Issue with Websites Opening Automatically

Solved

Omar67123 Posted messages 14 Status Member -
Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention - 13 Nov 2017 at 20:59

Hello,
For some time now, when I browse the internet, ad pages keep popping up...
Although I have downloaded and run scans with AdwCleaner and Malwarebytes Anti-Malware, the pages continue to show up (but are blocked by MBAM)
I wanted to know if reformatting my PC would help me get rid of all this...
Otherwise, could someone please tell me the steps to follow to remove what I must have accidentally downloaded?
Thank you in advance.

6 answers

Answer 1 / 6

Best answer
The best answer is the one that has been validated by our teams.
Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712

You have installed a malicious extension on Google Chrome.

Open a new tab.
Then paste the address chrome://extensions
Delete the Color Picker extension

This should resolve the issue.
Read the document linked about malicious extensions to understand how you installed it and how to avoid being tricked in the future.
This document explains how to reset Google Chrome, which can also help in resolving issues.

--
Please press a key to continue the disinfection...
8
1. Omar67123 Posted messages 14 Status Member
  
  Alright, it's done...
  But I'm not sure the problem is over... I've been using Color Picker for almost a month and the new ad tabs have started appearing for about 3 days now...
  
  0
2. Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712 > Omar67123 Posted messages 14 Status Member
  
  Are these ads good on Chrome?
  
  0
Answer 2 / 6
Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712
Hi,

Windows has been infected by adware and potentially unwanted programs. These unwanted items are known to cause pop-up ads and serious slowdowns on your web browsers.
Here are the steps to follow:

Reset/Repair the affected web browsers:
- Repair Mozilla Firefox (first paragraph)
- Repair Google Chrome (only the first paragraph).
- Reset and repair Internet Explorer
then:

Follow the FRST tutorial. ( take the time to read carefully - everything is explained well ).

Download and run the FRST scan, 3 FRST reports will be generated:
- FRST.txt
- Shortcut.txt
- Additional.txt
Send these 3 reports to the site http://pjjoint.malekal.com/ and in return, provide the 3 pjjoint links leading to the reports here in a new response so that we can review them.

--
Please press a key to continue the disinfection...
1
Answer 3 / 6
Omar67123 Posted messages 14 Status Member

Hello,
First of all, thank you for taking some of your time for me.
Regarding what you told me to do, I am currently doing it...

I am just sending you this message to inform you about the kind of problem I have...

Here is a report from MBAM regarding a page that was blocked this morning, which I exported to a .txt file to copy:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection event date: 04/16/2017
Protection event time: 12:20
Log file: web page blocked by MBAM.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Component version: 1.0.103
Update pack version: 1.0.1741
License: Trial

-System Information-
Operating system: Windows 10
Processor: x64
File system: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1], 0.0.0

-Website Data-
Domain: weevah2.top
IP Address: 67.55.77.171
Port: [52768]
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(end)
0
1. Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712
  
  Please follow the given procedure.
  
  0
Answer 4 / 6
Omar67123 Posted messages 14 Status Member

Here are the 3 links containing the analysis information (in the order: FRST - Addition - Shortcut):

https://pjjoint.malekal.com/files.php?id=FRST_20170416_7b13q8i14f11
https://pjjoint.malekal.com/files.php?id=20170416_h8f15j9u11g15
https://pjjoint.malekal.com/files.php?id=20170416_g11c12m5b710
0

Kovax

Hello to you!

On my side, I have web pages that open by themselves every 10 minutes without doing anything... Good pages with very interesting topics, of course.

I ran AdwCleaner + ZHP + FRST Diag.

Everything is clean when I uninstall Google Chrome, but every time I reinstall it, it's the same thing...

I also used Revo Uninstaller for a clean uninstall.

Addition: https://pjjoint.malekal.com/files.php?id=20171112_t7w13n9n14z8
FRST: https://pjjoint.malekal.com/files.php?id=FRST_20171112_x10p10c7v13v14
ZHP Cleaner: https://pjjoint.malekal.com/files.php?id=20171112_t1512b13t6b10
ZHP Diag: https://pjjoint.malekal.com/files.php?id=20171112_b8t15n11h6q13

Thank you if you can help me! I wish to continue using Chrome, but if I have to switch back to Mozilla to avoid these pages, then I will! :)

Best regards and have a good evening!

Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712

Hi,

Here is the correction to be made with FRST. You can use this explanatory note with screenshots.

Open Notepad: Windows + R key,
In the "Run" field, type notepad and OK.
Copy/Paste the following into it:

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-18\...\RunOnce: [KyhuRAcNvF] => "C:\Windows\system32\config\SYSTEM~1\AppData\Local\YXVHVH~1\win32k.exe"
GroupPolicy: Restriction <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
2017-11-12 22:45 - 2017-11-12 22:48 - 000015652 _____ C:\Users\Max\Desktop\ZHPCleaner.txt
2017-11-12 22:39 - 2017-11-12 22:48 - 000000000 ____D C:\Users\Max\AppData\Roaming\ZHP
2017-11-12 22:39 - 2017-11-12 22:39 - 002969472 _____ C:\Users\Max\Downloads\ZHPCleaner.exe
2017-11-12 22:39 - 2017-11-12 22:39 - 000000826 _____ C:\Users\Max\Desktop\ZHPCleaner.lnk
2017-11-12 22:34 - 2017-11-12 22:34 - 002946944 _____ C:\Users\Max\Downloads\zhpcleaner_2017.10.10.179.exe
2017-11-12 22:34 - 2017-11-12 22:34 - 000000000 ____D C:\Users\Max\AppData\Local\ZHP
2017-11-12 19:14 - 2017-11-12 19:28 - 000000000 ____D C:\Users\Max\Downloads\GMT-MAX.NET_Assassins_Creed_Origins_Gold_Edition_Uplay-Rip
2017-11-12 19:14 - 2017-11-12 19:14 - 000241817 _____ C:\Users\Max\Downloads\ac-origins.torrent
2017-11-12 18:48 - 2017-11-12 18:48 - 000392416 _____ ( ) C:\Users\Max\Downloads\Need_for_Speed_Payback_Crack_CTCEDC.exe
2017-11-12 18:38 - 2017-11-12 22:34 - 1949732864 _____ C:\Users\Max\Downloads\NFS Payback.iso
2017-11-12 18:24 - 2017-11-12 18:24 - 000057470 _____ C:\Users\Max\Downloads\Need.For.Speed.Payback test.torrent
2017-11-12 18:22 - 2017-11-12 18:22 - 001525156 _____ ( ) C:\Users\Max\Downloads\Full-Game-Crack_NFSPB.exe
2017-11-12 18:13 - 2017-11-12 18:13 - 000000000 ____D C:\Users\Max\Downloads\stp-nfs-payback-crack-only
2017-11-12 18:12 - 2017-11-12 18:12 - 000000000 ____D C:\Users\Max\Downloads\stp-ac-origins-crack
2017-11-12 18:11 - 2017-11-12 18:11 - 000000000 ____D C:\Users\Max\Downloads\[CPYGAMES.COM]Need.for.Speed.Payback.Crack.Only
2017-11-12 18:05 - 2017-11-12 18:05 - 003262672 _____ C:\Users\Max\Downloads\RAR Password Unlocker Game68240.rar
2017-11-12 18:05 - 2017-11-12 18:05 - 000000000 ____D C:\Users\Max\Downloads\RAR Password Unlocker Game68240
2017-11-12 17:59 - 2017-11-12 17:59 - 000707252 _____ C:\Users\Max\Downloads\stp-ac-origins-crack.rar
2017-11-12 17:54 - 2017-11-12 17:54 - 000057470 _____ C:\Users\Max\Downloads\Need.For.Speed.Payback.torrent
2017-11-12 17:43 - 2017-11-12 17:43 - 114799596 _____ C:\Users\Max\Downloads\[CPYGAMES.COM]Need.for.Speed.Payback.Crack.Only.rar
2017-11-12 17:41 - 2017-11-12 17:41 - 001541948 _____ C:\Users\Max\Downloads\stp-nfs-payback-crack-only.rar
2017-11-12 17:27 - 2017-11-12 17:28 - 000000000 ____D C:\Users\Max\AppData\Local\Go!
2017-11-12 17:27 - 2017-11-12 17:27 - 000003458 _____ C:\Windows\System32\Tasks\lfejpqwoxyoc
2017-11-12 17:27 - 2017-11-12 17:27 - 000003262 _____ C:\Windows\System32\Tasks\xdmnxanaaq
2017-11-12 17:27 - 2017-11-12 17:27 - 000000342 _____ C:\Users\Max\AppData\Local\ztjnruekjl.bat
2017-11-12 17:27 - 2017-11-12 17:27 - 000000342 _____ C:\Users\Max\AppData\Local\rscnaihosfkg.bat
2017-11-12 17:27 - 2017-11-12 17:27 - 000000069 _____ C:\Users\Max\AppData\Local\fttovjn.bat
2017-11-12 17:27 - 2017-11-12 17:27 - 000000067 _____ C:\Users\Max\AppData\Local\xdcytaboai.bat
2017-11-12 17:27 - 2010-11-20 13:16 - 000186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\2445185.exe
2017-11-12 17:26 - 2017-11-12 17:26 - 000003600 _____ C:\Windows\System32\Tasks\100newsupnetsoxkziwx
2017-11-12 16:11 - 2017-11-12 16:11 - 000001458 _____ C:\Users\Max\Downloads\Need For Speed PayBack.rar
Task: {16242425-EF3F-4440-B56B-214755E0A03E} - System32\Tasks\lfejpqwoxyoc => C:\Users\Max\AppData\Local\fttovjn.bat [2017-11-12] () <==== ATTENTION
Task: {964CEBD5-FC17-472B-88B1-CA25DB026C8F} - System32\Tasks\xdmnxanaaq => C:\Users\Max\AppData\Local\xdcytaboai.bat [2017-11-12] () <==== ATTENTION
Task: {1F2E8334-DAFE-4447-9737-A27242AAF44D} - \xns2xi2k -> No file <==== ATTENTION
Shortcut: C:\Users\Max\Desktop\Запустить Middle-earth Shadow of War.lnk -> C:\Games\Middle-earth Shadow of War\x64\ShadowOfWar.exe (WB Games, Inc.) <==== Cyrillic
Shortcut: C:\Users\Max\Desktop\BUREAU 2015\Моzillа Firеfох.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (No file) <==== Cyrillic
Shortcut: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехρlоrеr.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) <==== Cyrillic
Shortcut: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnеt Ехρlоrеr (Nо Аdd-оns).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) <==== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Моzillа Firеfох.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (No file) <==== Cyrillic
Task: {FD4422B5-3458-481A-97C7-3DE3854494D1} - System32\Tasks\100newsupnetsoxkziwx => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" 100newsup.net/soxkziwx <==== ATTENTION
Task: {7DDDB5FA-1A09-4F2A-B681-5A116BEC9015} - \co5n1ips -> No file <==== ATTENTION
Task: {7ED35B5C-558F-400D-A0E0-ED9AC51A6B7E} - \aocill5s -> No file <==== ATTENTION
EmptyTemp:
RemoveProxy:
Reboot:

Once the text is pasted into Notepad,
Go to the "File" menu and then "Save as",
On the left, go to the Desktop,
In the bottom field, file name put: fixlist.txt
Click on "Save", this will create fixlist.txt on the Desktop.

Restart FRST and click on the "Fix" button
A restart may be necessary (not mandatory)
A text file appears, copy/paste the content here in a new message.

Restart the computer.

2°)
Reset/Repair the WEB browsers concerned by the problems:

Repair Mozilla Firefox (first paragraph)
Repair Google Chrome (only the first paragraph).
Reset and repair Internet Explorer

3°)
Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

4°)
See how it goes and if there have been any improvements.
If not, if you still have pop-up ads, specify which WEB browser.
Do another FRST scan and provide the new reports via attachment.

Kovax > Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention

Hello,

Thank you for your response!

I'll test that and let you know.

For your information, every time I restart my PC, I now have a command prompt that launches:

https://pjjoint.malekal.com/files.php?id=20171113_z14o11b12x8t8
https://pjjoint.malekal.com/files.php?id=20171113_f14s12l12x15q14

Thank you for your help,

Best regards
0
Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712 > Kovax

I already follow the entire procedure =)
0

Kovax

It's much better for now, thank you for your time and help!

Have a good evening!
0
1. Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention 24 712 > Kovax
  
  No problem.
  
  0

Answer 6 / 6
titane3 Posted messages 22 Status Member

Hello,

Reformatting your PC is a drastic solution and if you didn't make a "backup" of your PC beforehand, you'll have a lot of work to reinstall everything! (At least 1 day)

Another solution is to block "Popups" through your browser or by installing adblock ... Here’s a link to help you: https://www.google.fr/?gws_rd=ssl#q=adblock+mozilla
... It's worth trying to see if your problem is solved.

We remain at your disposal for further assistance if needed.

Have a very good day,
-1
1. Omar67123 Posted messages 14 Status Member
  
  Hi, thanks for your reply but I've already done all this... and it doesn't work.
  
  0

Issue with Websites Opening Automatically

6 answers

Google maps does not recognize my current location [pc]

How to reset a gps on a 2010 automatic c4 picasso clocking?

Understanding the use of the 'i' compartment in the washing machine

Smart tech tv without remote control

Problem with the poulpeo site

No network inside the house.

Installation of the claude ai

Pressure cooker gasket

Missing lock icon

Texture issues in enshrouded