admins at BC to take out my posting.

Kinda' stupid question, I know, but this afternoon I started thinking about this because of the forum name. I need to get some sleep!

Again, my appologies

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted

Done. I just posted the following:

Posted Today, 07:41 PM

Admin. My apologies. If you can take this post down as I did already post on the same issue in the MB Forums yesterday. I learned this evening that I shouldn't post so efforts are not duplicated since many of the same people work on these forums to help others. My apologies.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please run the following fix @takosan007

 

 

 

NOTE: Please read all of the information below before running this fix.

  • NOTICE: This script was written specifically for this user, for use on this particular machine.
  • Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\gwah\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

  1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
  2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed in most, but not all cases.
  3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Discord cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted

Thank you. I read your reply in full and have one question of scope of the fix: I've been logging into my friend's computer as Dave (standard user) since he is the user. I then provide password for gwah (admin user) when needed to elevate to install, etc. When I log out as Dave, log in as gwah, run FRSTEnglish.exe from C:\Users\gwah\Downloads where the FIXLIST.TXT also will reside, will the fix also apply to c:\user\Dave? Again, Dave is setup as standard user used everyday while gwah and SuperDave as admin users used for admin stuff.

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted

Understood Captain. My reply may come slower today but will do another reset following directions in the link provided tonight.

FYI, before I saw your reply I remotely did a quick Chrome reset from settings & it loaded on3.com without block or Chrome putting up a warning.

Is the same needed for EDGE or process of elimination so one by one?

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Great, as long as all is clean again and no longer having issues @takosan007

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

  • right-click kprm_(version).exe and select Run as Administrator.
  • Read and accept the disclaimer.
  • When the tool opens, ensure all boxes under Actions are checked.
  • Under Delete Quarantines select Delete Now, then click Run.
  • Once complete, click OK.
  • A log will open in Notepad titled kprm-(date).txt.
  • Please attach that file to your next reply. (not compulsory)

 

  1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
    https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
  2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
  3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
  4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
  5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
  6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

uBlock Origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes

 

Link to post
Share on other sites
takosan007

takosan007

Posted
  • Author
Posted (edited)

Captain, it's been a crazy week. My friend has been using his laptop after cleaning/reseting the browsers so since Tuesday.

So from your post on Wednesday, I have to:

  • need to do this - right-click kprm_(version).exe and select Run as Administrator.
  • need to do this - Please attach that file to your next reply. (not compulsory)
  1. I tell my friends to use an address book and also teach them on good password habits 😉 - Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
    https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
  2. I've setup Dave with backup4all years ago with simple copies so when disaster strikes & needs to resotre, he can just use File Explorer (no extra stressor like needing to install the backup software on the new laptop to restore) - Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
  3. Neat software - thank you - Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
  4. Yes but unless urgent, avoid black tuesday becoming zero day by sitting back a week or two - Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
  5. Thank you - Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
  6. Browser Guard on Chrome; will verify FF & EDGE - Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

I stumbled upon the Privacy Eraser software 

https://www.cybertronsoft.com/products/privacy-eraser/

a month or two ago and I like it nukes a lot of temporary files in one fell swoop. ANy thoughts as I think it's not harmful but ...

Edited by AdvancedSetup
Disabled live hyperlinks
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

To me it looks to be in the category of unwanted Windows Quick Fix tools and Registry Cleaners. They're not supported or recommended by Microsoft or most computer experts

Windows already comes with tools needed to clean up temp files, etc.

https://www.howtogeek.com/743633/how-to-delete-temporary-files-on-windows-10/

If you really want to do more cleaning there is also BleachBit

https://www.bleachbit.org/

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept