Chrome opens on login and goes to a set website.
Basically, I've got this http://i.imgur.com/lcbh68C.png (Horo is my account's name) and deleting it fixes it for a random amount of time before it comes back in the exact same place (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run).
When it's there, as soon as I log in and explorer.exe starts it opens chrome (my default browser) and goes to that website, which redirects to zodiac-game.info.
I have no idea where to look for it, malwarebytes and hitmanpro don't find anything, and like I mentioned deleting the entry from the registry doesn't kill it for good. Any ideas?
EDIT: I think I figured something out. I just noticed a cmd window opening and closing really quick, I didn't see what was in it BUT, I went into running processes right after and I noticed another explorer.exe which was taking up 7.5k kb ram as opposed to the 23k the main one did. I also went into the registry editor and there it is, the entry same as it was before. So I guess all I know at this point is that it might be a file that adds a registry entry at an interval?
Posted Aug 29, 2016, 11:55 PM UTC · edited