I'm having really annoying malware (fixed)

[SsnakeBite, the No1 Frenchman]

Every 10-15 minutes, a tab opens in Microsoft Edge showing me ads for some classic scams an "antivirus" that totally won't get me more viruses, browser pay-to-win "games" or blatant pyramid schemes. This happens even when Edge isn't open, it just launches it on its own.

Now here's the thing: I don't actually use Edge and it used to happen on Firefox but I ran MalwareBytes AND AdwCleaner, deleted everything it found, then I made a clean install of Firefox (which does actually keep your bookmarks and everything) and that solved the problem... on Firefox. Because it then jumped to Edge.

So I rand MalwareBytes and AdwCleaner again and even brought in Zemana as backup. Zemana did find stuff that the other two didn't catch, I deleted that as well, reset Edge's setting, rebooted the computer... and it STILL happens. I checked again and yeah, all three antiviruses say the computer is clean, so I'm running out of ideas.

Does anyone have any idea how I can fix this?

[MC Blowfish]

Run those programs in safe mode. Look through your programs to see if anything that was installed and shouldn't be.

[Gecko]

Have a look in your task manager processes as well. If you see anything suspicious, or just don't know what something is, type it into google and that will soon tell you.

The few times I've got stuff like this that didn't want to leave, although it usually just hijacked my homepage, google was the best way to find out how to get rid of it. Of course, you need to know what you're looking for first.

[xCompackx]

Jan 22, 2017 8:52:56 GMT -5 MC Blowfish said:

Run those programs in safe mode. Look through your programs to see if anything that was installed and shouldn't be.

Yeah, definitely use Safe Mode (without networking) when doing virus scans. It's more difficult to remove malicious programs while they're potentially running and even if you remove a few things, a few can actually replace the files the antivirus catches.

[SsnakeBite, the No1 Frenchman]

Okay, I'll try the safe mode thing (already checked the processes but thanks for the suggestion anyway).

Also, I eventually decided to just straight up delete the local files related to Edge. Now I'm getting an error message, presumably due to the thing trying to launch Edge even though it can't, but at least I'm not getting a window suddenly pop out while I'm trying to do something.

[wakko]

Vince Russo is attacking your computer. It's his version of a computer run-in.

[SsnakeBite, the No1 Frenchman]

Jan 22, 2017 12:44:20 GMT -5 wakko said:

Vince Russo is attacking your computer. It's his version of a computer run-in.

Frankly, I can totally see Russo coding scam viruses just for the sake of trolling people. Then again, his viruses probably wouldn't work because he'd insist on using his own coding language that isn't recognized by the software.

[xCompackx]

Jan 22, 2017 12:50:53 GMT -5 SsnakeBite, the No1 Frenchman said:

Jan 22, 2017 12:44:20 GMT -5 wakko said:

Vince Russo is attacking your computer. It's his version of a computer run-in.

Frankly, I can totally see Russo coding scam viruses just for the sake of trolling people. Then again, his viruses probably wouldn't work because he'd insist on using his own coding language that isn't recognized by the software.

Every line would just be the word "bro" over and over.

[SsnakeBite, the No1 Frenchman]

Welp, rebooted the computer in safe mode, only HitmanPro found anything (yeah, brought that one in as well) and it was just cookies which I'm pretty sure had nothing to do with it. And I still get the error message, meaning it's still there.

Interestingly, though, the error message mentions something about incorrect values in the registry, so I assume whatever is causing this is in there but Hell if I know what to do about it.

[Oh Cry Me a Screwball]

Can you System Restore to before you were getting these pop ups?

[Alice Syndrome]

When I get one of those, I look through the uninstall program menu by date, and see what kind of crap I got added on that I don't remember adding.

[Deleted]

Whenever I do tech support, this lovely little killer is my go to program: siri.geekstogo.com/SmitfraudFix.php

Run that sucker in safe mode. It's gonna delete your wallpaper probably. Might set your homepage to whatever the browser default is but it is a gnarly little beast for catching browser hijackers. I love the thing.

I know it looks sketchy, but the thing works for me.

[SsnakeBite, the No1 Frenchman]

Jan 23, 2017 3:38:28 GMT -5 Oh Cry Me a Screwball said:

Can you System Restore to before you were getting these pop ups?

Hm, that's a good idea but I don't think I have a restore point set up. I really need to remember that's a thing.

Jan 23, 2017 5:18:20 GMT -5 Alice Syndrome said:

When I get one of those, I look through the uninstall program menu by date, and see what kind of crap I got added on that I don't remember adding.

That's the first thing I did, it at least stopped it from auto-installing a bunch of other shit I didn't want or ask for but there's still a lot of leftover files that can keep annoying you.

[SsnakeBite, the No1 Frenchman]

Jan 23, 2017 5:27:37 GMT -5 @rrnew said:

Whenever I do tech support, this lovely little killer is my go to program: siri.geekstogo.com/SmitfraudFix.php

Run that sucker in safe mode. It's gonna delete your wallpaper probably. Might set your homepage to whatever the browser default is but it is a gnarly little beast for catching browser hijackers. I love the thing.

I know it looks sketchy, but the thing works for me.

Well f*** me, I think that did the trick. No more error message or anything. Now I did run Zemana again just to be safe and it found an adware but then again, it didn't find it before so I dunno which one of them got rid of it. Either way, thank you very much. I was worried when the screen turned black with only the cursor visible (although I could access the task manager and everything) but it does seem to work and everything was perfectly fine after a reboot.

And now, to make a restore point.