PLEASE HELP (Chrome)

[Kanna]

I'm about to lose my mind first my chrome was managed by organization fixed that thanks to the forum reinstalled chrome scanned malwarebytes nothing logged in and then 2 PUP dsrlte which I know is a browser hijacker please help

[Void Master]

Seems like some sort of weird adware, what extensions do you have installed ?

[PorkishPig]

If you're going to start a new thread, at least link the previous ones so you don't get the same suggestions. I don't quite understand what wasn't resolved from the last thread.

 

[Void Master]

Do you have some weird free apps installed ? What about deleting all chrome files in %APPDATA% then reinstalling?

[Kanna]

4 minutes ago, PorkishPig said:

If you're going to start a new thread, at least link the previous ones so you don't get the same suggestions. I don't quite understand what wasn't resolved from the last thread.

 

The virus part only the managed my organization part got fixed but there is still somehow a hijacker in my browser

[PorkishPig]

Just now, Kanna said:

The virus part only the managed my organization part got fixed but there is still somehow a hijacker in my browser

What exactly is it doing..?

[Kanna]

Just now, Void Master said:

Do you have some weird free apps installed ? What about deleting all chrome files in %APPDATA% then reinstalling?

Read the thread the other guy linked (no weird apps installed only steam and some programs I know is safe)

[Kanna]

Just now, PorkishPig said:

What exactly is it doing..?

Turning homepage into yahoo back to back and giving me positives on MB

[PorkishPig]

10 minutes ago, Kanna said:

Turning homepage into yahoo back to back and giving me positives on MB

Malwarebytes is perfectly capable of removing malware. If it is reporting a positive, remove it and restart. Then reinstall Chrome again, making sure use the clear data option when uninstalling.

[Void Master]

11 minutes ago, Kanna said:

Turning homepage into yahoo back to back and giving me positives on MB

Well if your Antivirus can't remove the threat, then i would probably backup my data and reset windows (choose to remove your files after you backup your stuff, as malware might be somewhere in %APPDATA%). You'll end up spending less time then digging deep into the roots of the issue.

[Kanna]

Just now, PorkishPig said:

Malwarebytes is perfectly capable of removing malware. If it is reporting a positive remove it, and restart. Then reinstall Chrome again, making sure use the clear data option when uninstalling.

It doesn't remove it it just comes back I think it is saved in my account somewhere (not sure tho)

[Kanna]

Just now, Void Master said:

Well if your Antivirus can't remove the threat, then i would probably backup my data and reset windows (choose "remove your files after you backup your stuff, as malware might be somewhere in %APPDATA%). You'll end up spending less time then digging deep into the roots of the issue.

This was before my windows reinstall to

[Void Master]

4 minutes ago, Kanna said:

It doesn't remove it it just comes back I think it is saved in my account somewhere (not sure tho)

4 minutes ago, Kanna said:

This was before my windows reinstall to

Seems like that your account got somehow hacked, try monitoring login activity and changing your password (maybe enable 2FA)

[PorkishPig]

4 minutes ago, Kanna said:

It doesn't remove it it just comes back I think it is saved in my account somewhere (not sure tho)

Well then it's self-replicating malware. If you want, you can send me your complete install list with https://www.nirsoft.net/utils/uninstallview-x64.zip. Same deal as Autoruns, send me the .txt file after CTRL+S.

 

I do, however, agree with @Void Master. Given that we already have a thirty reply long thread, attempting to resolve every issue with your OS may be a waste of time.

[Kanna]

5 minutes ago, Void Master said:

Seems like that your account got somehow hacked, try monitoring login activity and changing your password (maybe enable 2FA)

Looked thru my account no suspicious sign ins already have 2FA phone sync changed password recently this hijacker has been here for so long 

[Kanna]

7 minutes ago, PorkishPig said:

Well then it's self-replicating malware. If you want, you can send me your complete install list with https://www.nirsoft.net/utils/uninstallview-x64.zip. Same deal as Autoruns, send me the .txt file after CTRL+S.

 

I do, however, agree with @Void Master. Given that we already have a thirty reply long thread, attempting to resolve every issue with your OS may be a waste of time.

 

KannDesktop.txt

[PorkishPig]

12 minutes ago, Kanna said:

KannDesktop.tx301.93 kB · 2 downloads

Yep, there's nothing there, it doesn't have an uninstaller. You can try SuperAntiSpyware from https://www.superantispyware.com/download.html, but I don't think there's much left that you can do.

[Kanna]

Just now, PorkishPig said:

Yep, there's nothing there. it doesn't have an uninstaller. You can try SuperAntiSpyware from https://www.superantispyware.com/download.html, I don't think there's much left that you can do.

I will contact google support suspect google synced something from my laptop back in the day and just left it in the sync storage

[PorkishPig]

1 minute ago, Kanna said:

I will contact google support suspect google synced something from my laptop back in the day and just left it in the sync storage

Google has a guide on resetting synced data at https://support.google.com/chromebook/answer/2914794?hl=en. Have you been signing in every time you reinstalled Chrome?

[Kanna]

Just now, PorkishPig said:

Google has a guide on resetting synced data at https://support.google.com/chromebook/answer/2914794?hl=en. Have you been signing in every time you reinstalled Chrome?

Yes that's why I suspect that but I don't want to reset everything since I sign in for a reason

[PorkishPig]

Just now, Kanna said:

Yes that's why I suspect that but I don't want to reset everything since I sign in for a reason

Yeah, uh, reinstall and don't sign in. See if the issue occurs. I was under the impression that you were making a clean profile.

[Kanna]

1 minute ago, PorkishPig said:

Yeah, uh, reinstall and don't sign in. See if the issue occurs. I was under the impression that you were making a clean profile.

Didn't I include that it is only after signing in, clean profile explain?

[PorkishPig]

Just now, Kanna said:

Didn't I include that it is only after signing in, clean profile explain?

I don't believe you did. You can just close the sign in tab when you install Chrome or create a new profile, that's a clean profile.

[Kanna]

Just now, PorkishPig said:

I don't believe you did. You can just close the sign in tab when you install Chrome or create a new profile, that's a clean profile.

Well I can't do that since I sign in for a reason all my passwords and phone stuff is on the account 

[PorkishPig]

2 minutes ago, Kanna said:

Well I can't do that since I sign in for a reason all my passwords and phone stuff is on the account 

Just uninstall the offending extensions if present and manually change your search engine back to Google.