davephs Posted December 3, 2015 Posted December 3, 2015 (edited) I wonder if anybody out there can help? We have DNSUnlocker, it’s a savage piece of Malware, which, appears to be totally invisible. By this I mean it’s not installed on the PC (Or is it ?) and currently its effecting Google Chrome underlining various links, and displaying popups (Some are very inappropriate) A sample Screenshot is attached, showing the Edugeek homepage, with random words underlined. Anyone have any suggestions on how to remove it? If you “Google” DNSUnlocker, there are various guides that outline removing applications, registry entries, etc, even modifying the DNS settings, however none of this has been found/ tampered with! We are at a loss! Even using Google’s DNS servers the problem persists. Any help would be greatly appreciated. Thanks. Edited December 3, 2015 by davephs
ZeroHour Posted December 3, 2015 Posted December 3, 2015 Try malwarebytes in F8 safe mode boot and see if it gets it. Safe mode generally works better for removing the real nasty stuff but I would always try a removal, reboot and rescan and see if it shows up again.
ADMaster Posted December 3, 2015 Posted December 3, 2015 Are there any odd entries in the chrome://extensions ? If you find one that is causing the issue tick the developer options box at the top this will give you the ID number. Put that ID into a chrome extensions black list GPO or admin console if you have GAFE.
bald_pig Posted December 3, 2015 Posted December 3, 2015 What AV are you using? plus what ADMaster said, it should have an entry in extensions
disk Posted December 4, 2015 Posted December 4, 2015 We have seen this type of issue before and to the best of our knowledge, it appears to follow users from home to work via chrome's cloud-syncing capabilities. We only support IE and Firefox on our campus though so we usually just remove chrome, cleanup the PC (or reimage), and send the user back on their way. If it becomes a bigger issue we may have to implement a policy to block chrome entirely from our PCs.
disk Posted December 4, 2015 Posted December 4, 2015 Can you not just re-image? If the issue is being synced by chrome, then it is only a matter of time before it comes back. I'm not saying that is what they are experiencing, only that we had some issues in our environment which caused us to have to remove chrome and instruct the users to use IE11 or the latest version of Firefox. Prior to that we had a few users that kept getting malware issues even though their PC was up-to-date and was running the latest version of System Center Endpoint Protect and Malwarebytes Business with Malwarebytes Anti-Exploit. Reimaging would fix it, of course, but as soon as the users downloaded chrome again and signed in with their google account, the issues came back.
Arthur Posted December 4, 2015 Posted December 4, 2015 as soon as the users downloaded chrome again and signed in with their Google account, the issues came back. That's easy to fix by deleting all of the synced data that is stored on Google servers. www.google.com/settings/chrome/sync
ADMaster Posted December 6, 2015 Posted December 6, 2015 If the issue is being synced by chrome, then it is only a matter of time before it comes back. I'm not saying that is what they are experiencing, only that we had some issues in our environment which caused us to have to remove chrome and instruct the users to use IE11 or the latest version of Firefox. Prior to that we had a few users that kept getting malware issues even though their PC was up-to-date and was running the latest version of System Center Endpoint Protect and Malwarebytes Business with Malwarebytes Anti-Exploit. Reimaging would fix it, of course, but as soon as the users downloaded chrome again and signed in with their google account, the issues came back. It is also fixed by installing chrome system wide for the users and controlling it with GPO, and blacklist the extension. Firefox also has sync options, and can't be controlled by GPO out of the box. Users should not be installing stuff to begin with, that's half the problem.
Homer Posted December 6, 2015 Posted December 6, 2015 I have extensions and plugins on a whitelist only basis - only what I specify to run will run everything else can do one!
Fuzzz Posted December 7, 2015 Posted December 7, 2015 You can try HitmanPro.Kickstart: HitmanPro.Kickstart - Anti ransomware, politievirus, bundestrojaner, Reveton, BKA, GVU - SurfRight
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now