Virus / Malware

Here's some follow-up information.

I ran Norton's Power Eraser (NPE). I found two items: 1) vyprvpnservice.exe and 2) a registry entry. I allowed NPE to delete or fix both. The first item is actually legitimate. It's my Vypr VPN service.

I went to the website and redownloaded and installed the file. So I have my VPN back again.

I reran NPE. This time, it only identified the vyprvpnservice.exe. Because that's a false positive, I skipped it. There were no registry entries this time.

Could a registry entry be responsible for my malware? In other words, has the issue likely been addressed?

I chatted with Norton on the phone for about a half hour. He was confident that my computer was clean because the Norton Power Eraser (NPE) didn't find anything. He believes that it might be related to some of the Extensions that I am using. Or, it might simply be the websites themselves. I have difficulty with the website idea because I am going to "mainstream" websites when the problem occurs and it is *always* the same popup message that exists on a separate tab.

Out of an abundance of caution, I removed the following two extensions:

• Ghostry
• IP Address and Domain Information

My other extensions are as follows:

• Dashlane
• Office Online
• Adblock Plus
• Save to Pocket
• OneNote Web Clipper

I followed spunk's advice.

In addition to some relative innocuous stuff, ADWCleaner cleaned out 9 registry entries. I have a hunch that these might have played a role. The have the form like the following:

Code:

HKLM\Software\Classes\CLSID\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\DOMStorage\SuspiciousSite1dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\DOMStorage\wwwSuspiciousSite1dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\EdpDomStorage\SuspiciousSite1dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\EdpDomStorage\wwwSuspiciousSite1dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\DOMStorage\SuspiciousSite2dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\EdpDomStorage\SuspiciousSite2dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\DOMStorage\SuspiciousSite3dotcom
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_xxxxxxxxxxxxx\Xxxxxxxx\001\Internet Explorer\EdpDomStorage\SuspiciousSite3dotcom

I used "X" to replace various characters that are non-essential. And used "SuspiciousSite1dotcom" rather than placing the actual website.

I have a hunch that those sites were somehow responsible for supplying the garbage pop-ups.

I ran Malwarebytes. It indicated that my computer was clean.

I am running Norton again now using a full scan. So far after 3 million scanned items, it's found five tracking cookies. I suspect it won't find anything. I will wait, though, until it is done.

I hope that by deleting those registry entries my system is now clean.

Attention Moderator:

Please go to my first post in this thread and remove the hyperlink to the website. I don't trust that website. I am fearful that the website is designed to catch those wanting to remove these popups. If you to the hyperlinked site and hover over some of the links in the instructions, you will find that they don't go to where you think they should go. So please remove the hyperlink.

Stecyk said:

Attention Moderator:

Please go to my first post in this thread and remove the hyperlink to the website.

Should be able to do that yourself. Just go to post and edit.

Thank you, Moderator.

With regard to others suggesting that I should have edited the post myself, I see that I can report, quote, multi-quote, unsubscribe, print, and search. But I don't see the edit function. I must be looking in all the wrong places. Can someone, please, point me to the correct spot to edit for future reference?