View original (French)

HELP! Help me get rid of apdrive.win....

Cap85 Posted messages 3 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

Configuration: Windows / Chrome 70.0.3538.77

I have a problem in Chrome: it starts automatically in the background and tries to connect to a site called APDRIVE.WIN. Malwarebytes is blocking it, but I can't get rid of this mess.... Could a kind soul perhaps guide me on what to do? I would be eternally grateful...

3 answers

  1.
    Traxmix Posted messages 508 Status Member 175
     
    Hi, download ADWCleaner, run a scan and then clean up.
    Here is a doc' with the steps to follow: https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/
    Keep us updated on the result.

    1
    1. Cap85 Posted messages 3 Status Member
       
      Thank you for your response, but unfortunately, it doesn't help me: the dirt in question is of the Trojan horse type, adwcleaner won't be of any use (I ran it out of caution, and that’s confirmed).
      Some research leads me to think that this apdrive.win dirt is a mining software... Well, rather a website that Chrome connects to... discreetly... and which runs mining software. And I want to emphasize that it does not mine for me...
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Cap85 Posted messages 3 Status Member
         
        Do FRST.
        0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    To check the computer, I invite you to perform this FRST analysis and return the reports:

    Follow the FRST tutorial. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additional.txt


    Send these 3 reports to the site https://pjjoint.malekal.com/ to share them.
    In return, provide the 3 pjjoint links leading to the reports here in a new response so that we can review them.

    --
    Please press any key to continue the disinfection...
    1
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    You have programs that were installed when you purchased the computer or installed later that are not necessarily useful.
    They clutter Windows and can slow it down.
    You can therefore uninstall them.
    Go to the Control Panel
    then Programs and Features.
    Uninstall:

    CCleaner
    Daemon tool - you should be able to do without it, in Windows 10, you can mount ISO files directly, see: https://www.malekal.com/daemon-tools-acceder-fichier-iso/
    Driver Booster
    Java
    Spybot - Search & Destroy (ineffective)


    PS: CCleaner is not really useful, even though it is recommended everywhere.
    If you want to keep it, disable CCleaner's monitoring, unnecessary, it starts up with Windows and slows it down with its incessant cleanings, see: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/

    Here is the fix to be made with FRST. You can help yourself with this explanatory note with screenshots.
    Restart FRST then on your keyboard press the CTRL + Y keys.
    The notepad will open, copy/paste this. 

    CreateRestorePoint:
    CloseProcesses:
     Task: {CFC96636-22E3-45AF-B1A9-76D9A0213969} - System32\Tasks\ASUS Live Update2 => "C:\Program Files\Google\Chrome\Application\chrome.exe" localtask.bid
     Task: {A8F9FB44-0AD6-43AC-B717-EC7544E576C1} - System32\Tasks\ASUS Live Update1 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" localtask.bid
     HKU\S-1-5-21-3012557238-2381312675-506323260-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize 
     C:\Program Files (x86)\Lavasoft
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Save the content using the file menu and then save.

    Close the notepad, go back to FRST and click on the "Fix" button
    A restart may be necessary and automatic.
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer

    2°)
    Reset/Repair the browsers affected by the issues:

    3°)
    Finish with a scan using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

    --
    Please press a key to continue the disinfection...
    1