Taobao infection Solved

Page 1 of 2 12 LastLast
  1.    24 Oct 2015 #1

    Taobao infection

    Color me embarrassed but I seem to have picked up ........... something. As you can see from my screenshot my Browser has gotten a .....visitor and I can't seem to make it leave. It seems to be a shortcut to Taobao. I've tried scans with Malwarebytes,SuperAntiSpyware,ADWcleaner, JRT,and Panda A/V (free) to no avail. Any suggestions?

    Click image for larger version. 

Name:	Screenshot_1.png 
Views:	18 
Size:	258.6 KB 
ID:	44436
      My ComputerSystem Spec

  2. JohnC's Avatar
    Posts : 3
    Dual Boot 10 Pro v1607 10 Pro rs2 build 14971
       24 Oct 2015 #2

    It looks like a browser toolbar. In IE try going to Settings>manage Add-ons > Toolbars and extensions. You should be able to delete it there. The other one I have seen lately resets your homepage. By going to control panel>Internet options general tab will allow you to reset the homepage.
      My ComputerSystem Spec

  3.    24 Oct 2015 #3

    Well, this is Maxthon but I tried resetting. Tried a few more things ........ then just deleted the browser and reinstalled. No idea where I got it or how it eluded everything I tried but it did. Its gone now, but thanks for the suggestion.
      My ComputerSystem Spec

  4.    25 Oct 2015 #4

    Try ZHPCleaner and RogueKiller too.
      My ComputerSystem Spec

  5.    25 Oct 2015 #5

    Maxthon has addons as well, a lot of which I would not consider using. Go to Menu - Tools - Extensions and see if theres any unwarranted addon there.
      My ComputersSystem Spec

  6.    25 Oct 2015 #6

    O.K. ......... Its back. Came back yesterday evening about an hour after I thought I'd gotten rid of it. It is only on the tabs after the main one and it turns off AdBlock Plus, (Its bundled into my Browser), but only on the unopened tabs. In addition to what I have already mentioned I've ran RougeKiller, ZHP Cleaner, BitDefender online rootkit scan,Malwarebytes Rootkit scanner, Malwarebytes Chameleon and at least a couple more that just don't come to mind. I've reset my Browser to defaults to no avail and even reinstalled Maxthon cleanly (no saved data).

    It is only on my Maxthon, nowhere to be found on Edge,but as Maxthon is "my" browser, its a annoyance. Seems fairly "benign" too i.e. no re-directions or pop-ups but its not supposed to be there.

    Click image for larger version. 

Name:	Screenshot_1.png 
Views:	5 
Size:	224.5 KB 
ID:	44585
      My ComputerSystem Spec

  7. Borg 386's Avatar
    Posts : 22,272
    Win 7 32, Win 7 64 Pro, Win 8.1 64 Pro, Win 10 64 Education Edition
       25 Oct 2015 #7

    Have you tried running RKill & then run all the malware scanners to see if it can ferret it out? Could be it's not leaving because it's running & that blocks some removal attempts. Also, you might try running in safe mode & then run some of the scanners.

    RKill Download

    As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.
      My ComputerSystem Spec

  8.    25 Oct 2015 #8

    Do as Borg suggests, but DO NOT REBOOT THE PC after running RKill. Its main purpose is to flush ram from any running malware process, so you must run any malware cleaner after it, but without rebooting.

    As a last resort, try booting with any Linux BootCD or similar and check the ProgramData and Users\<your account> folders (Specially AppData) for any weird looking file/folder that may be residing there. You can also flush the browser cache from there (usually stored under AppData\Local folder).
      My ComputerSystem Spec

  9.    25 Oct 2015 #9

    Nice seeing you here Borg 386!

    Tried RKill (can't believe I didn't think of that........), ran Malwarebytes,SuperAntiSpyware,ADWcleaner,and my A/V after running RKill. Its still there.
    Additional data ; My Windows Defender is grayed out , says its on in Windows, but RKill says its disabled. Also, I don't know if this is important or not but I cannot access Maxthons home page. Says its "unable to resolve domain name". Its the only page I can't get to.
    Will be trying eLPuSHer's suggestions next.
    Click image for larger version. 

Name:	Screenshot_1.png 
Views:	4 
Size:	633.9 KB 
ID:	44611Click image for larger version. 

Name:	Screenshot_2.png 
Views:	4 
Size:	161.7 KB 
ID:	44613
      My ComputerSystem Spec

  10.    25 Oct 2015 #10

    RKill also says you are missing some services. Which ones are those?
      My ComputerSystem Spec

Page 1 of 2 12 LastLast

Related Threads
Read more: Microsoft updates Windows Defender to remove Superfish infection | ZDNet
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 03:22.
Find Us