There is a huge problem that exhausted me a lot and got me. In the browser (Chrome and Opera) at certain intervals, the advertisement tab opens. Also, this virus creates folders in the directory .. \ AppData \ Local ... Folders are named like (Kometa, Bromium, Yandex, etc.). All of them contain the same and same Data User Data folder \ here pack with a long combination of Latin. I used the following actions:

  1. Scanning and cleaning ADWCleaner
  2. Scanning and cleaningMailwareFight
  3. Manual removal of folders created automatically by a virus
  4. Eset nod skinning
  5. Resetting the settings and cleaning the cookie
  6. I tried to reinstall the browser (Chrom), but copied the old User data folder into a new browser.

What are some tips for solving this issue? Thank you in advance. I attach a link to the archive with one of the folders, which is generated in AppData.

Closed due to the fact that it is necessary to reformulate the question so that it was possible to give an objectively correct answer by the participants aleksandr barakin , Kromster , user194374, Alex , Denis Bubnov 21 Dec '16 at 6:12 .

The question gives rise to endless debates and discussions based not on knowledge, but on opinions. To get an answer, rephrase your question so that it can be given an unambiguously correct answer, or delete the question altogether. If the question can be reformulated according to the rules set out in the certificate , edit it .

    3 answers 3

    Faced with a similar problem with my wife on my computer

    In short, the joke is that in the “ Task Scheduler ” some program created a task to install the browser and go to a specific URL during installation.

    I also saw a task that does not launch the browser, but the application from the Windows folder OpenWith.exe , which offers you to choose the browser through which to open it)

    They are called InternetD , InternetB , InternetSC

    Worth performing every 22 minutes

    enter image description here

    enter image description here

    Accordingly, no antivirus and other software does not find anything)

    Delete task and everything is OK, by the way in the internet I did not find anything about it

    • Indeed, a similar InternetDB process was launched in the scheduler. Removed and advertising, like, until it stopped getting. Thanks for the help. - Denis Danilov
    • @DenisDanilov can be ticked off) - tCode
    • I apologize, I forgot it with joy) I just got so exhausted with this viral trash. Thanks again) - Denis Danilov
    1. There is a program by malwarebytes anti-malware.
    2. Another search in the registry for something by keywords (for example, the name of the site). You can program regedit
    3. In the properties of the browser to see if there is anything extra attributed after the path to the .exe
    • Malwarebyte is an excellent choice for cleaning, and also in the appendix we pull the utility "jv16", which simply amazingly cleans the registry of any garbage. Well and "ABP" in the extension. - Garrus_En

    You can try the following tricks:

    1. Find the folders that the virus creates for your work. Delete them by creating files of the same name in their place (if the folder was without an extension, then the file must be created without an extension, this is important!).

    2. Find the folders that the virus creates for your work. Edit the rights to these folders, setting for the group "All Users" / "All" a complete denial of access.