Hello everybody!
This video is about taking away viral advertising in such browsers as Google Chrome, Mozilla
Firefox, Opera, Yandex Browser, Microsoft Edge and Internet Explorer.
If your browser suddenly opens tabs containing advertising (for example, Vulcan casino),
if tabs with popular websites (Yandex, VK, YouTube, Odnoklassniki) appear to be filled
with extra advertising banners, or adverts start flashing as soon as you start the browser,
it means your computer is infected with a virus.
All that advertising slows down the computer so much that it’s impossible to work with
the browser!
For example, I installed several programs from a doubtful source.
As a result, here is what I get without receiving any notice:
• Amigo browser and other services by Mail.ru were installed (Odnoklassniki, Vkontakte,
Automatic software update service, Unity Web Player);
• my default browser was changed to Amigo; • the startup page of other browsers was
changed to Mail.ru; • all browsers are showing advertising banners
all the time (here are several examples).
However, this is just the beginning - things could be much worse in your case.
Before you start deleting viral advertising, you can roll back to the last restore point
or restore your system from an image you such function has been enabled in your computer.
You can watch my previous videos to see how to do it.
Otherwise you will have to delete the virus manually.
It is a long and painstaking process of several stages:
• cleaning Windows scheduler; • deleting malware (viruses);
• cleaning system startup list; • cleaning the browsers.
In the description to this video, you can go down to the stage which you need.
First of all, disconnect the computer from the network and check Task Scheduler.
Viruses and unwanted programs often create automatic tasks to run various malware processes:
• downloading, installing and updating themselves and other viruses;
• forced opening of advertising tabs in browsers and so on.
With the use of Task Scheduler, a virus can install itself again while you are trying
to delete it.
In order to delete such tasks, go to Control Panel / Administrative Tools / Task Scheduler.
Click once on the Scheduler Library and search the list for the tasks related to malware
processes (you can find some of them in the description of this video below).
In my case they are “find journal” and “MailRuUpdater.”
Delete these tasks.
To do it, right-click on the task, select “delete” and confirm it by clicking OK.
After deleting all malware tasks in the Task Scheduler, go to Control Panel / Programs
and Features and sort installed programs by date of the last installation.
You can see what programs and features were installed without your knowing it.
In my case, the infection date is 9 December 2017 and here are the programs that were installed
by themselves: • Amigo browser;
• Automatic software update service; • Unity Web Player.
Delete all of them.
To do it, right-click once on the program and select “Delete.”
Some malware cannot be deleted in this way, because they are not shown in Programs and
Features menu.
To see them, start Task Manager by pressing the key combination Ctrl + Shift +Esc.
Then click on “More details” and open the tab “Details” (in Windows 7 it is
the tab “Processes”) and look for all suspicious processes running on your computer.
In my case, they are MailRuUpdater.exe, mrupdsrv.exe by Mail.ru Update Service and so on (see the
extended list in the description).
Then right-click on one of the processes (for example, MailRuUpdater.exe), click “File
location” and write down the path to this folder (in my case, this is Andrey Revchuk/AppData/Local/Mail.ru).
Repeat these actions for all suspicious processes, and then restart the computer in safe mode
(to see how, watch my previous videos).
When in Safe Mode, go to Control Panel / File Explorer Options, then click on the tab “View”
and choose the option “Show hidden files, folders and drives.”
Uncheck the box next to “Hide protected operating system files (recommended)” and
then apply the changes to all folders.
After that go to the folders the path to which you have written down, and delete all files
and folders created by these malware processes.
In my case, I find the folder Mail.ru in the path “С:/Users/Andrey Revchuk/AppData/Local/”
and delete it.
After viruses have been deleted, open the Task manager, click “Startup” and see
if there is anything wrong.
Disable and delete all unwanted processes.
To do it, right-click on the line, choose to open file location and delete it.
Repeat this operation for all suspicious processes in the startup tab.
After that, press Win + R, type in “Regedit” and press “Enter.”
Viruses and unwanted programs create entries in the registry to download or update their
files when Windows starts.
These entries can be found in registry keys HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER in
the path /Software/Microsoft/Windows/Current Version in folders Run and RunOnce.
If these registry lines (Run and RunOnce) contain registry entries related to malware
processes, delete them.
To do it, right-click on the necessary file (for example, Amigo) and click “Delete.”
After that, search the registry for names of malware processes.
In the registry editor, select “Computer” and click “Find” in the tab “Edit.”
Enter the names of those malware processes which you remembered (for example, mail.ru)
and click on “Find next.”
Delete all registry lines where these processes are found.
To do it, right-click on the necessary file and click “Delete.”
After each deleting, press F3 key (that is, restart the search for malware registry entries
with such name).
This action should be repeated until registry editor finds no malware entries for your search.
Be very careful - if you delete a system line in the registry editor, your computer will
stop working.
After deleting all entries, close the registry editor.
After that, press Win + R, type in “msconfig” and press “Enter.”
Open the tab “Services” and select “Hide all Microsoft services” then look at the
list.
If you see any services related to viruses or malware processes, uncheck the boxes next
to such services and click OK.
In my case they are “Mail.ru Update Service,” “Updater.Mail.Ru.”
After disabling them, log out of the Safe Mode and restart the computer in normal mode.
Your next step is to check browser shortcuts on the desktop, in the taskbar and the Start
menu.
Sometimes viruses or unwanted programs change the value in Target line of the shortcut.
After that, you browser startup page changes into a website you don’t know, and your
browser starts with several new windows showing you advertising.
To fix the problem, right-click on the shortcut (for example, of Chrome browser) and select
Properties.
Look attentively at the value in Target line of your browser shortcut.
For Google Chrome, the end of line should contain the value “Chrome.exe” and the
path should correspond to the folder containing this program.
If the shortcut shows the path to a file other that the application’s .exe file (for example,
some .url or .bat file) or the path contains a URL address of a website (for example, http://virussite.com),
you should change such path to: • for 32-bit Windows - “C:\Program Files\Google\Chrome\Application\chrome.exe”;
• for 64-bit Windows - “C:\Program Files (x86)\Google\Chrome\Application\chrome.exe”.
After you made any changes, click on “Apply.”
You will find examples of correct Target values for shortcuts of such browsers as Chrome,
Mozilla Firefox, Opera, Internet Explorer, Microsoft Edge and Yandex Browser in the description
of this video.
Instead of changing the shortcut, you can delete it and create a new one.
Then you should reset browser settings.
This function will: • reset startup page settings;
• reset quick access and search system pages; • unpin all tabs;
• make the system disable all browser themes and extensions;
• make the system delete all temporary files (including cookies).
Your bookmarks, history and passwords will be preserved.
To do it in Google Chrome or Yandex Browser, go to Settings / Show advanced settings, then
click on “Reset settings” and then “Reset.”
In Mozilla Firefox, go to the menu Help / Troubleshooting information, then Clean Firefox, and confirm
your decision.
After resetting Firefox, a folder containing old browser settings will appear on the desktop.
That is, Firefox creates a backup on the desktop (with the name “Old Firefox Data”), and
you can restore deleted data using the folder on the desktop in case you lost something
important.
If you don’t need this folder, just delete it.
In Opera browser, there is no option for automatic resetting, so you have to do it manually.
Go to the menu, select “About Opera” and open paths to user profile and browser cache
in File Explorer.
Make sure you close Opera, and delete all contents of the profile and cache folders.
This procedure will reset all Opera settings.
In Microsoft Edge, go to Settings, and in the section “Clear browsing data” click
on “Choose what to clear.”
Choose “Cookies and saved website data” and “Cached data and files”, then click
“Clear.”
In Internet Explorer, go to Service / Browser Properties, then open the tab Advanced settings
and click on “Reset” (in doing so, you can also delete personal data by selecting
this option).
You should restart the computer for the changes to take effect.
In the end, the file “Hosts” must be checked.
To do it, start Notepad as an administrator, choose “Open” in the File menu, enable
showing all files, then go to “С:/Windows/System32/drivers/etc” and open the file “hosts.”
If there are any lines which begin without a hash-mark, delete them, and save the file.
If you liked this video, click the Like button below and subscribe to our channel to see
more.
Thank you for watching and good luck!