Waiting for reply Stubborn browser hijacker

[Plumduff]

Evening. Ok, been scrolling through various topics, but looking at walls of info.

I have a stubborn browser hijacker, currently named AnciCubel, but is coming back under various weird names.

I've done several resets of group policies which clears it for a bit, but it just comes back, displaying 'managed by your organisation' message when clicking on Chrome's 3 dots.

Anyone got any permanent solutions?

 

[Plumduff]

Fair do's.

I did the FRST scane and saw this attached to Edge:

Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Big Naddy\AppData\Local\Microsoft\Edge\User Data\Default [2024-05-17]
Edge Extension: (MagnusSpheren) - C:\Users\Big Naddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\fdphiaidaabnllehegghhiokpoligeja [2024-05-17] [UpdateUrl:hxxps://disablenotificationupdate.com/crx/updates.php] <==== ATTENTION
Edge Extension: (Google Docs Offline) - C:\Users\Big Naddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-05-10]
Edge Extension: (Adblock Plus - free ad blocker) - C:\Users\Big Naddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\gmgoamodcdcjnbaobigkjelfplakmdhh [2024-05-10]
Edge Extension: (Edge relevant text changes) - C:\Users\Big Naddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-05-11]
Edge Extension: (LunaAzureor) - C:\Users\Big Naddy\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odkkpfmbfpamgddknpijhonhinfmepeo [2024-05-17] [UpdateUrl:hxxps://disablenotificationupdate.com/crx/updates.php] <==== ATTENTION
Edge HKLM-x32\...\Edge\Extension: [odkkpfmbfpamgddknpijhonhinfmepeo] - C:\\Users\\Big Naddy\\AppData\\Local\\apps.crx [2024-05-13]

LunaAzureor is the current name of the browser hijacker extension, so I've deleted that and anything else I didn't like the look of, but it's still showing on the extension, albeit looking inactive. However, I'd also done this on previous occasions when it was cropping up under different names and it eventually pops back under a new name, so it must be hiding elsewhere then activating randomly.

Any ideas?

 

[nasdaq]

Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

In order to give you sound advice I need to see the complete logs or FRST.TXTand Additional.txt created by the Farbar program.

Please the complete log or attach the files for my review.

I wiill review them advise.

 

[Plumduff]

Files added. The extension is now calling itself HelioSpheror

 

[Plumduff]

Kicked back in again after all of those extensions deleted, now called FairyArgentius.

 

[Plumduff]

Just to add, this is what Malwarebytes found and quarantined, now removed but the hijacker is still looking at me on the extensions

 

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

 

[Plumduff]

Attached is the fixlog, and the extension now isn't showing on Chrome itself, but there is this lurking in the chrome > user data > default > estensions folder (2md attachment)

 

[nasdaq]

Hi,

CHR Extension: (Chrome Web Store Payments) - C:\Users\Big Naddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Is a (Potentially Unwanted Programs) and Malware Often Pretend to be Legitimate Applications.

Read about it.

Nmmhkkegccagdldgiimedpiccmgmieda Browser Extension - Remove Spyware & Malware with SpyHunter - EnigmaSoft Ltd

Users who dig a bit deeper into their Chrome browser could be alarmed to find an extension with the Nmmhkkegccagdldgiimedpiccmgmieda ID string. The particular extension will not be listed among the other regular browser extension installed by the user. Instead, it appears to be injected into...

www.enigmasoftware.com

To remove it run this fix attached.


Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===



Please post the Fixlog.txt and let me know what problem persists.

 

[Plumduff]

Fixlog attached. Nmmhkkegccagdldgiimedpiccmgmieda was still in the extensions folder though. Maybe it was a genuine google wallet ext, although I never use that. Got rid of it for now.

 

[nasdaq]

Hi,

If any issues in the future please let us know.

 

[Plumduff]

Thank you for the help. A very kind and thorough service you're providing here.