Malware advice please (Chrome popups/random websites)

grumpycrab

Struggling with this one (don't see much malware, antivirus...); facts:-
1. at a neighbours (not within wifi range!)
2. 2 laptops in the house have been affected (wifi used); a third possibly (no usb sticks shared)
3. issue is with Chrome (I think the others are ok)
4. symptom 1 - randomly get a popup "you have a virus, ring the number"; pic below
symptom 2 - an extension install is attempted and the only way to quit is to kill chrome; pic below.

Have tried the usual suspects:- chrome clean tool; malwarebytes, hitman pro, Zemana but the b*st*rd keeps coming back; annoying it seems ok here but within 5mins at neighbours its back.

Possible suspect - ancient router Zyxel AMG1202-T1Q(or 0)A. Never seen a hacked router before.
AV is McAfee Livesafe (paid); and McAfee WebAdvisor has been (automatically) installed I believe. Thanks in advance.

grumpycrab

Not to deliberately bump the thread but may be a hacked router e.g.
http://www.comley.name/2016/12/02/fixing-your-amg-1302-t10b-if-its-been-hacked/
(I'd better find the right firmware first).

Also, I may not have run hitman pro properly - dmr_72.exe found and properly processed this time. Why doesn't McAfee spot this stuff!?

debitcardmayhem

check what the dns says it is pointing too, and change it to say 8.8.8.8 ? adwarecleaner perhaps,

debitcardmayhem

grumpycrab wrote: »

Not to deliberately bump the thread but may be a hacked router e.g.
http://www.comley.name/2016/12/02/fixing-your-amg-1302-t10b-if-its-been-hacked/
(I'd better find the right firmware first).

Also, I may not have run hitman pro properly - dmr_72.exe found and properly processed this time. Why doesn't McAfee spot this stuff!?

Why is the world round not flat.
Did you get the tools mentioned from their house

grumpycrab

debitcardmayhem wrote: »

check what the dns says it is pointing too, and change it to say 8.8.8.8 ? adwarecleaner perhaps,

I probably ran adwarecleaner too! I definitely need a checklist for this sort of debugging, otherwise just end up going round in circles...
Re. DNS. It's fine here :-) Must admit I had problems connecting to the net at their house and went through the flush/reset/DNS and winsock sequence. It came back. Will have a closer look at DNS/the router tomorrow.

EDIT: got the tools here. (Most of them). Don't make me panic.

grumpycrab

Couldn't connect to the router control panel 192.168.1.1 (the usual) via ethernet and static IP address set on my laptop. New router ordered immediately (Sabre Internet - never heard of them).

QUESTION2. As it looks like (most) AV programs don't do malware, what do other people do? I just run the occasional MWB scan but is there anything recommended that'll run in the background and is cheap and resource light? (something I can sell to worried punters :-)

hans_2

grumpycrab wrote: »

is there anything recommended that'll run in the background and is cheap and resource light?

BitDefender Antivirus Free Edition has proactive malware and spyware scanning

debitcardmayhem

run ipconfig /all and see what the default gateway is it will be the ip address of the router is
the usual is not the usual mine is 192.168.2.1 some are 192.168.0.254 or 192.168.1.254 and some are something different