False positives

Viruses and worms
1

My Mum is having issues with what are clearly false positives.

I took control of her Laptop via Remote assistance to see it for myself.

She was quite worried that it was genuine.

It doesnt matter which website, or which browser for that matter, she is on, it happens on every page she clicks on to.

I reported these to Avast via the report pop-up box, and manually updated to have the reports sent.

She is talking about uninstalling, and installing a different AV just to get rid of the annoyance, as it is quite literally happening every single website she clicks on, and being a worrier she can’t shake the feeling its not false positives, no matter what I tell her.

I have told her not to uninstall, but I need to get rid of the pop ups for her.

Her little bas…I mean darling Grandson ::slight_smile: managed to install the Avast Pro Suite just over a month ago without realising he had done so, it after clicking on what he thought was an update pop up.

After the month trial expired she went back to the free AV.

The false positives, accompanied by the pop up advertising an upgrade to paid version, have been appearing monotonously pretty much ever since return to the free version.

Is there anything that I can do myself to get rid of this annoyance?

She is using Avast Free AV latest Engine and definitions.

It is a Windows 7 x64 machine.

Thanks for any help in solving this matter.

2

Could I have a screenshot of the alert or at least tell me what it says

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[]Select LOP and Purity
[]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir “%systemdrive%*” /S /A:L /C
/md5start
rpcss.dll
/md5stop
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

3

Thanks for your reply EssexBoy, and apologies for the delay in my reply.

I live 300 miles from my Mum, and she is a total novice when it comes to computers, so it wasn’t easy to get a screenshot, so i settled for her e-mailing me a photograph of the pop up.

This is what she sees every single website she visits.

http://i61.tinypic.com/2u5t660.jpg

Thanks in advance for any help, and once again, apologies for the delay in my reply.

4

OK it looks like an infected chrome extension. Two options either reset Chrome to default or run an OTL scan so that I can clean it up :slight_smile:

5

Thanks again for your reply

I got my Mum to set defaults and to re-enable chrome extensions one by one, and “VIS 1.0.0 Internet Security” is what is causing the problem. As soon as you disable it the pop ups stop.

I got her to disable the same extension in Firefox (Where it was also happening) and it also stopped the pop ups.

It appears, from a simple google search, that it is related to the fingerprint scanner on her laptop.

I got her to delete both extensions, and restart. No sign of the extensions reappearing, and problem has gone.

I have got her to run a Malwarebytes scan, which hasn’t finished yet.

Many thanks for your help, it’s greatly appreciated.

6

No problem, if you need anything else just shout