Assigned Malware redirects every Google domain from my browsers

[jeremycards]

Hello, so i've been having a weird problem since yesterday, every time i try to enter gmail, google maps, or even just do a google search from any of my browsers URL bar, i get a privacy breach error. This happens on all of my browsers.

So i ran Malwarebytes and it indeed found a redirect malware on my pc, so i proceeded to quarentine them all, but the problem persists... further scans with both Malwarebytes and Avira have no new results.

My guess is that some hosts file remain changed despite the virus being gone, but i have no idea how to find it or fix it... so, help?
attached are the files in quarentine, the error i get in Opera (tough i get the same in chrome or firefox) and the FRST file as requested. Thanks in advance for the help!

(Edit: Ok i can't attach the FRST file for the life of me, also wont let me post it in code or spoiler tags =/)

 

[jeremycards]

Spoiler: FRST file part 1

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01-04-2022
Ran by Jeremy (administrator) on ENDING_SEKAI (Gigabyte Technology Co., Ltd. H170M-DS3H) (04-04-2022 21:04:56)
Running from C:\Users\Jeremy\Desktop
Loaded Profiles: Jeremy
Platform: Microsoft Windows 10 Pro Version 21H1 19043.1620 (X64) Language: English (United States)
Default browser: Opera
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files (x86)\Avira\Antivirus\avguard.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(C:\Program Files (x86)\CCleaner Browser\Update\CCleanerBrowserUpdate.exe ->) (Piriform Software Ltd -> Piriform Software) C:\Program Files (x86)\CCleaner Browser\Update\1.8.1067.0\CCleanerBrowserCrashHandler.exe
(C:\Program Files (x86)\CCleaner Browser\Update\CCleanerBrowserUpdate.exe ->) (Piriform Software Ltd -> Piriform Software) C:\Program Files (x86)\CCleaner Browser\Update\1.8.1067.0\CCleanerBrowserCrashHandler64.exe
(C:\Program Files (x86)\Dropbox\Client\Dropbox.exe ->) (Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\145.4.4921\QtWebEngineProcess.exe <3>
(C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler.exe
(C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler64.exe
(C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe ->) (Razer USA Ltd. -> ) C:\Program Files (x86)\Razer\Synapse3\UserProcess\Razer Synapse Service Process.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Users\Jeremy\AppData\Local\Programs\Opera GX\opera.exe ->) (Opera Software AS -> Opera Software) C:\Users\Jeremy\AppData\Local\Programs\Opera GX\84.0.4316.52\opera_crashreporter.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(explorer.exe ->) (Google LLC -> ) C:\Program Files\Google\Drive File Stream\56.0.7.0\crashpad_handler.exe <2>
(explorer.exe ->) (Google LLC -> Google, Inc.) C:\Program Files\Google\Drive File Stream\56.0.7.0\GoogleDriveFS.exe <8>
(explorer.exe ->) (Valve Corp. -> Valve Corporation) F:\Steam\steam.exe
(F:\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) F:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <8>
(F:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe ->) (Skutta, Kristjan -> ) F:\SteamLibrary\steamapps\common\wallpaper_engine\bin\webwallpaper32.exe <6>
(Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe
(Opera Software AS -> Opera Software) C:\Users\Jeremy\AppData\Local\Programs\Opera GX\opera.exe <19>
(Piriform Software Ltd -> Piriform Software Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Piriform Software Ltd -> Piriform Software) C:\Program Files (x86)\CCleaner Browser\Update\CCleanerBrowserUpdate.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\protectedservice.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
(services.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(services.exe ->) (Flexera Software LLC -> Flexera) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(services.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingServices_3.63.22003.0_x64__8wekyb3d8bbwe\gamingservices.exe
(services.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingServices_3.63.22003.0_x64__8wekyb3d8bbwe\gamingservicesnet.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <2>
(services.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_015fa42d67826549\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (Popcorn Time) [File not signed] C:\Program Files (x86)\Popcorn Time\Updater.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc) C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe <2>
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(svchost.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe
(svchost.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe <3>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\pacjsworker.exe
(svchost.exe ->) (Skutta, Kristjan -> ) F:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe

Ok i keep trying to post more parts to this in replies but i keep getting an error :S let me know if there's a better way to share this file plz.

 

[nasdaq]

Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Let's check it out.


Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Ensure that you are in an Administrator Account
Double-click to run it. When the tool opens click Yes to disclaimer.
Check the boxes as seen here:

Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.
[img=[URL]http://deeprybka.trojaner-board.de/eset/eng/attachlogs.png[/URL]]

Attach the file(s). A 2 Steps process.
Reply to this topic.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach. <- Step 1.
Click Attach this file. <- Step 2.
Click the Add reply button.

Please post the logs for my review.

Let me know what problems persists.

Wait for further instructions

p.s.

The Farbar program is updated often.
If it's identified as suspicious by your Anti-Virus program trust it if Downloaded from the link I provided.
You should restore the program from the Quarantine folder.
<<<>>>

 

[jeremycards]

Ok let me try again...

Edit: Ok, it just wont work... i attach the file but once i send the reply the file dosn't show up, i guess i'll just post screenshots of the txt file since images is the only thing its allowing :S Sorry for the inconvenience, i tried on different browsers but its the same in all.

 

[jeremycards]

just in case, here's the .txt attached to this reply.

No dice... i click save and it ends up like the post above. I hope the screenshots are good enough :S

 

[nasdaq]

Hi,

That's nor working for me.

In your next reply attach the logs to this topic.

How to:

In the reply box select the Upload files button on the bottom letf.

Select the file and click attach

Do this for the 2 files that were created by the Farbar program.

Save the topic and post it.

 

[jeremycards]

i'll try again....... Ok, wow, i finally made it. Aparently there were 3 lines in particular that for some reason wouldn't let me upload the file. I had to remove them from the txt and if i copy them in this message it wont even let me post it for some reason... they were in the "registry whitelisted" part where i left a blank, i'll put a screenshot of what it was just in case.

 

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please Attach the Fixlog.txt and let me know what problem persists.

 

[jeremycards]

Done, problem persists but here's the fixlog.

 

[nasdaq]

Hi,

Google security breach.

Follow the directives on this page to find out what may cause this error.

Chrome Password Breach Warning: How to Check and Fix ASAP

Has your password been exposed in a recent data breach? Learn how to check a Chrome password breach using Chrome Password Manager.

www.maketecheasier.com

To check your passwords for security breach use this link.

Have I Been Pwned: Pwned Passwords

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

Hope that helps.

p.s.

If the problem persists and Opera is synchronized between your devices, I suggest you Sign out.
Refer to this topic

Features

Ad blocker If you block ads, web pages will load faster and look cleaner. By blocking ads with Opera's built-in ad blocker, you also block the source of many tracking cookies. The ad blocker also stops cryptocurrency mining scripts. To block ads: Go to Settings. Under Block ads, turn on Block...

help.opera.com

Follow the instructions under the Sync Section.

When done restart Opera.

Restart the computer normally.

You can Sign in after the test if all is well.
<<<>>>

 

[jeremycards]

Ah yes, i was aware of that data breach, has been a headache for a while, but i've been changing all my passwords to unique ones for a while now, the one i use right now for google is quite recent and unique so i'm fairly certain its not breached, the "i have been pwned" site seems to confirm that.

So i doubt the redirection problem is due to that, i changed my passwords a few months ago and i can enter normally from cellphones or my laptop.

 

[nasdaq]

Hi,

Try this fix.

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

If the problem persists Clear Chrome Browsing Data:

Open Chrome settings > More Tools > Clear Browsing data

Be careful what you select.

I normally only delete the browsing History, The Download history, Cached images and files.

If the problem persists Clean the passwords ... this will mean that you will have to re-enter the password when you go to sites requesting a password.

Please post the Fixlog.txt and let me know what problem persists.

 

[jeremycards]

Alright, done, the problem persist so i deleted all the browsing data in chrome, i even restored it to default since its not the browser i normally use, but it still persist :S

 

[nasdaq]

Hi,

Are you possibly using the same password on various sites?

This may be the only way to clear the password issue.

You could try by changing you passwords for the compromised sites.

https://support.qiscus.com/hc/en-us/articles/900002203186-Why-do-I-Get-Warning-A-data-breach-on-a-site-or-app-exposed-your-password-in-Chrome-

 

[jeremycards]

Hi,

Are you possibly using the same password on various sites?

This may be the only way to clear the password issue.

You could try by changing you passwords for the compromised sites.

https://support.qiscus.com/hc/en-us/articles/900002203186-Why-do-I-Get-Warning-A-data-breach-on-a-site-or-app-exposed-your-password-in-Chrome-

Well when i found out about the data breach i started changing passwords to unique ones in every important page i could think of, and also checked the list that google gives you. Since these are passwords that i had for decades by now, there were hundreds of pages i had to change, so i ignored the ones without any sensitive information or where there couldn't do any damage, so technically those are still there. But i'd imagine if that was the issue it would happen on my laptop too at least, but i can do searches and everything there with the same account with no problem... wich leads me to believe the issue was something the malware did on this pc.

 

[nasdaq]

Hi,

Are you always using the Same Profile (Account)?
If not some of the others could be compromised. (not sure)

Was Opera Synced with other devices as I previous posted in post no. 10.

Have a look at this Malwarebytes's topic.

Resetting Google Chrome to clear unexpected issues

Resetting Google Chrome to clear unexpected issues

Resetting Google Chrome to clear unexpected issues General Precautions - Recommendations Before resetting Google Chrome please review the following links and export your bookmarks to a folder location outside of any Google folders such as My Documents How to Back Up and Restore Your Chrome Bookma...

forums.malwarebytes.com

Hope that helps.

 

[jeremycards]

Hi,

Are you always using the Same Profile (Account)?
If not some of the others could be compromised. (not sure)

Was Opera Synced with other devices as I previous posted in post no. 10.

Have a look at this Malwarebytes's topic.

Resetting Google Chrome to clear unexpected issues

Resetting Google Chrome to clear unexpected issues

Resetting Google Chrome to clear unexpected issues General Precautions - Recommendations Before resetting Google Chrome please review the following links and export your bookmarks to a folder location outside of any Google folders such as My Documents How to Back Up and Restore Your Chrome Bookma...

forums.malwarebytes.com

Hope that helps.

Yes, in chrome and such i always use the same account, tho i have 3 gmail accounts for other purpouses. At least in my laptop and cell phone i don't have these problems when logged in with that same account.

Opera was synced with the mobile app, at least there im not having this issue either, in fact i usually do my searches there and share them with the pc browser with the flow option that Opera has.

Tried everything on that link, cleared the sync data and ran malwarebytes again with no detections... the problem persists =/

I'm starting to think i'll proceed with formatting the pc, some other problems are starting to pile up, like the start button only working on full screen mode and the search bar not working at all, been years since my last formatting so maybe it's time... Thanks a lot for your help! i've been asking around and nobody is able to fix the problem, so it seems i got something quite complicated going on, i hope formatting fixes everything. I really appreciate your time and effort! you guys are doing a great job at this forum, so thanks again!

 

[nasdaq]

Hi,

If I'm not too late I can give you instructions to remove Chrome Completely.
You will have to reinstall it after.