+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] [Resolved] Adware / Possible browser hijacker? (/showthread.php?tid=5500214)
Pages: Pages
1
2
[Resolved] Adware / Possible browser hijacker? - ze-slade - Dec 21, 2016
It started after I was completing my download https://www.xamarin.com/ It looked completely legit, it installed everything but left behind this adware that has ONLY targeted HF, whenever I click anything on hackforums it open a new tab and this is the url http://findbetterresults.com/?dn=sublyme.net&pid=9PO755G95 It might not have been xamarin, but that's the only thing I've recently installed and I didn't have this before I installed it. I've tried using malware bytes adwcleaner, but it didn't fix it it seems. Any help is appreciated.
Edit: I have scanned with mbam, it got rid of some malware, but it didn't get rid of this, it only blocks the website from loading when it opens a new tab.
* - Sparkfear - Dec 21, 2016
I'd recommend to check your extensions, also is this on 1 browser or multiple?
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 07:57 AM)Sparkfear Wrote: I'd recommend to check your extensions, also is this on 1 browser or multiple?
It's not in my extensions, when I went and checked I saw this, though https://gyazo.com/b247698b6092becac59d79fa273bf79c and for the browsers, I have no idea since I only use chrome.
* - Hackoo - Dec 21, 2016
Download Malwarebytes (v3.0.5.1299) , Adwcleaner (v6.040) and RogueKiller
perform a deep scan and post their reports
If you want to check all your statrup items that starts with windows, all running processes with their commands lines, all connections (established and in listening).
Just copy and paste this batch file on your notepad and save it as STARTUP_ITEMS.bat
Source code of STARTUP_ITEMS.bat
STARTUP_ITEMS.bat (Click to View)
Execute it as administrator to generate a report that you can copy and paste to http://pastebin.com/ or to http://textuploader.com/
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 09:55 AM)Hackoo Wrote: Download Malwarebytes (v3.0.5.1299) , Adwcleaner (v6.040) and RogueKiller
perform a deep scan and post their reports
If you want to check all your statrup items that starts with windows, all running processes with their commands lines, all connections (established and in listening).
Just copy and paste this batch file on your notepad and save it as STARTUP_ITEMS.bat
Source code of STARTUP_ITEMS.bat
STARTUP_ITEMS.bat (Click to View)
Execute it as administrator to generate a report that you can copy and paste to http://pastebin.com/ or to http://textuploader.com/
Scanning with mbam now, I already did one with adwcleaner yesterday and got rid of some adware but not this one, mbam is blocking the website each time it pops up now, but it doens't get rid of the tab.
* - Hackoo - Dec 21, 2016
Did your tried with roguekiller ?
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 11:38 AM)Hackoo Wrote: Did your tried with roguekiller ?
Not yet, I'm scanning with mbam first.
* - ｋａ＄ｈ - Dec 21, 2016
Post that log when you can
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 09:55 AM)Hackoo Wrote: Download Malwarebytes (v3.0.5.1299) , Adwcleaner (v6.040) and RogueKiller
perform a deep scan and post their reports
If you want to check all your statrup items that starts with windows, all running processes with their commands lines, all connections (established and in listening).
Just copy and paste this batch file on your notepad and save it as STARTUP_ITEMS.bat
Source code of STARTUP_ITEMS.bat
STARTUP_ITEMS.bat (Click to View)
Execute it as administrator to generate a report that you can copy and paste to http://pastebin.com/ or to http://textuploader.com/
(Dec 21, 2016 01:33 PM)ｋａ＄ｈ Wrote: Post that log when you can
http://pastebin.com/QkJBZx3s here are the logs, if you want any more logs from mbam/awd let me know.
* - ｋａ＄ｈ - Dec 21, 2016
So you are saying that your still getting ad pop-ups but they are just getting blocked because you have MBAM installed
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 03:11 PM)ｋａ＄ｈ Wrote: So you are saying that your still getting ad pop-ups but they are just getting blocked because you have MBAM installed
Yeah, it's really annoying and making HF unusable, it doesn't do this to ANY other site but HF.
![[Image: 9ffb8d7eb9baf4b12156d41389ba6a92.gif]](https://i.gyazo.com/9ffb8d7eb9baf4b12156d41389ba6a92.gif)
* - ｋａ＄ｈ - Dec 21, 2016
If you haven't I would suggest clearing your temp files/browser cache and resetting google chrome to its default settings.
It may be easier to run CCleaner but that is up to you.
I am having a look at the log you posted now.
Another program which may be worth running: MB Junkware Removal Tool
If you still see no results, it might be possible that something is conflicting with the removal of the adware, it may be worth it to boot to safe mode and run the tests again. It may seem pointless but it does occur.
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 03:31 PM)ｋａ＄ｈ Wrote: If you haven't I would suggest clearing your temp files/browser cache and resetting google chrome to its default settings.Neither worked, here are the logs from the tool: http://pastebin.com/uf9umDX8
It may be easier to run CCleaner but that is up to you.
I am having a look at the log you posted now.
Another program which may be worth running: MB Junkware Removal Tool
If you still see no results, it might be possible that something is conflicting with the removal of the adware, it may be worth it to boot to safe mode and run the tests again. It may seem pointless but it does occur.
* - ｋａ＄ｈ - Dec 21, 2016
(Dec 21, 2016 06:48 PM)ze-slade Wrote: Neither worked, here are the logs from the tool: http://pastebin.com/uf9umDX8
If it is still occurring then it's likely to still be bundled with one of the programs you installed, I would need the results from a scan of Farbar Recovery Scan to diagnose what it could possibly be, most likely free software/software that wasn't downloaded from the original source.
If you have an idea you can go and look yourself and uninstall/terminate processes to anything you do not need/recognise or you can run the diagnostic and I will look for things that I find suspicious.
The fact that each scan you ran persisted to find more is also interesting, if you haven't maybe re-run one and see if it comes back with the same/more results. If it only occurs in Chrome, you should also uninstall/re-install.
* - ze-slade - Dec 21, 2016
(Dec 21, 2016 07:32 PM)ｋａ＄ｈ Wrote: If it is still occurring then it's likely to still be bundled with one of the programs you installed, I would need the results from a scan of Farbar Recovery Scan to diagnose what it could possibly be, most likely free software/software that wasn't downloaded from the original source.Nothing suspicious in my task manger, can you provide a safe download to fabar? I don't feel like getting more adware. The thing that REALLY irks me about this adware is it doesn't target anything else besides hackforums, any other website I've visited had no issues what so ever.
If you have an idea you can go and look yourself and uninstall/terminate processes to anything you do not need/recognise or you can run the diagnostic and I will look for things that I find suspicious.
The fact that each scan you ran persisted to find more is also interesting, if you haven't maybe re-run one and see if it comes back with the same/more results. If it only occurs in Chrome, you should also uninstall/re-install.