Random ads popping up even when Chrome is closed?

[sup3rcarrx8]

Hi All,

It's been a while since I saw popups and possible malware on my desktop. But I recently noticed ads that keep popping up in the bottom right screen even when Chrome is closed. I've run a number of malware apps: Spybot SD, malwarebytes, SuperAntiSpyware, TDDSKIller, and RogueKiller. I also verified I ticked off any suspicious startup apps from Startup Manager. I even checked any new random Chrome extensions but still can't get rid of them. Any help would be much appreciated.

The ads seem to be normal ads you'd see while browsing anywhere. Below is a screenshot of one while I was typing this thread.

 

[Kenrou]

Check your add/remove (Programs and Features in Win10) and your Task Manager/details to see if you got anything suspicious listed, most of the time these bypass malware protection by acting as genuine programs.

 

[sup3rcarrx8]

Check your add/remove (Programs and Features in Win10) and your Task Manager/details to see if you got anything suspicious listed, most of the time these bypass malware protection by acting as genuine programs.

Only interesting thing that caught my eye was

 

[Kenrou]

Google says that one is part of the Windows update system (although i don't have it and i'm running 1809), better not mess with it just in case. What about running services ?

 

[Zerileous]

Check which sites are allowed to send notifications, it sure looks a lot like a notification. You may just need to block the notifications. You can right click on the notification center and "turn notifications off." It looks like you have 20 of them there. That will prevent the Win10 notifications. Then you need to go through chrome and block them as well chrome://settings/content/notifications. Make sure you have it set to ask you before a site can send notifications.

If that doesn't work you need to run hijackthis and compare it to the running processes. Anything that doesn't match up or seem justified in its existence you'll need to go into the registry and gut it. Google it first to see if it should be there. Back up's first of course, this is not a low-risk procedure as you could kill your install, but the alternative is a clean install. May require use of safe mode if it keeps reproducing.

 

[wagex]

Check which sites are allowed to send notifications, it sure looks a lot like a notification. You may just need to block the notifications. You can right click on the notification center and "turn notifications off." It looks like you have 20 of them there. That will prevent the Win10 notifications. Then you need to go through chrome and block them as well chrome://settings/content/notifications. Make sure you have it set to ask you before a site can send notifications.

If that doesn't work you need to run hijackthis and compare it to the running processes. Anything that doesn't match up or seem justified in its existence you'll need to go into the registry and gut it. Google it first to see if it should be there. Back up's first of course, this is not a low-risk procedure as you could kill your install, but the alternative is a clean install. May require use of safe mode if it keeps reproducing.

beat me to it, i had the same issue drove me insane for weeeeeks.

 

[Kenrou]

Problem with Hijackthis is that it hasn't been updated in 2 years. There's at least one fork updated every 3 months or so from what i see but is it any good ?

 

[Zerileous]

HJT isn't your normal anti-malware solution. Most solutions that we call "scanners" are actually scanners + automatic analyzers. HJT is a scanner only, and it leaves the analysis up to the user.

I wasn't aware that it hadn't been updated, sorry about that, its been 4+ years since I did major anti-malware work. Since HJT isn't identifying the latest threat, I don't think frequent updates are important. I did however just notice a caveat that "Though HijackThis works on Windows Vista, 7, and 8, it is unable to properly generate the report for the various types of entries. Therefore, we typically recommend HijackThis for Windows XP only." on the bleepingcomputer download page. I would still find it useful as a last resort to possibly prevent having to do a clean install.

 

[sup3rcarrx8]

Check which sites are allowed to send notifications, it sure looks a lot like a notification. You may just need to block the notifications. You can right click on the notification center and "turn notifications off." It looks like you have 20 of them there. That will prevent the Win10 notifications. Then you need to go through chrome and block them as well chrome://settings/content/notifications. Make sure you have it set to ask you before a site can send notifications.

If that doesn't work you need to run hijackthis and compare it to the running processes. Anything that doesn't match up or seem justified in its existence you'll need to go into the registry and gut it. Google it first to see if it should be there. Back up's first of course, this is not a low-risk procedure as you could kill your install, but the alternative is a clean install. May require use of safe mode if it keeps reproducing.

Lifesaver thanks guys! So far nothing popped up yet