Virus or malware/adware. Anyone else had this problem and can help sort it?

[BigBird]

Don't know where this has come from but has anyone got an idea about getting rid. Malwarebytes found stuff during a search and was removed but the problem is still there. Comodo internet security is running a scan now but I'm not convinced it will sort it.

It.s been years since I have had any problems. Everything was fine last night. Now today I am getting this Malwarebytes message with almost every page I visit on the net.




Also notice that many words in the forum posts have become links to adverts. They are all over the place. I know its something my end adding the link to the text and not anything to do with DF.




Also occasionally get these pop up apparent surveys. They are not genuine but are made to look as if they are part of whatever site you are visiting.




Whois information came up with this:

IP Address 162.210.192.22 Whois Lookup

Find IP Address is designed to provide you information about the given IP Address 162.210.192.22.
The whois lookup can tell you the owner of the IP Address 162.210.192.22. You can use this information to contact the owner in case of abuse or spam report.

WHOIS INFO FOR IP ADDRESS 162.210.192.22 .# # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=16...se&ext=netref2 # NetRange: 162.210.192.0 - 162.210.199.255 CIDR: 162.210.192.0/21 OriginAS: AS30633 NetName: LEASEWEB-US NetHandle: NET-162-210-192-0-1 Parent: NET-162-0-0-0-0 NetType: Direct Allocation RegDate: 2013-04-26 Updated: 2013-04-26 Ref: http://whois.arin.net/rest/net/NET-162-210-192-0-1 OrgName: Leaseweb USA, Inc. OrgId: LU Address: 9480 Innovation Dr City: Manassas StateProv: VA PostalCode: 20109 Country: US RegDate: 2010-09-13 Updated: 2013-08-06 Comment: www.leaseweb.com Ref: http://whois.arin.net/rest/org/LU OrgNOCHandle: LEASE-ARIN OrgNOCName: Leaseweb ARIN OrgNOCPhone: +1-571-814-3777 OrgNOCEmail: arin@leaseweb.com OrgNOCRef: http://whois.arin.net/rest/poc/LEASE-ARIN OrgAbuseHandle: LUAD1-ARIN OrgAbuseName: Leaseweb US abuse dept OrgAbusePhone: +1-571-814-3777 OrgAbuseEmail: abuse@leaseweb.us OrgAbuseRef: http://whois.arin.net/rest/poc/LUAD1-ARIN OrgTechHandle: LEASE-ARIN OrgTechName: Leaseweb ARIN OrgTechPhone: +1-571-814-3777 OrgTechEmail: arin@leaseweb.com OrgTechRef: http://whois.arin.net/rest/poc/LEASE-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html #

[ss30]

I have had this in the past but can't remember how to get rid of it.

Have you tried using a restore point?

[BigBird]

I have had this in the past but can't remember how to get rid of it.

Have you tried using a restore point?

Thanks. Hadn't thought of that. For some reason I have to into safe mode to use restore. Will try it later if I cant sort any other way. (">

[akimba]

Is it all browsers or a specific one, check msconfig to see if anything rogue is starting up when you boot up (look for process names/regkeys and file paths)

[EvilBoB]

I tend to run a combination of Spybot S+D and Malwarebytes along with AVG and it keeps my machines fresh. I'd recommend trying Spybot though http://www.safer-networking.org/dl/ just the free one and do a scan.

[BigBird]

I tend to run a combination of Spybot S+D and Malwarebytes along with AVG and it keeps my machines fresh. I'd recommend trying Spybot though http://www.safer-networking.org/dl/ just the free one and do a scan.

Already have Spybot running but this wasn't picked up. Always used Spybot S+D and Malwarebytes with either AVG, Alvira, or my current anti virus which is Comodo. Always updated for any new threats. This is the first time anything has got through. (">

[TotallyRandom]

If i see a virus like that i just tend to grab data and OS re install as the time you spend messing about trying to remove it

you could be back up and running with guaranteed to be removed

[plug1]

Does it happen with ie and chrome ?

[davey52]

I generally use Malwarebytes in safe mode without networking., usually finds stuff that it misses when in full windows mode

[BigBird]

Does it happen with ie and chrome ?

In chrome the malwarebytes warning pops up and some text is being linked to popup ads from 'local.smartshopping'. In Firefox I still get the malwarebytes warning but the ad links that are created on any page is from 'Tidy Network'.

In Explorer there is no malwarebytes warning coming up at all but the ad links are there and from 'Tidy Network'. (">

[evilsatan]

Have you checked browser add-ons, startup records, services etc? Download and run Rkill, once that completes try a full MBAM scan.

[plug1]

I would try rkill and combofix if you haven't all ready

[ZX7R]

My usual routine:

1) Reboot to Safe mode with networking
2) download and run (from bleeping computer website)
- Rkill
- Tdsskiller
- tfc (temp file cleaner)
- Malwarebytes full scan

After all this you may need to restore default homepage and remove any shite browser addons , present.

If that doesn't work then I resort to combofix

[BigBird]

Just completed a full scan after running Rkill. Removed over a thousand items including 'Tidy Network' and loads relating to 'smartbar'. Rebooted and still have exactly the same problem. Will try all the tools you mention ZX7R and see if that lot will do the trick. If not then it will be a restore point or a reinstall of windows. (">

[plug1]

Have you uninstalled any suspect programs .
toolbars ect . From control panel ?

post a screen cap if you are stuck of what you have installed .

these days you need to clk the advanced tab on instal of most programs or you
get fooled to agreeing to lots of malware .

[TotallyRandom]

1000 items? Bite the bullet and reinstall it

Sent from my GT-P5210 using Tapatalk

[DejaVu]

1000 items? Bite the bullet and reinstall it

Sent from my GT-P5210 using Tapatalk

+1. Your PC's a mess.

Sent from my HTC One using Tapatalk

[Mobileman]

You running pro or free version of malwarebytes out of interest ? Get pro and add eset IMO once sorted.

Had 80 year old down street bring me his laptop about month ago 1368 items found on malwarebytes and had to uninstall around 20 rouge programs took best part of day to sort !

[plug1]

Reinstalling windows is admitting defeat . Get it fixed and learn something .

[BigBird]

My usual routine:

1) Reboot to Safe mode with networking
2) download and run (from bleeping computer website)
- Rkill
- Tdsskiller
- tfc (temp file cleaner)
- Malwarebytes full scan

After all this you may need to restore default homepage and remove any shite browser addons , present.

If that doesn't work then I resort to combofix

Zip-a-dee-doo-dah, zip-a-dee-ay, My oh my what a wonderful day!




Thanks to all who contributed to my quest for a clean PC.

Followed ZX7R's procedure but nothing worked up until I ran his final suggestion combofix. After Rkill, tdskiller, tfc and malwarebytes, followed by a reboot, the problem was still there even though over a thousand items had been removed. Plug1 also mentioned combofix and on this occasion it was the right tool for the job. Don't know if the other options I first tried had paved the way for combobox to succeed but all is good now.

Glad I stuck it out. In the past it would have been a restore or a reinstall. (">