Cookies are only setting in one tab

[Cliff S]

Okay then, I've deleted a few folders from redundant programs (I'm really surprised how many Github leave behind) and some temp files. If nothing else, I've got rid of some rubbish from my PC which is always good.

Yeah I always check there after uninstalling/before reinstalling. specially if I'm having problems with settings in a program. That way it kills the registry links too.

 

[chris98]

I looked in Task manager as it came back again today, and there was nothing related in there like the article you linked to says. However, I do have the scan results here which might help a bit more:

Malwarebytes Anti-Malware
[URL="http://www.malwarebytes.org"]www.malwarebytes.org[/URL]
Scan Date: 19/05/2015
Scan Time: 11:54:16
Logfile: scan_results.txt
Administrator: Yes
Version: 2.01.6.1022
Malware Database: v2015.05.19.02
Rootkit Database: v2015.05.16.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 8.1
CPU: x64
File System: NTFS
User: Christopher
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 348593
Time Elapsed: 29 min, 16 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 1
PUM.Hijack.CMDPrompt, HKU\S-1-5-21-2974942078-2449443277-1922112558-1001\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM|DisableCMD, 1, Good: (0), Bad: (1),,[c6b8197c0e7c84b257e2e23aaf57e41c]
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)

(end)

 

[Cliff S]

Registry Data: 1
PUM.Hijack.CMDPrompt, HKU\S-1-5-21-2974942078-2449443277-1922112558-1001\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM|DisableCMD, 1, Good: (0), Bad: (1),,[c6b8197c0e7c84b257e2e23aaf57e41c]

Go ahead and delete this key.

 

[chris98]

Okay, I removed the key 'DisableCMD'. Hopefully that should solve the issue, I'll let you know what happens.

 

[chris98]

Nope, the same key has come back again. I've removed it with MalwareBytes and removed the key in regedit again, though I have a feeling it will probably just come back again ....

 

[Cliff S]

Have you tried that link I posted in post #19?

 

[Cliff S]

Try running a Full Scan with your Anti Virus, than a full scan with Microsoft’s Malicious Software Removal Tool(Just type MRT in search), and then Malwarebytes again. Try to do it in safe mode.

 

[chris98]

Have you tried that link I posted in post #19?

Yes, that's exactly what was picked up in the scan and what you said to remove in post #23. I've noticed though that it has now come back again since this morning.

There was also a default key picked up when I searched, I'm not sure whether that should be deleted or not so I attempted it and it wouldn't let me. The default key did not have a value, though.

I'll run the scans you suggested now, but after removing it again I may need to wait a few hours yet for it to come back.

 

[Cliff S]

You could also look in services and see if there is anything related. Some malware have services so that it can repair it self. But the best bet is to scan in safe mode.

 

[chris98]

I found this in Task manager, when I looked much more closely in the "Details" tab: wmiprvse.exe

I honestly don't know what stood out to me about this, as I don't know some of the process names in Task manager, but something did about this name, and when searched Google, it seems to have given me incontrovertible proof it's related: https://www.google.co.uk/#q=wmiprvse+PUM+hijack

The initial scans finished with nothing found, I'll let you know later what happens when I run it in safe mode.

 

[Cliff S]

https://forums.malwarebytes.org/index.php?/topic/104017-hijack-virus/
See this thread at malwarebytes help. It's not always considered malware(in your case most likely though).

 

[chris98]

Ah that's interesting. I used group policy to disable quite a few things, could it be part of that?

If it is though, the thing which I don't understand is why it flags as being PUM HIJACK.

 

[Cliff S]

Found in Wikipedia:

[h=2]Details[edit][/h]The name is assigned by Malwarebytes' Anti-Malware and is not the specific name of a unique virus or hack. The "PUM" defines a "Potentially Unwanted Modification," and the "bad.proxy" defines the modification. The ability to search for and alert a user to "Potentially Unwanted Modifications" was added to Malware Bytes in November, 2010. It is likely that the first day users began reporting PUM.bad.proxy was not the first day the hack existed, but rather the first time Malware Bytes could alert a user to the vulnerability.[SUP][2][/SUP] Also, the fact that the proxy server is often not active when Malware Bytes alerts a user to its presence may indicate that it is a remnant of a virus, hack, or other malicious software that had previously been removed or quarantined

Source: PUM.bad.proxy - Wikipedia, the free encyclopedia