1.    4 Weeks Ago #1
    Join Date : Feb 2017
    Posts : 22
    Windows 10 64 bit

    Still getting popups for Chromium malware


    If you look at my previous threads I started, I'm still getting malware about installing Chromium browser. It's not a legitimate popup. I thought I deleted the software and I ran all my antiviruses. Here are some screenshots. The one is a screenshot of the popup. The other is a screenshot of the process in task manager, and the third is what pops up when I click OK on the popup. Any help? UPDATE: I know mshta.exe is a legitimate process because I Googled it. But I don't know why it is popping up. Do I need to delete it? Click image for larger version. 

Name:	Capture.JPG 
Views:	2 
Size:	48.9 KB 
ID:	159556Click image for larger version. 

Name:	Capture2.JPG 
Views:	29 
Size:	95.7 KB 
ID:	159557Click image for larger version. 

Name:	Capture3.JPG 
Views:	29 
Size:	19.7 KB 
ID:	159558
      My ComputerSystem Spec
  2.    4 Weeks Ago #2
    Join Date : Oct 2017
    Posts : 454
    Windows 10 Pro 64-bit

    From your Firewall block mshta.exe file from inbound and outbound internet connections.
      My ComputerSystem Spec
  3.    4 Weeks Ago #3

    Where did you download Chromium from? Why are you using Chromium rather than Chrome stable?

    What other anti virus are you using other than MBM?
      My ComputersSystem Spec
  4.    2 Weeks Ago #4
    Join Date : Feb 2017
    Posts : 22
    Windows 10 64 bit
    Thread Starter

    Quote Originally Posted by swarfega View Post
    Where did you download Chromium from? Why are you using Chromium rather than Chrome stable?

    What other anti virus are you using other than MBM?

    I don't use Chromium. This popped up after my nephew downloaded some teamspeak thing called discord. He's 10 and he downloads things. I use Avast free and the paid version of MBM
      My ComputerSystem Spec
  5.    2 Weeks Ago #5
    Join Date : Feb 2017
    Posts : 22
    Windows 10 64 bit
    Thread Starter

    Quote Originally Posted by FreeBooter View Post
    From your Firewall block mshta.exe file from inbound and outbound internet connections.
    I just did that and I'm going to delete mshta
      My ComputerSystem Spec
  6.    2 Weeks Ago #6
    Join Date : Oct 2014
    Posts : 361
    Win 10 Home Build 1709 16299.19 64bit

    https://www.malwarebytes.com/adwcleaner/

    Did not see your other threads. Did you run AdwCleaner ?
      My ComputerSystem Spec
  7.    2 Weeks Ago #7
    Join Date : Oct 2014
    Trnava
    Posts : 2,863
    Windows 10.4 Home 1709 x64

    Windows Script Host (WSH) is usually responsible for executing random stuff, you can block it like this:
    Code:
    reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f
    I have actually that executable blocked, because it is commonly used by scripting malware.
    Note, this only blocks it for the current user, if it is run by system, it will still be executed.
    Code:
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "mshta.exe" /f
    There is also this multipurpose beauty, since the default popup blocker sucks these days anyway.

    Pop up blocker for Chrome™ - Poper Blocker - Chrome Web Store
      My ComputerSystem Spec
  8.    2 Weeks Ago #8
    Join Date : Feb 2017
    Posts : 22
    Windows 10 64 bit
    Thread Starter

    Quote Originally Posted by TairikuOkami View Post
    Windows Script Host (WSH) is usually responsible for executing random stuff, you can block it like this:
    Code:
    reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f
    I have actually that executable blocked, because it is commonly used by scripting malware.
    Note, this only blocks it for the current user, if it is run by system, it will still be executed.
    Code:
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "mshta.exe" /f
    There is also this multipurpose beauty, since the default popup blocker sucks these days anyway.

    Pop up blocker for Chrome™ - Poper Blocker - Chrome Web Store
    I just ran these command lines and let's see what happens.
      My ComputerSystem Spec

 


Similar Threads
Thread Forum
Solved Chromium - self installed
Would appreciate your assistance! Have a friends laptop where Chromium installed on its own, and keeps popping up when the computer starts. Went to Task Manager/Startup, and Disabled 3 entries of Chromium. However, they cannot be deleted....
Software and Apps
Every...i mean every anti malware blocked by unknown malware/virus
i have looked up this issue and apparently this must be a new one since there is no solution what so ever, even the hidden admin account is defenseless, here is what's going on 1. the PC got infected on windows defenders watch, the infection...
AntiVirus, Firewalls and System Security
Chromium
I got the chromium virus and I uninstalled it but it still activates sometimes. Its not showing up in task manager:sick::sick: Ignore pictures.
AntiVirus, Firewalls and System Security
Solved How to get rid of Chromium in Windows 10
Message deleted. Was not posted correctly.
Browsers and Email
Persistent immovable popups, adware, malware etc
Have use Win 10 successfully since released. two weeks ago I began being besieged by immovable persistent popups. Since then I have scanned HP Pavillion laptop with Norton, PC Cleaner, Reimage and AVG . All of them found and cured faults,...
AntiVirus, Firewalls and System Security
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 14:19.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums