1

A few days back I faced irritating popups called "Ads by Advertise" in Google Chrome, which displays ads when certain highlighted keywords were hovered over. The issue was specific to Chrome (it did not appear on other browsers like MS Edge or Firefox). Subsequently I installed Malwarebytes, did a system scan, and the program identified ..\appdata\local\google\chrome\userdata\Default\Web Data and ..\appdata\local\google\chrome\userdata\Default\Sync Data\SyncData.sqlite3 as "potentially unwanted programs".

I somehow eliminated the "Ads by Advertise" popups by removing the "Tampermonkey" Chrome extension (as suggested by these instructions). But Malwarebytes, which scans my PC on a daily basis, still detects the above-mentioned files as potential threats. I first tried choosing the quarantine option from the software, but they return after I restart my PC. I have also tried deleting them from their original locations, which signed me out of Chrome (understandable, as Chrome uses them to sync my data). After signing in again, the threats return. Finally, I chose the cancel option from the scan results page. But after all this, I still cannot get rid of the threat alerts from Malwarebytes. Does anyone know how to eliminate this situation, or would it be best to just get rid of Malwarebytes and its annoying messages (as it is an unpaid trial, anyways)?

1
  • another thing to consider is removing and reinstalling chrome. you could try exporting bookmarks and passwords and importing them on another computer as a test so you know you exported them correctly and can import them, before removing chrome. – barlop May 1 '18 at 2:53
2

I had this same issue, and I was able to solve it by deleting a few saved "search engine" URLs in my Chrome data.
Check this: In Chrome, go to:

"Settings" > "Search Engine" > "Manage Search Engines"

and remove links to anything you don't recognise (you can actually remove them all if you like).

I found some links that were linked to malware installed by a rogue extension. Remove all of these links, and run MalwareBytes again.

Stay Safe!👌

0

To add to @barlop suggestion:

  1. Uninstall Chrome
  2. Delete your user data folder from %LOCALAPPDATA%\Google\Chrome
  3. Install the Chrome for Enterprise which installs Chrome in Program Files
  4. After signing in Chrome, before the sync starts, uncheck sync my extensions and application data. This will prevent any unwanted application data or addons from coming back to the PC.

Post this, scan with MalwareBytes and let us know if it helped.

4
  • As per your instructions I have installed Chrome using the Enterprise installer and under chrome://settings/syncSetup I have disabled apps and extensions but left everything else checked. Malwarebytes no longer reports any threats. But I frequently use the Chrome extensions that I sync to my PC, and am afraid once I restore them the scan will detect the threats once more. Should I go ahead and sync my extensions then, or should I leave it alone? – Andrew Lau May 2 '18 at 3:52
  • If you have another PC where the extensions are already synced, can you check if there are any unknown or unwanted extensions? If yes, delete them and sync. Then once you are sure all the extensions are trusted, you can enable sync on this PC – Ganesh R. May 2 '18 at 4:31
  • Just started my PC and Malwarebytes detects the same files as threats, but I have not synced any Chrome extensions or apps yet. I suspect it could be a false positive, but please tell me if a re-install would be ideal. – Andrew Lau May 2 '18 at 23:54
  • I think it is a false positive. If you still want to confirm, you can Kaspersky Rescue Disk to perform an offline scan: support.kaspersky.com/viruses/rescuedisk. Also report the detection to MalwareBytes using their UI so that they can fix it – Ganesh R. May 3 '18 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.