Page 1 of 2 12 LastLast
  1.    24 Oct 2015 #1
    Join Date : Jan 2014
    Indiana/Florida
    Posts : 1,580
    Windows 10 Home x64

    Taobao infection


    Color me embarrassed but I seem to have picked up ........... something. As you can see from my screenshot my Browser has gotten a .....visitor and I can't seem to make it leave. It seems to be a shortcut to Taobao. I've tried scans with Malwarebytes,SuperAntiSpyware,ADWcleaner, JRT,and Panda A/V (free) to no avail. Any suggestions?

    Click image for larger version. 

Name:	Screenshot_1.png 
Views:	18 
Size:	258.6 KB 
ID:	44436
      My ComputerSystem Spec
  2.    24 Oct 2015 #2
    Join Date : Feb 2015
    Posts : 3
    Dual Boot 10 Pro v1607 10 Pro rs2 build 14971

    It looks like a browser toolbar. In IE try going to Settings>manage Add-ons > Toolbars and extensions. You should be able to delete it there. The other one I have seen lately resets your homepage. By going to control panel>Internet options general tab will allow you to reset the homepage.
      My ComputerSystem Spec
  3.    24 Oct 2015 #3
    Join Date : Jan 2014
    Indiana/Florida
    Posts : 1,580
    Windows 10 Home x64
    Thread Starter

    Well, this is Maxthon but I tried resetting. Tried a few more things ........ then just deleted the browser and reinstalled. No idea where I got it or how it eluded everything I tried but it did. Its gone now, but thanks for the suggestion.
      My ComputerSystem Spec
  4.    25 Oct 2015 #4
    Join Date : Jul 2015
    Posts : 903
    Windows 10 Home x64

    Try ZHPCleaner and RogueKiller too.
      My ComputerSystem Spec
  5.    25 Oct 2015 #5

    Maxthon has addons as well, a lot of which I would not consider using. Go to Menu - Tools - Extensions and see if theres any unwarranted addon there.
      My ComputersSystem Spec
  6.    25 Oct 2015 #6
    Join Date : Jan 2014
    Indiana/Florida
    Posts : 1,580
    Windows 10 Home x64
    Thread Starter

    O.K. ......... Its back. Came back yesterday evening about an hour after I thought I'd gotten rid of it. It is only on the tabs after the main one and it turns off AdBlock Plus, (Its bundled into my Browser), but only on the unopened tabs. In addition to what I have already mentioned I've ran RougeKiller, ZHP Cleaner, BitDefender online rootkit scan,Malwarebytes Rootkit scanner, Malwarebytes Chameleon and at least a couple more that just don't come to mind. I've reset my Browser to defaults to no avail and even reinstalled Maxthon cleanly (no saved data).

    It is only on my Maxthon, nowhere to be found on Edge,but as Maxthon is "my" browser, its a annoyance. Seems fairly "benign" too i.e. no re-directions or pop-ups but its not supposed to be there.

    Click image for larger version. 

Name:	Screenshot_1.png 
Views:	5 
Size:	224.5 KB 
ID:	44585
      My ComputerSystem Spec
  7.    25 Oct 2015 #7
    Join Date : Oct 2014
    In a house with a crazy cat trying to kill me
    Posts : 17,468
    Win 7 32, Win 7 64 Pro, Win 8.1 64 Pro, Win 10 64 Education Edition

    Have you tried running RKill & then run all the malware scanners to see if it can ferret it out? Could be it's not leaving because it's running & that blocks some removal attempts. Also, you might try running in safe mode & then run some of the scanners.

    RKill Download

    As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.
      My ComputerSystem Spec
  8.    25 Oct 2015 #8
    Join Date : Jul 2015
    Posts : 903
    Windows 10 Home x64

    Do as Borg suggests, but DO NOT REBOOT THE PC after running RKill. Its main purpose is to flush ram from any running malware process, so you must run any malware cleaner after it, but without rebooting.

    As a last resort, try booting with any Linux BootCD or similar and check the ProgramData and Users\<your account> folders (Specially AppData) for any weird looking file/folder that may be residing there. You can also flush the browser cache from there (usually stored under AppData\Local folder).
      My ComputerSystem Spec
  9.    25 Oct 2015 #9
    Join Date : Jan 2014
    Indiana/Florida
    Posts : 1,580
    Windows 10 Home x64
    Thread Starter

    Nice seeing you here Borg 386!

    Tried RKill (can't believe I didn't think of that........), ran Malwarebytes,SuperAntiSpyware,ADWcleaner,and my A/V after running RKill. Its still there.
    Additional data ; My Windows Defender is grayed out , says its on in Windows, but RKill says its disabled. Also, I don't know if this is important or not but I cannot access Maxthons home page. Says its "unable to resolve domain name". Its the only page I can't get to.
    Will be trying eLPuSHer's suggestions next.
    Click image for larger version. 

Name:	Screenshot_1.png 
Views:	4 
Size:	633.9 KB 
ID:	44611Click image for larger version. 

Name:	Screenshot_2.png 
Views:	4 
Size:	161.7 KB 
ID:	44613
      My ComputerSystem Spec
  10.    25 Oct 2015 #10
    Join Date : Jul 2015
    Posts : 903
    Windows 10 Home x64

    RKill also says you are missing some services. Which ones are those?
      My ComputerSystem Spec

 
Page 1 of 2 12 LastLast


Similar Threads
Thread Forum
Microsoft updates Windows Defender to remove Superfish infection
Read more: Microsoft updates Windows Defender to remove Superfish infection | ZDNet
Windows 10 News
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 15:51.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums