View original (French)

I am infected with a virus that opens pages by itself.

Solved
Mistya Posted messages 16 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello;

I must have been infected by a virus.

When I click on my logo chrome at the bottom of the toolbar to show or hide the window, it opens another window, and so on. It doesn't happen all the time. It also happens to me on Firefox as well.

It also happens on the desktop, when I click on a folder, it opens multiple folders at once.

I thought it was a bug, so I restarted the computer. But my password no longer worked. I tried to recover it, but that didn't really work. I finally managed to log into the computer with my working password.

While I'm typing, the keyboard keeps misbehaving, changing my settings (capital letters appearing randomly, etc.), maybe that's why my password wasn't working anymore.

I RAN A SCAN WITH mALWARE bYTES, IT FOUND TWO FILES THAT IT PUT IN QUARANTINE. But all of this has started again and I don't know what to do. Malware Bytes doesn't find anything anymore.

By the way, I don't speak English well (JUST A LITTLE), but the Windows we have at home is in English :(

I hoPE you can help me.

8 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello/Good evening,

    Here is the procedure to follow.
    In the blue links, you will find explanatory tutorials with all the details to follow the steps.

    1)
    Fix the web browsers concerned by the issues:
    (do not use zoek and perform a manual reset)

    2) To check your computer for potential infections and to get a general status of the system:

    Follow the FRST tutorial by clicking on this blue link. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.
    • Additionnal.txt


    Send these 3 reports to the website https://pjjoint.malekal.com/ and in return, provide the 3 pjjoint links leading to the reports here in a new response so that we can review them.

    (The blue links lead to step-by-step explanatory tutorials, click on them for more precise instructions to follow).

    --
    Please press any key to continue the disinfection...
    2
  2. Mistya Posted messages 16 Status Member
     
    Hello,

    Thank you for your response.

    This situation seems to have calmed down since I sent my message, but I think the problem comes and goes.

    I have taken the steps for Firefox and Chrome.

    I'm sending you the requested links.

    https://pjjoint.malekal.com/files.php?id=20190731_s7d5d8r12r10
    https://pjjoint.malekal.com/files.php?id=FRST_20190731_h5f8z8e7e11
    https://pjjoint.malekal.com/files.php?id=20190731_g11x7i11n7m6

    Thank you for your help :)
    0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Reset the web browsers as indicated.
    This will help a lot.

    You have programs that were installed when you purchased the computer or installed later that are not necessarily useful.
    They clutter Windows and can slow it down.
    You can therefore uninstall them.
    Go to the Control Panel
    then Programs and Features.
    Uninstall:
    Avast Secure Browser
    Bing Bar
    Google Toolbar for Internet Explorer
    Norton Online Backup
    PowerDirector
    WildTangent Games App

    PS: CCleaner is not really useful, even though it's recommended everywhere.
    If you want to keep it, disable CCleaner's monitoring, which is unnecessary, as it starts up with Windows and slows it down with its incessant cleanings. See: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/

    Here is the correction to make with FRST. You can refer to this explanatory note with screenshots.
    Restart FRST then on your keyboard press the CTRL + Y key.
    The notepad will open, copy/paste this. 

    Start:
    CloseProcesses:
    CreateRestorePoint:
    2019-07-30 15:20 - 2017-03-28 16:01 - 000000000 ___RD C:\caroline
    2019-07-03 13:35 - 2019-07-03 13:35 - 000000000 _____ () C:\Users\table\AppData\Local\{46AB99BE-FC64-4ACD-A7CD-1D21776FC89F}
    HKU\S-1-5-21-2028229713-4275210609-188884171-1000\...\Run: [Chromium] => c:\users\table\appdata\local\chromium\application\chrome.exe [1053184 2016-03-09] (The Chromium Authors) [File not signed]
    c:\users\table\appdata\local\chromium
    FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
    RemoveProxy:
    Reboot:
    End:


    Save the content using the file menu then save.

    Close the notepad, return to FRST, and click the "Fix" button.
    A restart may be necessary and automatic.
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    --
    Please press a key to continue the disinfection...
    0
  4. Mistya Posted messages 16 Status Member
     
    Hello,

    Here is the content of the file I received

    Fix result of Farbar Recovery Scan Tool (x64) Version: 30-07-2019 01
    Ran by table (31-07-2019 13:07:59) Run:1
    Running from C:\Users\table\Desktop
    Loaded Profiles: table (Available Profiles: table)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    Start:
    CloseProcesses:
    CreateRestorePoint:
    2019-07-30 15:20 - 2017-03-28 16:01 - 000000000 ___RD C:\caroline
    2019-07-03 13:35 - 2019-07-03 13:35 - 000000000 _____ () C:\Users\table\AppData\Local\{46AB99BE-FC64-4ACD-A7CD-1D21776FC89F}
    HKU\S-1-5-21-2028229713-4275210609-188884171-1000\...\Run: [Chromium] => c:\users\table\appdata\local\chromium\application\chrome.exe [1053184 2016-03-09] (The Chromium Authors) [File not signed]
    c:\users\table\appdata\local\chromium
    FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
    RemoveProxy:
    Reboot:
    End:

    Processes closed successfully.
    Restore point was successfully created.
    C:\caroline => moved successfully
    C:\Users\table\AppData\Local\{46AB99BE-FC64-4ACD-A7CD-1D21776FC89F} => moved successfully
    "HKU\S-1-5-21-2028229713-4275210609-188884171-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Chromium" => removed successfully
    c:\users\table\appdata\local\chromium => moved successfully
    HKLM\SOFTWARE\Policies\Mozilla => removed successfully

    ========= RemoveProxy: =========

    "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
    "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
    "HKU\S-1-5-21-2028229713-4275210609-188884171-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
    "HKU\S-1-5-21-2028229713-4275210609-188884171-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully

    ========= End of RemoveProxy: =========

    The system needed a reboot.

    End of Fixlog 13:08:19

    0
  6. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Ok, see what it does for the ads.

    --
    Please press a key to continue the disinfection...
    0
  7. Mistya Posted messages 16 Status Member
     
    For the ads? I didn't really understand what I need to do. I haven't noticed anything regarding ads. I don't have any intrusive ads if that's what you're asking.
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      In your title, you talk about pages that open by themselves
      if they're not ads, what would they be opening?
      0
  8. Mistya Posted messages 16 Status Member
     
    This problem comes and goes.
    As soon as it occurs, I've noticed all these issues:

    1) It only opens the pages I request, but it opens them in a new window every time in an uncontrollable manner.

    2) And on the PC, if I click on a folder, it opens multiple folders at the same time (unless I counter the issue by right-clicking to open).

    3) The mouse becomes uncontrollable for copying and pasting. I'm having difficulty doing them.

    4) The keyboard is acting up. It mixes everything up in writing lowercase/uppercase, special characters, etc.

    And now, the problem has come back and disappeared again. So it doesn't seem to be fully resolved :(
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      ok, test with another mouse.
      0
    2. Mistya Posted messages 16 Status Member
       
      J'ai essayé ; cela fait la même chose.
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Mistya Posted messages 16 Status Member
         
        Okay, all I can tell you is that it has nothing to do with viruses.
        So either the keyboard or the mouse.
        At first glance, anyway.
        0
  9. Mistya Posted messages 16 Status Member
     
    Thank you for your response, it relieves me to know that it has nothing to do with a virus, I was sure I had been infected. I thought the computer password had been changed (hacked) but it must have been the keyboard that was glitching and preventing me from typing my password correctly without realizing it.

    Actually, I use a USB port for my wireless keyboard and mouse. So it must be that hardware that is no longer working. Before, following your request, I used a different mouse but that USB port was still connected for my keyboard. Now, I am using a different mouse and keyboard and the USB port is disconnected. It hasn't happened again for the moment.

    I'm waiting a bit to see since it didn't happen all the time.

    In any case, thank you very much.
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      ok it seems that you found it =)
      I will mark the subject as resolved.
      Thanks for the feedback.
      0