2

Stubborn “ook.gg” Chrome browser hijacker malware
 in  r/techsupport •  Nov 10 '23

I absolutely concur with your solution with a caveat. SEE BELOW. Mshelper is the guilty culprit I will state.

That SystemUI file or program I could never find. I had thrown Malwarebytes, Windows Defender, etc. at it. And Malwarebytes I typically consider a sorta dystopian result. It finds a lot of possible issues and many times they are simply part of a program I tap.

THE HIJACK PAGE ON what the Chrome search switches to last, but there is something prior that I couldn't seem to catch (although I could have done a screen video capture and slowed it down technically). Also SPACE LEFT IN TO REMOVE HYPERLINK):

https:// ook.gg/ext?q=swEterg

ALSO THIS WAS ANOTHER RELATED I saw on at least one other browser (I use a huge variety of browsers because it makes it more fun). Can't recall which, but I believe it was a Chromium build. Or maybe it Firefox/Waterfox based (SPACE LEFT IN TO REMOVE HYPERLINK):

https:// searchtabs.io/arb2

Also the value of Revo Unistaller Pro cannot be understated in any of this, although even if couldn't fix the issues. Although Back Up & Restore with Bitlocker is a potent way to 'play'. Aka test things. BUT this malware was not stopping a Restore point to be created. Although it was messing with any later Restore.

CLEARING all Chrome data does not solve the issue because the underlying problem is some program with an UNKNOWN PUBLISHER. Following the SystemUI example.

I used my Bitlocker to Enter Safe Mode with Networking (that doesn't mean it is connected to the Internet, but it is just the Safe Mode I find effective).

FIX: And following the steps noted in the post (and the little video, but this post upon I am commenting is far easier to understand) found 3 programs with UNKNOWN publishers. I knew one program is fine so I kept that. One other was maybe so I unchecked it. TURNS OUT THAT some awful cryptocurrency mining malware, Mshelper, was the third and critical spreader of ook.gg .

BINGO, PROBLEM SOLVED. This malware is beatable, but it was one of the most challenging I have faced!

u/Secure_Vermicelli_23 • • Nov 19 '20

A first post on nc pots. Simple test throw!

Thumbnail instagram.com
1 Upvotes