Reimage Repair/DNS Unlocker popups remaining

[thebluenose]

Right. I've done that. I THINK. We're clear now. Thanks for the help. Want me to run another FRST scan?

 

[TwinHeadedEagle]

If everything is okay, I don't need them.

 

[thebluenose]

We're not clear. Just had a popup in Steam and now they've returned to Chrome. Adwcleaner just found nothing malicious on the PC

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[thebluenose]

Kinda nuked the system last night with multiple scans as well as reinstalling chrome and steam and I've had no problems since reinstalling stuff at 10am UK time so I should hope that it's clean now. Either way here's the FRST results.

 

[TwinHeadedEagle]

Okay, let me know within few days if everything is okay.

 

[thebluenose]

Yeah we're not clean, I have no idea what's setting it off since I haven't installed anything in the time I've been clean

 

[TwinHeadedEagle]

Is it happening in all browsers? Did you reinstall system?

 

[thebluenose]

It was only in the Steam browser just then. I was browsing the store and got a redirect. Instantly uninstalled and cleared the local appdata of steam and it seems to be clear now.

Just finding it very confusing and frustrating as I can't see an obvious source of infection

 

[TwinHeadedEagle]

• Press the
  
  + R on your keyboard at the same time. Type ncpa.cpl and click OK.
• Find you internet adapter, usually Local Area Connection if connection is wired.
• Right click on it and select Properties.
• Click on Internet Protocol Version 4 and select Properties again.
• Make sure that IP Address and DNS Server are set to automatically.

 

[thebluenose]

Done. It already was set to auto

 

[thebluenose]

yep it was just in chrome now. Just had popups on dota2.gamepedia

 

[TwinHeadedEagle]

Scan with Malwarebytes' Anti-Malware

Please re-run

Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
• In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

 

[thebluenose]

I have bitten the bullet and reformatted. This thing is just proving too damn stubborn and I've got my important data stored elsewhere . If The infection returns with no changes to my habits is it safe to say the network is infected?

 

[TwinHeadedEagle]

Keep me updated.

 

[thebluenose]

Yep. Just had popups on Chrome within an hour of completely reformatting and reinstalling Chrome. Can only assume it's my Chrome account or the network. Any ideas?

 

[TwinHeadedEagle]

Did you login into your Google account? Sometimes it is the problem, because it synchronizate and bring some unwanted settings.

 

[thebluenose]

Yes I did. I am starting to think that google account is the problem

 

[TwinHeadedEagle]

Uninstall Chrome completely now and install again, but do not login into your Google account.

You can also try some suggestions from this link:

Sign out of Chrome or delete a synced account - Chrome Help

 

[thebluenose]

I have completely uninstalled Chrome and deleted the localappdata folder and have installed firefox instead.
I have not signed into my Google account. Do I just leave that account now and assume it as compromised?