Windows 10: Google chrome and firefox starting up with a virus website (fanli90)

Hi,

I am running windows 10 on the latest update, recently i downloaded a programme that turned out to be a virus and after getting rid of the virus, being a trojan running a UC Browser some stuff are still left, i used windows defender and Avast pro antivirus.

The problem occurs every time i open up google chrome, it opens up with a random website being "fanli90.cn" i tried usinf adwcleaner and but nothing seems to get rid of this. i uninstalled google chrome and reinstalled, i even installed firefox but the same website opens on each browser. i tried uninstalling the most reccent programme but nothing seems suspicious.

could you please tell me what to do, thank you

:)

 

hi.fo virus automatically opens tab on google chrome start up

Hi,

Everytime i open google chrome, a tab opens on start up redirecting me to hi.fo website. Can anyone please help me remove the virus?

Changing the startup options from chrome settings does not help.

Thanks,

Waleed

 

ERR_CONNECTION_TIMED_OUT error in Google chrome

I've posted it in the Google Chrome forum. However, I'm finding the website doesn't work on Chrome or Firefox

 

Download Malwarebytes: Malwarebytes | Free Anti-Malware & Malware Removal And perform a scan.

Instructions here: How to remove Fanli90.cn redirect (Virus Removal Guide) Scroll down to Step 2: the instructions for Malwarebytes.

More here: AdwCleaner review & free download: Remove Adware, PUP, Toolbars, etc.

 

That is why I only use Edge Browser and no third party browsers
Chrome did at one time warn people to make sure they unticked the add on's they did not want

 

When random website appears open Task Manager, under Processes highlight intruder and click on End Task button.
Shut down computer, then disconnect router.
Reconnect router, start computer.

 

I've tried malware bytes and still no solution. It found a few viruses and still nothing. Website still opens up with a virus website. I've become accustomed to chrome becoz of the way my bookmarks and the new tab page is set up so I really don't wana change. And as for task manager I've tried that but I cannot find anything suspicious I'm going to check it out again soon, thank you. Any other options?

 

Maybe this: How to remove Fanli90.cn from Chrome, Firefox, IE - YouTube

 

Thanks for your advice 'prikker' but it seems those solutions still do not work. I'm gonna have to try spy hunter but the only problem is you have to but the program so I'm not too sure now.

 

Have you checked your Host file. Windows => system32 => drivers => etc Open it in Notepad.

Generally if not always there should be no lines that are not commented out.. They should all start with # sign, which is a comment.

When you are going after these things shut off restore points. Boot to safe mode and then run your tools and processes like reset browsers

Are the tools not detecting or are they reporting they cannot fix?

 

Sorry Caledon ken I am abit unclear about what you are trying to say. I went into the drivers folder in system32 and couldn't find a host file. So I searched in that folder, found a file called 'host' opened it in notepad and noticed it all starts with hashtags. But I don't know what to do with this. The tools are detecting something and removing them, which was UC I will try adwcleaner again and see if it detects this. But before it didn't

 

rezarawat,


It is here: C:\Windows\System32\Drivers\etc <<---


Try opening the hosts file and see if there is something unusual there.

Right-click the Windows Start and select: Command Prompt (Admin)

At the Command Prompt, type the following commands, one at a time, and press ENTER after each::

cd drivers
cd etc
dir

The contents are shown, and below them, the following appears:
C:\Windows\System32\drivers\etc>

At the above, type: notepad hosts
A Notepad text appears.

Please copy the results, and provide in your reply.

 

Also, let's do the following:

Use the Zemana AntiMalware Download


Double-click on the file Zemana.AntiMalware.Setup.exe to install.


When the program starts you are presented with a Setup screen, click: Next
Follow the prompts to install.

Once Zemana AntiMalware starts, click: Scan


When Zemana AntiMalware is finished it displays a list of all the malware found.
Click on Next to remove the malicious files from your computer.


A reboot may be required to remove malware.


Click the Graph icon (far upper riht), highlight the applicable log file, and then click: Open Report

Please post the notepad text file for review.

 

Please do NOT, under any circumstances, install SpyHunter on your system. You're just asking for trouble by doing that.

-Run TDSSKiller - in the options, select all boxes from the bottom up; it will reboot to scan
-Open Ccleaner free, clear all cache/history in all browsers - even ones you don't use.
-Flush your DNS - at admin command prompt: ipconfig /flushdns
-Reset all browsers on the machine - even ones you don't use.
How to Reset Your Web Browser To Its Default Settings

Microsoft Edge - Reset to Default in Windows 10

-Run RKILL
-Run ADWCleaner
-Run JRT

All these tools are free. All should be done in this order.

 

hi cottonball ive done what you asked:

using comand prompt:
----------------------------------------------------------------------------------------------------------------------------------------------------------# Copyright (c) 1993-2006 Microsoft Corp.#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost