+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Ads.. ads... and more ads. (/showthread.php?tid=4701455)
Ads.. ads... and more ads. - prada ⠀ - Feb 23, 2015
No clue what's up... don't really understand this stuff too much. Every time I go to click a link on my web browser, it opens another tab with some random ad. I have to click it a few times to even be able to click the link. I ran adwcleaner, JRT, and Malware Bytes and none have been of any help. If anyone can help or point me in the right direction, that'd be cool.
* - immortalwon - Feb 23, 2015
Hit me up with your teamviewer for fast and easy support. Will get this thoroughly checked out.
* - Impulses - Feb 23, 2015
I realize this is quite primitive, but one of the first things I always do, is check extensions, then look through installed programs. I've actually found that a lot of anti-virus programs, such as MalwareBytes, won't pick up on "self-installed" programs. Just browse through your installed programs list, if there is something that you aren't familiar with, Google it, and see what it checks out to be.
As far as extensions go, just repeat the same process you did with the Installed Programs list.
Private-message me if you'd like more, in-depth assistance.
* - Orchid - Feb 23, 2015
Prada,
Tomorrow I will help you, I will do it 1:1.
Let me know on Skype.
* - immortalwon - Feb 23, 2015
Problem remains unresolved for now, very persistent adware. I think some of his programs he has are responsible.
* - HoshHash - Feb 23, 2015
Whats the name of the ads if i may ask?
* - desynk - Feb 24, 2015
What browser are you using? You'll most likely need to completely uninstall it, manually remove the folders in %appdata%, then reinstall it to get rid of it. That's what's worked for me in the past with persistent adware. It's either that or you have something more malicious on your system.
* - prada ⠀ - Feb 24, 2015
(Feb 24, 2015 01:49 AM)desynk Wrote: What browser are you using? You'll most likely need to completely uninstall it, manually remove the folders in %appdata%, then reinstall it to get rid of it. That's what's worked for me in the past with persistent adware. It's either that or you have something more malicious on your system.
It was doing it with both Firefox and chrome if that makes a difference
(Feb 23, 2015 11:36 PM)Farfar Wrote: Whats the name of the ads if i may ask?
They are usually all different but one I see consistently is adcash
* - Nick Burkhardt - Feb 24, 2015
You could check your Google Chrome extensions, some extensions are a pain in the ***.
I just did a checkup on someone who had an extension that made ads popup everywhere... Could be the same :)
And I always recommend that you run an adware scan.
Step 1. Junkware Removal Tool
- *Please download Junkware Removal Tool to your desktop.
*Shutdown your antivirus to avoid any conflicts. Also they can interfere with eachother and cause damage to your system.
*Right click over JRT.exe and select Run as administrator on Windows *Vista or Windows 7, double-click on XP.
*The tool will open and start scanning your system.
*Please be patient as this can take a while to complete.
*When finished, a log (JRT.txt) is saved to your desktop and will automatically open.
*Post the contents of JRT.txt into your next reply message on here, or www.Pastebin.com
*When completed make sure to re-enable your antivirus
Step 2. AdwareCleaner
- Lets clean out any adware now: (this will require a reboot so save all your work)
*Please download AdwCleaner by Xplode and save to your Desktop.
*Double click on AdwCleaner.exe to run the tool.
*Vista/Windows 7/8 users right-click and select Run As Administrator
*Click on the Scan button.
*AdwCleaner will begin...be patient as the scan may take some time to complete.
*When it's done you'll see: Pending: Please uncheck elements you don't want removed.
*Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
*Look over the log especially under Files/Folders for any program you want to save.
*If there's a program you may want to save, just uncheck it from AdwCleaner.
*If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
*If you're ready to clean it all up.....click the Clean button.
*After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
*Copy and paste the contents of that logfile in your next reply, or on www.Pastebin.com
*A copy of that logfile will also be saved in the C:\AdwCleaner folder.
*Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
NOTE: To restore an item that has been deleted:
NOTE: Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
* - HoshHash - Feb 24, 2015
(Feb 24, 2015 11:40 AM)David S Wrote: It was doing it with both Firefox and chrome if that makes a differenceIf this dosent help you, I will help you.
They are usually all different but one I see consistently is adcash
http://malwaretips.com/blogs/adcash-com-removal/
* - prada ⠀ - Feb 24, 2015
(Feb 24, 2015 11:54 AM)JonasDK Wrote: You could check your Google Chrome extensions, some extensions are a pain in the ***.
I just did a checkup on someone who had an extension that made ads popup everywhere... Could be the same :)
And I always recommend that you run an adware scan.
Step 1. Junkware Removal Tool
- *Please download Junkware Removal Tool to your desktop.
*Shutdown your antivirus to avoid any conflicts. Also they can interfere with eachother and cause damage to your system.
*Right click over JRT.exe and select Run as administrator on Windows *Vista or Windows 7, double-click on XP.
*The tool will open and start scanning your system.
*Please be patient as this can take a while to complete.
*When finished, a log (JRT.txt) is saved to your desktop and will automatically open.
*Post the contents of JRT.txt into your next reply message on here, or www.Pastebin.com
*When completed make sure to re-enable your antivirus
Step 2. AdwareCleaner
- Lets clean out any adware now: (this will require a reboot so save all your work)
*Please download AdwCleaner by Xplode and save to your Desktop.
*Double click on AdwCleaner.exe to run the tool.
*Vista/Windows 7/8 users right-click and select Run As Administrator
*Click on the Scan button.
*AdwCleaner will begin...be patient as the scan may take some time to complete.
*When it's done you'll see: Pending: Please uncheck elements you don't want removed.
*Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
*Look over the log especially under Files/Folders for any program you want to save.
*If there's a program you may want to save, just uncheck it from AdwCleaner.
*If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
*If you're ready to clean it all up.....click the Clean button.
*After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
*Copy and paste the contents of that logfile in your next reply, or on www.Pastebin.com
*A copy of that logfile will also be saved in the C:\AdwCleaner folder.
*Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
NOTE: To restore an item that has been deleted:
NOTE: Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
JRT Log: http://pastebin.com/BZ9xV1L9
AdwCleaner Log: http://pastebin.com/mbBq9fDP
Problem is persisting despite the files being removed. The file that was removed was downloaded last night in an effort to fix the problem, so it's safe to say that program isn't the issue.
* - Orchid - Feb 24, 2015
(Feb 24, 2015 01:31 PM)David S Wrote: JRT Log: http://pastebin.com/BZ9xV1L9
AdwCleaner Log: http://pastebin.com/mbBq9fDP
Problem is persisting despite the files being removed. The file that was removed was downloaded last night in an effort to fix the problem, so it's safe to say that program isn't the issue.
Download FRST and make sure Addition is ticked, press scan and let me know.
* - prada ⠀ - Feb 24, 2015
(Feb 24, 2015 01:35 PM)Orchid Wrote: Download FRST and make sure Addition is ticked, press scan and let me know.
addition.txt: http://pastebin.com/wabSzRAA
FRST.txt: http://pastebin.com/tkkL5SUu
* - HoshHash - Feb 24, 2015
So is someone taking a look at his logs now or should i do it, or Null Byte?
* - prada ⠀ - Feb 24, 2015
The ads stopped appearing for some reason, very sudden. I'm sure the issue is not resolved as I have not done anything furthermore to fix it, I believe it paused if that makes sense.