Malware/adware infection on my PC, tried various programs to remove but none worked

Juicymarmalade

Distinguished
Apr 17, 2013
53
1
18,630
After accidentally accessing a malicious website, a major malware infection has infected my PC. Every time I access a website, ads and popups will appear on every page. Sometimes they will even try and download stuff automatically without me clicking on anything.

I've used various programs which are supposed to help such as AdwCleaner, HitmanPro, MalwareBytes anti-malware, and the standard CCleaner but absolutely none of them fixed the issued despite saying that they removed a bunch of malicious files. I also uninstalled one of the malicious files just through the programs and features installation manager from the control panel but for some reason it's still on my PC and I can't uninstall it again.

I also tried clearing all my settings and history on Google chrome which did remove a search engine that the malware gave me but did nothing else.

It doesn't seem to pose a serious threat to my PC but it is very very annoying and I keep misclicking on ads since they keep appearing everywhere. They've even managed to appear on Steam.

Can someone please help me get rid of the malware/spyware once and for all? It will save me from a lot of frustration and it will be good just to not have to deal with ads everywhere.
 
Solution
Well, just as I figured System Restore was probably corrupted by the infection and it will not work untill you disable it to remove any corruption from it, restart the computer and re-enable system Restore.

Disable System Restore in Windows 7
http://www.howtogeek.com/howto/3187/disable-system-restore-in-windows-7/
Do you know how to make a liveCD? If so, Kaspersky offers a free liveCD that you can use for scanning outside of the Windows operating system. This should prevent infections from activating to stop an effective scan. The other option I'd recommend is using avast! Free is safemode to do a bootscan.

However, depending on the degree of the infection, what is probably easier is to just try and copy your information using a linux disk. Then reformat/reinstall Windows.
 
To remove some bugs you first have to disable every program, process or name that may be keeping them active or names under which the bugs may be disguising. To disable them: click on Start \ search bar: type msconfig and press Enter \ Startup \ remove the checkmark from every process except the antivirus... next delete temp files with %TEMP% typed in the search bar to open the temps folder. Again on the search bar type: TEMP to open the system temp files folder and delete all files.

Next:
1. scan with Malwarebytes Antimalware.
2. run a online virus scan

If scans don't delete or even detect it:
3. You can try in safe mode or disable System Restore before scanning.
(disabling System Restore deletes malware that saves itself in the System Restore folder and so you can delete them but probably not their saved copies)
4. program the Antivirus for a boot scan
5. run a Live CD Antivirus
6. download the Hirens Boot CD to scan with the tools included
7. Once the bug names identified you can search for them with "Everything" and delete them manually or preferably with File shredder

To stop the Ads and Pop-ups, install Flash Blocker and Ads Blocker addons in your web browser.
 

Juicymarmalade

Distinguished
Apr 17, 2013
53
1
18,630
As I said, I already scanned using Malwarebytes and various other programs and they detected absolutely nothing. I even booted my PC in safe mode and scanned like the stickied thread on this forum suggested but other than scanning a little faster it still didn't detect anything.

I did just make a weird discovery that the adware was appearing on Google Chrome but when I tried Internet Explorer, it didn't show up on Internet Explorer at all. I tried reinstalling Google Chrome but I was still getting the adware. Same with Steam.
 


Do you see anything errant in Msconfig?
Also, have you tried a liveCD completely outside the reach of Windows viruses? You may have some luck. Kaspersky offers a free one.
 
Did you disable System Restore before scanning with an antivirus boot scan?... it may be the only way of removing it.

Use Revo Uninstaller to uninstall Chrome and remove it's leftover registry data... after that delete temp files and scan for malware before restarting the computer and reinstalling Chrome. You may also have to disable System Restore before this. Leave Chrome without Addons for a while.. if it has any.
 

Juicymarmalade

Distinguished
Apr 17, 2013
53
1
18,630
I tried uninstalling Chrome with Revo Uninstaller and then reinstalled but still getting adware. I even uninstalled it using the advanced option and deleting the temp files but still nothing. Also, what is System Restore and why would I want to disable it?

EDIT: Found out the reason why Internet Explorer was doing fine was because I had the browser version of Avast protecting it, which I had installed in a rush to try every program possible. Put Avast on chrome and now it seems to be blocking most of the ads. Still, I wish there was a way to remove them forever so I won't need to use Avast.
 
Chrome - go into Tools, Extensions and see if there is anything there that you need to disable.

Go into Control Panel, Uninstall Programs and carefully go through the list of program,s and uninstall any you know definitely should not be there.

Run a hdd scan with Avast.
 

scout_03

Titan
Ambassador
if you could check all the extension you have in chrome also did you associate the ie with it so you have to clean both browser and search in the program files on the drive one that could lead to those add you could also if you are safe to do a search in the registery for those and delete those keys ,you could contact me if you need .
 

What is System Restore? System Restore helps you restore your computer's system files to an earlier point in time. It's a way to undo system changes to your computer without affecting your personal files, such as e‑mail, documents, or photos. http://windows.microsoft.com/en-us/windows/What-is-System-Restore#1TC=windows-7

And just as SR restores your computer's system files, it can also restore a virus, malware or adware. The feature creates frequent restore points and saves them in the "C:\System Volume Information" folder which is a system protected folder and inaccessible even to the Administrator without previous configuration of it's security permissions, and that means even the Antivirus or any security program may not be able to scan that folder... therefore it's a favorite hideout for all types of malware... and it's possible to delete malware with a security program scan, and to find the malware has later returned (having come out of the Restore Points folder).

That's why it's adviceable to disable system restore which deletes the restore points and any bugs among them. I recommend this as a last resort option when different scans have not solved the problem.

System Restore can also help remove malware by restoring the system to a previous date to that when the malware is likely to have infected the system.

So if the date when you first noticed the problem is not far back, you could run System Restore and hope that solves your problem. That would also help check that System Restore is working as malware can corrupt it... and if it's not working, disabling it would be the only way of restoring it's functionality anyway.

Mind you this is not a guarantee that the infection will be removed, but it better then having run out of options and not doing anything more. So try a System Restore: If it works and solves the problem good, and if SR doesn't work, disabling it becomes the obvious thing to do since it's the only way to recover it's funcionallity (after enabling it again)... and once it's disabled running virus + malware scans... preferably boot time scans turns out move effective against stubborn malware.

I would also suggest you go into Control Panel Programs and features or Revo Uninstaller and check all your installed programs for any of them that you may have installed when the problem started, and remove them since some free programs are a source for adware and malware specially if you use the default installation (as opposed to the custom installation where you select what to or not to install) as most all programs nowadays include extra programs you did not ask for, which in most cases are adware and malicious apps.

Disable System Restore in Windows 7
http://www.howtogeek.com/howto/3187/disable-system-restore-in-windows-7/
 

You don't need the installation disc... just click Start \ All Programs \ Accessories \ Sysem Tools \ System Restore.. as the Restore program opens, mark "Choose a different restore point".. Next \ Show more restore points \ select a date that's previous to the start of the problem and click Next... the System will restart and may take a few minutes to complete before the desktop appears on the screen. Any system settings or programs you may have configured or installed since the restore point date will be lost, so make a note of what you'd like to reinstall or re-configure before sarting the Restore. Personal files and settings will not be affected.

BTW.. this can be reverted in case you have to... the SR program should create a new restore point before starting to restore to the date you choose... that new restore point is your reversion point.
 
Well, just as I figured System Restore was probably corrupted by the infection and it will not work untill you disable it to remove any corruption from it, restart the computer and re-enable system Restore.

Disable System Restore in Windows 7
http://www.howtogeek.com/howto/3187/disable-system-restore-in-windows-7/
 
Solution

Juicymarmalade

Distinguished
Apr 17, 2013
53
1
18,630
I will keep that in mind for when the ads strike again. Weirdly enough though, the ads have completely disappeared since yesterday. Even with all those anti malware programs I was using turned off they are gone.

I will remember this thread for when and if they ever do come back though which may unfortunately happen because it's weird for them to just disappear. Until then though, thanks for the help everyone!