Removal instructions for NewzFinder

Content is republished with permission from Malwarebytes.

What is NewzFinder?

The Malwarebytes research team has determined that NewzFinder is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.
This particular one changes your default search engine and adds recommendations to the results.

How do I know if my computer is affected by NewzFinder?

You may see this entry in your list of installed Chrome extensions:

You may have noticed these warnings during install:

and this changed setting:

How did NewzFinder get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was downloaded from the webstore:

after a redirect from their website:

How do I remove NewzFinder?

Our program Malwarebytes can detect and remove this search hijacker.

Please download Malwarebytes for Windows to your desktop.
Double-click MBSetup.exe and follow the prompts to install the program.
When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
Click on the Get started button.
Click Scan to start a Threat Scan.
When the scan is finished click Quarantine to remove the found threats.
Reboot the system if prompted to complete the removal process.

Is there anything else I need to do to get rid of NewzFinder?

No, Malwarebytes removes NewzFinder completely.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below Malwarebytes Browser Guard, and the full version of Malwarebytes would have protected you against the NewzFinder hijacker. It would have blocked their website, giving you a chance to stop it before it became too late.

Technical details for experts

Possible signs in FRST logs:

CHR DefaultSearchURL: Default -> hxxps://search.mybrowsingsafety.pro/search/?category=web&vert=safe&s=c6pr&q={searchTerms}
CHR DefaultSearchKeyword: Default -> newz
CHR DefaultSuggestURL: Default -> hxxps://sug.mybrowsingsafety.pro/v1/sug/?s=c6pr&ssv=2&vert=safe&q={searchTerms}
CHR Extension: (Newz Finder) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp [2021-05-10]

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0
       Adds the file config.js"="8/23/2020 9:06 PM, 1379 bytes, A
       Adds the file manifest.json"="5/10/2021 9:18 AM, 1793 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\_metadata
       Adds the file computed_hashes.json"="5/10/2021 9:18 AM, 7958 bytes, A
       Adds the file verified_contents.json"="8/23/2020 10:16 PM, 6268 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\bg
       Adds the file background.html"="8/23/2020 9:06 PM, 139 bytes, A
       Adds the file background.js"="8/23/2020 9:06 PM, 3403 bytes, A
       Adds the file defaultSettings.js"="8/23/2020 9:06 PM, 323 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\img
       Adds the file basket.svg"="8/23/2020 9:06 PM, 1014 bytes, A
       Adds the file business.svg"="8/23/2020 9:06 PM, 2985 bytes, A
       Adds the file default.svg"="8/23/2020 9:06 PM, 3460 bytes, A
       Adds the file extertainment.svg"="8/23/2020 9:06 PM, 2800 bytes, A
       Adds the file general.svg"="8/23/2020 9:06 PM, 41639 bytes, A
       Adds the file health.svg"="8/23/2020 9:06 PM, 1220 bytes, A
       Adds the file icon128.png"="5/10/2021 9:18 AM, 2689 bytes, A
       Adds the file icon16.png"="5/10/2021 9:18 AM, 355 bytes, A
       Adds the file icon48.png"="5/10/2021 9:18 AM, 882 bytes, A
       Adds the file logo.svg"="8/23/2020 9:50 PM, 7197 bytes, A
       Adds the file pen.svg"="8/23/2020 9:06 PM, 348 bytes, A
       Adds the file plus.svg"="8/23/2020 9:06 PM, 456 bytes, A
       Adds the file science.svg"="8/23/2020 9:06 PM, 3111 bytes, A
       Adds the file select-arrow.svg"="8/23/2020 9:06 PM, 175 bytes, A
       Adds the file slider-img-1.png"="8/23/2020 9:06 PM, 26753 bytes, A
       Adds the file slider-img-2.png"="8/23/2020 9:06 PM, 25909 bytes, A
       Adds the file slider-img-3.png"="8/23/2020 9:14 PM, 27744 bytes, A
       Adds the file sports.svg"="8/23/2020 9:06 PM, 1278 bytes, A
       Adds the file stories.svg"="8/23/2020 9:06 PM, 6050 bytes, A
       Adds the file technology.svg"="8/23/2020 9:06 PM, 2283 bytes, A
       Adds the file x.svg"="8/23/2020 9:06 PM, 200 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\img\engine-logos
       Adds the file buzzfeed.svg"="8/23/2020 9:06 PM, 470 bytes, A
       Adds the file cnn.svg"="8/23/2020 9:06 PM, 3859 bytes, A
       Adds the file google.svg"="8/23/2020 9:06 PM, 6930 bytes, A
       Adds the file huffingtonpost.svg"="8/23/2020 9:06 PM, 259 bytes, A
       Adds the file nbcnews.svg"="8/23/2020 9:06 PM, 2020 bytes, A
       Adds the file nytimes.svg"="8/23/2020 9:06 PM, 1942 bytes, A
       Adds the file yahoo.svg"="8/23/2020 9:06 PM, 509 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\libs
       Adds the file jquery.js"="8/23/2020 9:06 PM, 89476 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\libs\selectric
       Adds the file selectric.css"="8/23/2020 9:06 PM, 4207 bytes, A
       Adds the file selectric.js"="8/23/2020 9:06 PM, 14348 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\libs\slick
       Adds the file slick.css"="8/23/2020 9:06 PM, 1776 bytes, A
       Adds the file slick.min.js"="8/23/2020 9:06 PM, 42863 bytes, A
       Adds the file slick-theme.css"="8/23/2020 9:06 PM, 2791 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfhfmkmokccaciopjahpkmfdbkjbhmfp\3.0.1_0\popup
       Adds the file new.css"="8/23/2020 9:06 PM, 639 bytes, A
       Adds the file popup.css"="8/23/2020 9:48 PM, 18277 bytes, A
       Adds the file popup.html"="8/23/2020 9:27 PM, 11536 bytes, A
       Adds the file popup.js"="8/23/2020 9:06 PM, 16014 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings]
       "hfhfmkmokccaciopjahpkmfdbkjbhmfp"="REG_SZ", "AE1FA71A05E96D48518A887104B8400C36239064F0B76B7E6E1BAEFFE0869230"

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/10/21
Scan Time: 12:03 PM
Log File: fa2de2a8-b176-11eb-a01f-080027235d76.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1273
Update Package Version: 1.0.40286
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}-PC\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 234016
Threats Detected: 7
Threats Quarantined: 7
Time Elapsed: 1 min, 41 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Value: 1
PUP.Optional.NewzFinder, HKCU\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|hfhfmkmokccaciopjahpkmfdbkjbhmfp, Quarantined, 16342, 938760, , , , , , 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.NewzFinder, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HFHFMKMOKCCACIOPJAHPKMFDBKJBHMFP, Quarantined, 16342, 938760, 1.0.40286, , ame, , , 

File: 3
PUP.Optional.NewzFinder, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 16342, 938760, , , , , AE0F100713FDC20D7F841168E2D6AD25, 633EF3CE919D026E689FC61CD98EB25EAB31CE9F965C79D199D6364BD06CE74D
PUP.Optional.NewzFinder, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, 16342, 938760, , , , , 14032E31B791AF3E3C1292E88BDF2A46, 720F8E3178B83CF6183608CFD36F711037A00A73F2E5CB6AC853B91A4AE37B47
PUP.Optional.NewzFinder, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HFHFMKMOKCCACIOPJAHPKMFDBKJBHMFP\3.0.1_0\MANIFEST.JSON, Quarantined, 16342, 938760, 1.0.40286, , ame, , 68ED697C608600BF17771F47A9F6CEB6, 7100FFFBA9D0C4249592DB82A1B29F6581E499437E1763F5C7FF2B261A2C54C8

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

Dynamically Blocks Malware Sites & Servers
Malware Execution Prevention

Save yourself the hassle and get protected.

#1
Metallica

Posted 10 May 2021 - 04:48 AM

Advertisements

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us