Help needed . Think i'm infected [Solved]

Hi there . I'll need some help as my chrome is filled up with weird popups at the moment . 

Hope to get this resolved soon . Thanks!

Hi . would you mind if we suspend this for the time being . Prior to this , i did run a version of malwarebytes and deleted / qurantine whatever that needs to do so . 

An extension was left in google chrome and i deleted that as well . So far everything is running smoothly again . Prior to creating this topic , i did not realise an extension was running on even though i had ad blocker on . Give me the standard time taken to reply to the topic and if i do not reply by then consider the case closed ? 

Once again , sorry about it .

Give me the standard time taken to reply to the topic and if i do not reply by then consider the case closed

 

Will do. I still think it's worth running the scans to see if anything's left.

Satchfan

This topic has been re-opened at the member's request.

Some junk has been cleared out and you last logs look OK but let's make sure there's nothing left.


Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

• start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• once it is updated, click on “Scan” tab, select Threat Scan, then click Scan.
• when the scan is complete, if no malicious items are found you can close the program
• if malicious items are found be sure that everything is checked and click Quarantine
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or  Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• click the Eset online Scanner button
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  

  
  o    click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
  o    double click on the Eset installer icon on your desktop.
   

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Enable detection of potentially unwanted applications
• click Advanced settings and select the following:
  

  
  o    scan archives
  o    scan for potentially unsafe applications
  o    enable Anti-Stealth technology

  
  Note: Do not check Remove found threats
   

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  

  
  Note - if ESET doesn't find any threats, no report will be created.
   

• push the back button.
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found.
 

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    Click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here.

Logs to include with the next post:

Mbam.txt
Eset results

Can you tell me if there are any outstanding problems.

Satchfan
 

Malwarebytes log file 

Other than that , machine is running ok . 

Google Chrome is infamous for this kind of behaviour.

We’ll clear up what was found by the scan and then we’ll use another tool to see what is there.


Please copy all text in the code box below and paste it into Notepad:
 

@echo off
del /f /s /q "C:\ProgramData\{2fddb011-058d-e79f-2fdd-db011058c044}\Download.exe”
del /f /s /q “C:\Users\All Users\{2fddb011-058d-e79f-2fdd-db011058c044}\Download.exe”
del /f /s /q "C:\Users\Alvin\AppData\Local\Temp\6458614719343520097.exe”
del /f /s /q "C:\Users\Alvin\AppData\Local\Temp\9Dca3DB7.exe”
del /f /s /q "C:\Users\Alvin\AppData\Local\Temp\86a3\temp\Download.exe
del /f /s /q "C:\Users\Alvin\AppData\Local\Temp\Hotspot Shield\html\scripts\AskToolbar.js
del /f /s /q "C:\Users\Alvin\AppData\Roaming\rmi\SopCast.zip
del /f /s /q "C:\Users\Alvin\Downloads\Download.exe
del /f /s /q "C:\Users\Alvin\Downloads\EN4500_188.exe
del /f /s /q "C:\Users\Alvin\Downloads\freevpn.exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3-42-install-hss-596-conduit (1).exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3-42-install-hss-596-conduit (2).exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3-42-install-hss-596-conduit (3).exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3-42-install-hss-596-conduit (4).exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3-42-install-hss-596-conduit.exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3.42-install-e-550-plain (1).exe
del /f /s /q "C:\Users\Alvin\Downloads\HSS-3.42-install-e-550-plain.exe
del %0

• save the Notepad file to your desktop and name it delfiles.bat
• save type as "All Files"
• on your desktop, double-click on delfiles.bat to run it, (a black CMD window will flash, then disappear - this is normal).

The files/folders, if found, will have been deleted and the "delfile.bat" file will also be deleted.

The rest of the Online scan is only reporting what has already been quarantined: whatever is in these folders can't cause any harm and will be removed when we tidy up.

==============================================


Run Zoek

Download zoek.exe to your Desktop:

Important : Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.

• on Windows Vista, 7, and 8, right-click Zoek.exe and select: Run as Administrator
• give it a few seconds to appear
• copy/paste the entire script inside the codebox below into the input field of Zoek:

  createsrpoint;
  chromelook;  
  

• close any open programs.
• click the Run script button, and wait. It takes a few minutes to run.
• when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\
• if a reboot is needed, the log will be opened after the reboot.

Thanks

Satchfan

Delfiles.bat double clicked and deleted . 

Zoek log file

Some strange popups will appear in google chrome sometimes in extensions

Sometimes a popup will appear in your google chrome browser when you just booted up . 

Often that is found in my extensions tab . 

When i see it again , i'll let ya know . 

So is there anything wrong with my machine ?

Sometimes a popup will appear in your google chrome browser….Often that is found in my extensions tab

 

 

What is found in your extension tab?

right now there is nothing unusual at the moment . i cant remember the popup which appeared that day for now .