1

I don't know why but this has been happening for a while now:

In every browser (Chrome, Firefox, IE) there is always a script attached at the end of the code.

That's the script:

http://cupons.dantis.com.br/api/app/landing.php?app=QUMtMjItMEItQkQtODAtQUQ=&aff=999999&partner=999999

It's an adware or something, I blocked the domain coupons.dantis.com.br on my hosts file only so the php script won't run and gather my personal info.

But the script is always there anyways, I have tried unninstalling the browsers and the extensions, I have removed many programs that seemed suspicious, nothing.

I ran Junkware Removal Tool, AdwCleaner, antivirus, Malware Bytes.

I'm desperate.

I need to track the process behind this script inclusion or a way to block it trough the browser.

enter image description here

DavidPostill
  • 162,382
Phiter
  • 143
  • 8

1 Answers1

1

Ok, got it!

There was a process called viva.exe

I tracked down the folder where the exe was at, and closed the process. Then deleted the file.

The script is gone.

Phiter
  • 143
  • 8