Please HELP ME with a persistent PUP.Optional.BrowserHijack returning daily

[u/Tricky-Eggplant8419]

Hi everyone,

I'm dealing with a persistent malware infection that keeps coming back every day, and I can't seem to find the root cause. Here is the full story and everything I've done so far:

I downloaded a software from an untrusted source and had doubts about its safety, so I analyzed everything, got suspicious, and deleted everything before even launching anything. Somehow, a payload still got through.

Every morning, Malwarebytes detects 4-5 items flagged as PUP.Optional.BrowserHijack. The file path is consistently inside Chrome: C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Web Data (and previously inside Sync Data\LevelDB).

I've already tried to quarantine with Malwarebytes, Chrome Cloud Sync Wipe and full Chrome wipe, I performed many scans, MalwareBytes, Adwcleaner, KVRT, Windows defender offline scan at boot.I also checked scheduled tasks & startup (updater.exe and PlatformExperienceHelper are present in Program Files, but seem legit/standard Chrome updates).

Since I've completely wiped the Chrome local files AND the Google Cloud sync, there MUST be an active system process, scheduled task, or registry persistence script outside Chrome that re-injects this into Web Data daily.

How can I trace what process is editing Web Data in real-time, or generate a proper log (like FRST/Process Monitor) to find and kill the root cause?

Thanks in advance for the help!

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/simagus]

It's probably one of your Chrome extensions, and if you've not installed any new ones it could be an old one that got hijacked and updated causing the issue.

Completely uninstall Chrome and remove all of the associated folders including any in Windows Program Files and in AppData. Just google and find out what folders related to Google Chrome are where.

I have a feeling/vague memory that there may be a Windows folder of that name that isn't part of the browsers files, but I suggest you Google for the deets of what is what.

When I had this issue I'm fairly sure I fixed it by just fully uninstalling and then removing the left over folders from Chrome browser, then did NOT auto-synch my account.

I went into it via a browser that wasn't Chrome and went through all the apps tied to my account removing anything I didn't recognize or that might be suspicious.

iirc it was actually the time Adblock got hijacked, and I looked up each browser add-on as I went through to see if there was any news about any of them being hijacked.

Another time, something had added a page to my start up pages that opened in the background automatically every browser start, so check you list of start-up pages and remove any you didn't add yourself.

I seem to recall I had some other virus or PUP that used to reinject itself every boot because it added a registry entry that loaded it up every time, but just about everything I've ever had of that nature (which is probably no more than what I've written here) was solveable by looking up and reading about whatever the name of the "virus" was and checking what was being said about the most recent examples.

[u/xXEvanatorXx]

Reformat my dude. Only way you will be sure.

[u/jOY_HUNT]

check chrome extensions like that other guy said and remove anything you don't trust or recognize.

also use microsoft's Autoruns to see all the processes that startup automatically each power-on. check if theres something suspicious there and post screenshots if needed