This just started a couple of days ago, and at first it was always this URL noted “http://bnud7nkk.com/ads.php?sid=1911”, but today there have been different URLs listed in the Object field. When it first started I attempted to use System Restore to a point a few hours before this started, but it didn’t fix the problem. Now I have to run Avast on silent/gaming mode, otherwise the warning pop-ups come up every 10 seconds or so. It’s definitely slowing my computer down.
I read the sticky about Malwarebytes and Logs, and have attached the logs below (Malwarebytes didn’t find anything, and when I tried to run aswMBR scan I kept getting a message that said scan error).
Just got another warning pop-up, also URL:Mal, but this time instead of explorer.EXE it’s coming from C:\Program Files\Google\Chrome\Application\chrome.exe
I didn’t use a USB stick or download a program. I only got that warning pop-up a couple of times, though, so not nearly as frequently as the one that was really slowing me down before.
Thanks again for all your help. It is sincerely appreciated.
Log attached below.
I’ll let my computer run for a little bit and do a few re-starts over the next hour and let you know if I get any more warning pop-ups.
I jinxed it. After leaving the computer off for a few hours, I just booted it up and got about 20 warning pop-ups in a row. I opened Chrome pretty soon after boot up, so I’m not sure if that set them off. I’ll get a barrage of them that Avast blocks, then nothing for a few minutes, then another barrage.
It’s the same URL:Mal and chrome.exe deal, and they all point to ninthclub(dot)com.
Chrome is about the most insecure browser around at the moment and there are multiple ways that it is being infected that are hidden from all my scanners
Re-install Chrome
If you have bookmarks, let’s save them by exporting them - Export Bookmarks
Then I need you to go Google Sync and sign into your account
Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
Import your bookmarks back into Chrome
Sign back in to your Chrome browser so that your bookmarks sync with your online account.
looks like this wasn’t fixed or has returned:
HKU\S-1-5-21-3056341256-334452140-1155790583-1001.…\Run: [WejIsbe] => regsvr32.exe “C:\Users\JJ\AppData\Roaming\Gulaz\SotePbanb.dll”
Okay, I will do that here in a little bit and report back.
Also, on startup I’m getting some windows that pop-up for a couple of seconds (not from Avast) that say “Injector Loaded” and “BC Loaded”. That’s also something that wasn’t happening before all this started.
Sorry it’s taken me a day to respond - I wanted to give this newest fix a little time to see if it was going to work. Unfortunately, after no trouble yesterday, the warning pop-ups for URL:Mal from chrome.exe directing to ninthclub(dot)com have returned. I followed your directions about uninstalling Chrome, running the fix you provided, then reinstalling Chrome as provided, with a couple of caveats: when I go to Google Sync, I don’t see a “Stop and Clear” button, but instead a button that says “Reset Sync” - I clicked that. Then, when uninstalling Chrome, I don’t see an option about user data or settings, but instead a box that says “Also delete your browsing data” - I clicked that, as well.
Attached is the log after running the fix yesterday (after uninstalling Chrome), as well as my FRST logs from this morning after the problem returned (after reinstalling Chrome yesterday).
Thanks again - this is turning out to be a persistent little sh!t.
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please RIGHT-CLICK HERE and Save As (in IE it’s “Save Target As”, in FF it’s “Save Link As”) to download Silent Runners.
[*]Save it to the desktop.
[*]Run Silent Runner’s by doubleclicking the “Silent Runners” icon on your desktop.
[*]You will receive a prompt: Do you want to skip supplementary searches?
click NO
[*]If you receive an error just click OK and double-click it to run it again - sometimes it won’t run as it’s supposed to the first time but will in subsequent runs.
[*]You will see a text file appear on the desktop - it’s not done, let it run (it won’t appear to be doing anything!)
[*]Once you receive the prompt All Done!, open the text file on the desktop, copy that entire log, and paste it here. NOTE If you receive any warning message about scripts, please choose to allow the script to run.
I can’t seem to get Silent Runners to run. When I double-click on it, it just opens up a document in WordPad. The FAQ on their website says that when that happens to use the command prompt to launch it, but after navigating to the directory in which it’s saved, I try cscript.exe “Silent Runners.vbs” and get the response “can not find script file”. When I use the dir command, I see that it’s Silent Runners.vbs.txt - is that the problem? I tried cscript.exe “Silent Runners.vbs.txt” and it didn’t like that, either. I’ve attached a screen shot of my attempt to run Silent Runners via the command prompt.
I’ve also attached the log after running the most recent fix.
