Malware - Googleapis/Amazonmaw

[REDACTED]

Hi
I have a new laptop - not more than 2 months old - but it's infected with malware despite there being no time when I was not protected by either McAfee, Sophos or Avast.  All browsers are affected, starting with Chrome - started to get tabs opening by themselves with ads or porn that I could not dismiss or move away from and could only escape by turning off laptop using power button.  Deleted Chrome and started using IE, Microsoft Edge and then Avast Safezone, but this occurrence gradually crept in there too.  Whatever security I use either does not detect any virus/malware/worm, or detects and deals with certain malware items, but the intrusions continue regardless.  Hope someone can help me with this - I use laptop for college and social media and am dependent on it.  I am very careful about security and downloading, and cannot understand how my new laptop has succumbed.  Thanks

[Eddy]

https://forum.avast.com/index.php?topic=194892.0

[REDACTED]

Thanks - logs attached

[dbrisendine]

The most obvious problem on your system (from your logs) is the multiple AVs running at the same time.  Choose one and remove the others please.

Also, Windows10 has a built-in "PDF printer"; you can create a PDF file just by printing to this "device".  You do not need a separate program to do this unless you want to adjust the PDF file directly.


Fix with Farbar Recovery Scan Tool
This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Please close any other programs you are using and save your work / files.  The FRST script will close all unneeded processes and then reboot the system (if needed) when finished.
• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

How is the system running now?

[Pondus]

The most obvious problem on your system (from your logs) is the multiple AVs running at the same time.

Why Using Multiple Antivirus Programs is a Bad Idea > https://blog.kaspersky.com/multiple-antivirus-programs-bad-idea/2670/

[REDACTED]

Hi
thanks!  I've retained Avast and removed mcafee - should have done sooner.  I only downloaded it because avast wasn't picking up the problem in scans.  I was aware of the print option for pdf and have no idea why there was another PDF programme - which I can't find to remove.  Carried out fix and have tried avast safezone browser and Microsoft Edge browser, with no tabs self-initiating with ads so far.  After I ran original scans to create logs there was a flurry of activity with tabs opening up all over the place with ads inviting me to meet girls in my local area!  Thank goodness that's not happening now - so far.
Have attached fixlog

[mchain]

Why You Need An Adblocker: 
https://www.nytimes.com/2015/08/20/technology/personaltech/ad-blockers-and-the-nuisance-at-the-heart-of-the-modern-web.html?_r=0

[REDACTED]

Hi
Ads are back - and I'm using Avast SafeZone browser.  Just got Googleapis/Microsoft warning that my pc is infected, must get in touch, threat threat etc.  This was after a tab opened and an ad for some game or other showed up, which I quickly dismissed.  Malwarebytes keeps telling me it has blocked malicious adware, but when I ran a scan it found nothing.

Hoping you can help!

[dbrisendine]

FIRST >>>>

Junkware Removal Tool
Please download JRT from here to your desktop.

Note: Temporarily disable/shut down your protection software now to avoid potential conflicts, how to do so can be read here.

Double click the JRT.exe file to run the application.

The application will open an Command Prompt window and run from there (this is normal for this program, so not to be alarmed).

When it is asked, press any key to allow the program to continue / run.

This will create a log on the desktop; please copy and paste the JRT.txt log text in your next post.

Note: After the log file is created, please enable your protection software / reboot your system and verify your protection software is enabled.


SECOND >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:


Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this


On reboot (if one is needed) a log will be produced; please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C#].txt


Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

[REDACTED]

Hi and thanks.  logs from JRT and Adwcleaner attached

[dbrisendine]

Any improvement?  If not, please ad an Ad Blocker to your browser(s).  I can recomend uBlock for Chrome, AdBlockPlus for FireFox and Adguard Adblocker for Edge.

[REDACTED]

Hi
No ads, googleapis/microsoft warnings so far, but this tends to be the pattern - run a fix, ads go, but then creep back in again after a few days.    This is despite always having security, and always running an ad blocker.  I'd be fascinated to find out when and how this adware/virus got through!  I'll try a different ad blocker I think.

[REDACTED]

Sadly, it hasn't worked.  Googleapis microsoft warning alert pop-up has appeared again.  I have never clicked on to these.  I know exactly what they are, yet they persist.  Malwarebytes has blocked a malicious website

[dbrisendine]

I would like to get a look at the following log file:

Please download and run the Avast Browser Cleanup tool from here.

Once it runs, click on the question mark on the left hand side and then the Log File.  Please attach this file in your reply.  Thanks.

[REDACTED]

Hi
Before it started it asked if it could clean up something called iSurf... (tried to remember name but failed).  I gave permission for this to be removed before scan started.  Log attached.