NewTab
Solved
ShakZi
-
ShakZi -
ShakZi -
Hello,
For a few days now, when I launch Google Chrome, a page that is not Google opens. It is titled "New Tab". I have set Google as my homepage in the settings, but the new pages I open are still New Tab. From what I've read, this might be malware.
Thank you for your help.
Configuration: Windows / Chrome 88.0.4324.190
For a few days now, when I launch Google Chrome, a page that is not Google opens. It is titled "New Tab". I have set Google as my homepage in the settings, but the new pages I open are still New Tab. From what I've read, this might be malware.
Thank you for your help.
Configuration: Windows / Chrome 88.0.4324.190
20 réponses
ShakZi
I checked, but I don't have an extension with that title.
Hello,
We will start with a PC diagnostic:
--> For a 32-bit system
--> For a 64-bit system
How can I find out which version, 32 bits or 64 bits, is running on my system?
--> Wait for your browser to offer the download to save, do not click anywhere, especially not on the sponsors of the page.
--> Close all applications, including your browser
--> Double-click on FRST.exe and click Yes to accept the Disclaimer
--> Under Vista, Windows 7 / 8 and 10, you need to launch the file by right-clicking -> Run as administrator
--> Wait for it to indicate The tool is ready to run
--> In the main menu, click on Scan and wait for the analysis to complete
--> At the end of the scan, the FRST.txt and Addition.txt reports are created. Post these reports in your next response.
--> The reports are saved in the same location as the tool and under C:\FRST\Logs
--> The SmartScreen filter may trigger an alert. Click on Actions or More information then click on Run anyway
---------------------------------------------------------------------------------------------
The expected reports are FRST.txt and Addition.txt
All reports must be hosted on https://security-x.fr/up/ and you indicate the obtained links in your response
--
Security contributor.
We will start with a PC diagnostic:
Read the entire procedure before posting the reports
--> Download the FRST version of Farbar, compatible with your system and save the file to your Desktop--> For a 32-bit system
--> For a 64-bit system
How can I find out which version, 32 bits or 64 bits, is running on my system?
--> Wait for your browser to offer the download to save, do not click anywhere, especially not on the sponsors of the page.
--> Close all applications, including your browser
--> Double-click on FRST.exe and click Yes to accept the Disclaimer
--> Under Vista, Windows 7 / 8 and 10, you need to launch the file by right-clicking -> Run as administrator
--> Wait for it to indicate The tool is ready to run
--> In the main menu, click on Scan and wait for the analysis to complete
--> At the end of the scan, the FRST.txt and Addition.txt reports are created. Post these reports in your next response.
--> The reports are saved in the same location as the tool and under C:\FRST\Logs
--> The SmartScreen filter may trigger an alert. Click on Actions or More information then click on Run anyway
---------------------------------------------------------------------------------------------
The expected reports are FRST.txt and Addition.txt
All reports must be hosted on https://security-x.fr/up/ and you indicate the obtained links in your response
--
Security contributor.
RE_
Your PC is indeed infected; you need to be careful about what you install
--------------------------------------
Uninstall:
=> NativeDesktopMediaService
=> SpyHunter 5
=> Windows Installer
=> Java 8 Update 261 (or update)
----------------
----------------------------------------
Is Chrome connected to your Google account and thus synchronized? If so,
follow this procedure to stop synchronization and delete your Google data:
All information that has been synchronized with your account is deleted, but it remains on your Chromebook. This means that information such as bookmarks,
apps, and extensions present on the Chromebook will not appear if you enable synchronization on another computer.
---------------------
----------------------------------------------------------
--> Download the file fixlist.txt here: FIXLIST in the same location as FRST <= (Important)
--> Open FRST (or FRST64) as an administrator and click on Fix
--> A fixlog file is created in the same location as FRST, post it
---------------------
----------------------------------------------------------
Run a Malwarebytes scan:
=> Download Malwarebytes Anti-Malware
=> Install the application --> Double-click the downloaded file to launch the tool
=> /!\ On Vista, Windows 7, and 8, the file must be run with a right-click ==>> Run as administrator
=> update the software before the scan.
=> Start detection by clicking Scan Now
=> At the end of the scan, if infections were found, click on Quarantine Selected
=> The PC will restart
=> After the restart, open MBAM again.
=> Click on the Report tab
=> Select the corresponding file --> Click on view report
=> Click on export --> Text File (TXT)
=> The Save File dialog opens
=> Give it a name and save it on the Desktop
=> Host the report and post the link in your next response.
Help with usage
Security contributor.
Your PC is indeed infected; you need to be careful about what you install
Procedure to follow in order
----------------------------------------------------
Uninstall:
=> NativeDesktopMediaService
=> SpyHunter 5
=> Windows Installer
=> Java 8 Update 261 (or update)
----------------
----------------------------------------
Is Chrome connected to your Google account and thus synchronized? If so,
follow this procedure to stop synchronization and delete your Google data:
All information that has been synchronized with your account is deleted, but it remains on your Chromebook. This means that information such as bookmarks,
apps, and extensions present on the Chromebook will not appear if you enable synchronization on another computer.
---------------------
----------------------------------------------------------
--> Download the file fixlist.txt here: FIXLIST in the same location as FRST <= (Important)
--> Open FRST (or FRST64) as an administrator and click on Fix
--> A fixlog file is created in the same location as FRST, post it
---------------------
----------------------------------------------------------
Run a Malwarebytes scan:
=> Download Malwarebytes Anti-Malware
=> Install the application --> Double-click the downloaded file to launch the tool
=> /!\ On Vista, Windows 7, and 8, the file must be run with a right-click ==>> Run as administrator
=> update the software before the scan.
=> Start detection by clicking Scan Now
=> At the end of the scan, if infections were found, click on Quarantine Selected
=> The PC will restart
=> After the restart, open MBAM again.
=> Click on the Report tab
=> Select the corresponding file --> Click on view report
=> Click on export --> Text File (TXT)
=> The Save File dialog opens
=> Give it a name and save it on the Desktop
=> Host the report and post the link in your next response.
Help with usage
TWO REPORTS EXPECTED
--Security contributor.
RE_
The fixes are done as needed, I do not keep them.
Have you uninstalled the indicated programs?
Run a new FRST analysis and post the new reports, I will redo the fix for you
--
Security Contributor.
The fixes are done as needed, I do not keep them.
Have you uninstalled the indicated programs?
Run a new FRST analysis and post the new reports, I will redo the fix for you
--
Security Contributor.
RE_
NativeDesktopMediaService is still present, were you unable to uninstall it?
-------------
-------------------------------
Here’s the procedure again:
Is Chrome connected to your Google account and therefore synchronized? If so,
follow this procedure to stop synchronization and delete Google data:
All information that has been synced with your account is deleted, but it remains on your Chromebook. This means that information like bookmarks,
applications, and extensions present on the Chromebook will not appear if you enable synchronization on another computer.
----------------------
---------------------------------------------
--> Download the FIXLIST file to the same location as FRST <= (Important)
--> Open FRST (or FRST64) as administrator and click on Fix
--> A fixlog file is created in the same location as FRST, post it
--> Let me know if you still have the problem.
----------------------
---------------------------------------------
Run a Malwarebytes scan:
=> Download Malwarebytes Anti-Malware
=> Install the application --> Double-click on the downloaded file to launch the tool
=> /!\ Under Vista, Windows 7, and 8, you need to launch the file by right-clicking ==>> Run as administrator
=> update the software before the scan.
=> Start detection by clicking Scan Now
=> At the end of the scan, if infections are found, click on Quarantine selected
=> The PC will restart
=> After the restart, open MBAM again.
=> Click on the Reports tab
=> Select the corresponding file --> Click on view report
=> Click on export --> Text File (TXT)
=> The Save file dialog opens
=> Give it a name and save it to the Desktop
=> Host the report and post the link in your next response.
Help for usage
Security contributor.
NativeDesktopMediaService is still present, were you unable to uninstall it?
-------------
-------------------------------
Here’s the procedure again:
Is Chrome connected to your Google account and therefore synchronized? If so,
follow this procedure to stop synchronization and delete Google data:
All information that has been synced with your account is deleted, but it remains on your Chromebook. This means that information like bookmarks,
applications, and extensions present on the Chromebook will not appear if you enable synchronization on another computer.
----------------------
---------------------------------------------
--> Download the FIXLIST file to the same location as FRST <= (Important)
--> Open FRST (or FRST64) as administrator and click on Fix
--> A fixlog file is created in the same location as FRST, post it
--> Let me know if you still have the problem.
----------------------
---------------------------------------------
Run a Malwarebytes scan:
=> Download Malwarebytes Anti-Malware
=> Install the application --> Double-click on the downloaded file to launch the tool
=> /!\ Under Vista, Windows 7, and 8, you need to launch the file by right-clicking ==>> Run as administrator
=> update the software before the scan.
=> Start detection by clicking Scan Now
=> At the end of the scan, if infections are found, click on Quarantine selected
=> The PC will restart
=> After the restart, open MBAM again.
=> Click on the Reports tab
=> Select the corresponding file --> Click on view report
=> Click on export --> Text File (TXT)
=> The Save file dialog opens
=> Give it a name and save it to the Desktop
=> Host the report and post the link in your next response.
Help for usage
Two reports expected
--Security contributor.
Désolé, je ne peux pas accéder à des liens ou à des contenus externes. Si vous avez un texte spécifique à traduire, veuillez le coller ici et je me ferai un plaisir de le traduire.
RE_
OK for Malwarebytes, but we also need the fixlog.
Answering the questions is also quite important:
OK for Malwarebytes, but we also need the fixlog.
Answering the questions is also quite important:
NativeDesktopMediaService is still present, weren't you able to uninstall it?
It is indicated in the procedure:
--> Download the FIXLIST file in the same location as FRST <= (Important)
--> Open FRST (or FRST64) as administrator and click on Fix
Security contributor.
--> Download the FIXLIST file in the same location as FRST <= (Important)
--> Open FRST (or FRST64) as administrator and click on Fix
--> A fixlog file is created in the same location as FRST, post it
--Security contributor.
Yes, I just forgot to include it with the first link, but it is in response below my previous message.
No, you put the fixlist file that I posted.
If it's still on your PC, it means you haven't made the correction.
The files are fixlist (corrective) and fixlog (result of the correction), they are not related.
--
Security contributor.
If it's still on your PC, it means you haven't made the correction.
The files are fixlist (corrective) and fixlog (result of the correction), they are not related.
--
Security contributor.
RE_
OK, it's better.
Open Chrome => click on the three dots at the top right => More tools => Extensions.
Check if you see one or more extensions Adblocker for Youtube™
If so, delete them and let me know if there were several (you can re-add it later if necessary)
--------------
Do you still have the problem with new tab?
--
Security contributor.
OK, it's better.
Open Chrome => click on the three dots at the top right => More tools => Extensions.
Check if you see one or more extensions Adblocker for Youtube™
If so, delete them and let me know if there were several (you can re-add it later if necessary)
--------------
Do you still have the problem with new tab?
--
Security contributor.
RE_
OK, you can empty the Malwarebytes quarantine:
Detection history --> Quarantined items --> Check all --> Delete
You can keep Malwarebytes as a backup and run a scan once a month. It has a 14-day trial version in resident mode, after which you'll need to run it manually for scans.
------------------
-------------------------------
To automatically delete all files/folders created by FRST and the tool itself, rename FRST/FRST64.exe to uninstall.exe and run it.
This procedure requires a restart.
------------------
-------------------------------
For me, it's all good, the PC is clean. Good luck!
PS: you can resynchronize on Chrome if needed
OK, you can empty the Malwarebytes quarantine:
Detection history --> Quarantined items --> Check all --> Delete
You can keep Malwarebytes as a backup and run a scan once a month. It has a 14-day trial version in resident mode, after which you'll need to run it manually for scans.
------------------
-------------------------------
To automatically delete all files/folders created by FRST and the tool itself, rename FRST/FRST64.exe to uninstall.exe and run it.
This procedure requires a restart.
------------------
-------------------------------
For me, it's all good, the PC is clean. Good luck!
PS: you can resynchronize on Chrome if needed