Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Chrome keeps adding bookmarks by the dozens


  • Please log in to reply
7 replies to this topic

#1 THook

THook

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:52 AM

Posted 15 October 2015 - 01:22 AM

Hi!

I have four computers in my home network. All of them running on Windows 10 and (hopefully) protected by McAfee and Iobit Antimalware. My Google account is synced over these devices and my Android phone.

 

A few weeks after installing Windows 10 I noticed that the bookmarks bar in Google Chrome had som 40-50 links to "https://mail.google.com/mail/ca" . I erased them and used all kind of virus, spyware and malware searches without result.

Some days later the bookmarks were back, with a vengeance. More than 300 of them - promptly erased.

Over the months I've deleted more than 1000 instances of this bookmark. Very annoying!

 

I have tried to contact Google and Chrome "support". No answer.

McAfee's support ("Google or browser problem. Not ours.")

 

I am infected, but with what? And what else can this do in my computers? And how do I get rid of it??

 

I really hope that someone in this forum can help me.

THook

 



BC AdBot (Login to Remove)

 


#2 severac

severac

  • Members
  • 872 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Serbia
  • Local time:07:52 AM

Posted 15 October 2015 - 02:17 AM

Hello and welcome to BC,

 

Which programs did you use? 

I would uninstall Iobit. 

 

 

 

In regards to IOBit (EvonSoft.com) products, please read: .
PC Mag: IObit Security 360 Review

Quote

Poor malware removal left many executables, some actually still running. Poor malware blocking did not prevent installation of malware...it just doesn't do the job of removing malware or preventing malware installation.

.
Although, the Malwarebytes team no longer has an issue with IObit, the vendor's dubious methods would not warrant a recommendation from me to use or trust their software. Further, IOBIT has even been placed into the Installers Hall of Shame

 

 

Do you have problems with one or all four computers?


I would like to help you to remove malware. Let's look inside.   :busy:

But I don't know to solve all PC problems.  :smash: 

 


#3 THook

THook
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:52 AM

Posted 15 October 2015 - 03:22 AM

Hello and thank you for prompt answer!

 

I'm not sure what programs have been used. The browsers are synced so the bookmarks are identical. This Google- bookmark appears in a folder i*ve named "Nyheter" where I keep links to news services and papers.



#4 severac

severac

  • Members
  • 872 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Serbia
  • Local time:07:52 AM

Posted 15 October 2015 - 12:31 PM

Please download Rkill to your Desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe
http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/
 

§  Double-click on the Rkill desktop icon to run the tool.

§  If using Windows Vista, 7, 8 or 10 right-click on it and choose Run As Administrator.

§  black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

§  If not, delete the file, then download and use the one provided in Link 2.

§  Do not reboot until instructed.

§  If the tool does not run from any of the links provided, please let me know.

If normal mode still doesn't work, run the tool from Safe Mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

-----------

 

Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
NOTE. If you already have MBAM 2.0 installed scroll down.

 

§  Double-click mbam-setup-2.x.x.xxxx.exe and follow the prompts to install the program.

§  At the end, be sure a checkmark is placed next to the following:
 

o    Launch Malwarebytes Anti-Malware

o    A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.

 

§  Click Finish.

§  On the Dashboard, click the 'Update Now >>' link

§  After the update completes, on Settings tab, set under Detection and Protection next options: 

1. 'Scan for rootkits'

2. Non-Malware Protection, for 'PUP detections', check, 'Threat detections as malware' option.

§  Return to Dashboard, click the 'Scan Now >>' button.

§  A Threat Scan will begin.

§  When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

§  In most cases, a restart will be required.

§  Wait for the prompt to restart the computer to appear, than click on Yes.


If you already have MBAM 2.0 installed:
 

§  On the Dashboard, click the 'Update Now >>' link.

§  After the update completes, on Settings tab, set under Detection and Protection next options: 

1. 'Scan for rootkits'

2. Non-Malware Protection, for 'PUP detections', check, 'Threat detections as malware' option.

§  Return to Dashboard, click the Scan Now >> button.

§  A Threat Scan will begin.

§  When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

§  In most cases, a restart will be required.

§  Wait for the prompt to restart the computer to appear, than click on Yes.

§  After the restart once you are back at your desktop, open MBAM once more.

§  Click on the History tab > Application Logs.

§  Double click on the Scan Log which shows the Date and time of the scan just performed.

§  Click 'Export'.

§  Click 'Copy to Clipboard'

§  Paste the contents of the clipboard into your reply.


I would like to help you to remove malware. Let's look inside.   :busy:

But I don't know to solve all PC problems.  :smash: 

 


#5 THook

THook
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:52 AM

Posted 17 October 2015 - 04:29 AM

Thank you, severac, for trying!
I deleted more than 1000 instances of the Gmail-bookmark, and then I did all the things you suggested on all computers.
Everything looked OK for about a day, but yesterday evening they were there again.
Mbamservice and McAfee AV have been running. 
I should perhaps get rid of my Google account and all Google things, but the synced Calendar has been useful...
I'll leave Sysinternal's Process Explorer, Process Monitor and System Explorer running hoping to catch some activity, though I'm not sure I'll recognize it if I see it.
I hope you dont give up on my case.
THook
 
 
 
 
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Skanningsdatum: 2015-10-15
Skanningstid: 19:58
Loggfil: 
Administratör: Ja
 
Version: 2.2.0.1024
Databas med skadliga program: v2015.10.15.05
Databas med rootkit: v2015.10.06.01
Licens: Utvärderingsversion
Skydd mot skadliga program: Aktiverat
Skydd mot skadliga webbplatser: Aktiverat
Självförsvar: Inaktiverat
 
OS: Windows 10
CPU: x64
Filsystem: NTFS
Användare: Tomas
 
Skanningstyp: Hotskanning
Resultat: Slutförd
Skannade objekt: 486175
Förfluten tid: 49 min, 43 sek
 
Minne: Aktiverat
Autostart: Aktiverat
Filsystem: Aktiverat
Arkivfiler: Aktiverat
Rootkits: Inaktiverat
Heuristik: Aktiverat
PUP: Aktiverat
PUM: Aktiverat
 
Processer: 0
(Inga skadliga poster upptäckta)
 
Moduler: 0
(Inga skadliga poster upptäckta)
 
Registernycklar: 0
(Inga skadliga poster upptäckta)
 
Registervärden: 0
(Inga skadliga poster upptäckta)
 
Registerdata: 0
(Inga skadliga poster upptäckta)
 
Mappar: 0
(Inga skadliga poster upptäckta)
 
Filer: 1
PUP.Optional.InstallCore, C:\Users\Tomas\Downloads\installer.zip, Flyttad till karantän, [a8995dfa1e6d1d193412d7b130d1c838], 
 
Fysiska sektorer: 0
(Inga skadliga poster upptäckta)
 
 
(end)


#6 severac

severac

  • Members
  • 872 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Serbia
  • Local time:07:52 AM

Posted 17 October 2015 - 04:34 AM

Can you take a screenshot of that bookmark, I have never seen that?

 

Upload it to sendspace.com


I would like to help you to remove malware. Let's look inside.   :busy:

But I don't know to solve all PC problems.  :smash: 

 


#7 THook

THook
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:52 AM

Posted 17 October 2015 - 04:49 AM

Right now I don't have any, since I deleted them all. 

It's an ordinary Google logo G or sometimes the Gmail M logo. They are never mixed, just one repeated. The link is to https://mail.google.com/mail/ca/. 



#8 severac

severac

  • Members
  • 872 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Serbia
  • Local time:07:52 AM

Posted 17 October 2015 - 04:58 AM

Try to reset your browser settings to default:

How to Reset Your Web Browser to its default settings in Google Chrome, Firefox, Internet Explorer

 

Or to reinstall chrome.


I would like to help you to remove malware. Let's look inside.   :busy:

But I don't know to solve all PC problems.  :smash: 

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users