How to delete Trojan webvaultpro.co.in on windows PC

Question

How to delete Trojan webvaultpro.co.in on windows PC

Daniel Scotti 0

I have continuous pop up warnings saying Trojan found in /Win 32, virus caught in browser from "Google Active Defender", which has button to Block Virus and Scan OC which dont work but delete the popup. These buttons open chrome and showed the following:

The webpage at hxxps://us-sea-avpc-redirect.trafficflowdiscovery.com/index.php?cid=dc07f241f8ba4a5582a7a01d8ccb228c&extclickid=dblp29ghubcc73etl6n might be temporarily down or it may have moved permanently to a new web address.

A second popup says System Warning PC infected. Click to activate windows defender.Gmail infected with malware, webvaultpro.co.in. Scan now and Delete Virus buttons also don work. These buttons open chrome and showedthe following:

The webpage at hxxps://us-sea-avpc-redirect.trafficflowdiscovery.com/index.php?cid=dc07f241f8ba4a5582a7a01d8ccb228c&extclickid=dblp29ghubcc73etl6n0&t1=&t2=&type=push&creativeId=10221954&creativeButton=2&subAge=0 might be temporarily down or it may have moved permanently to a new web address.

Malwarebytes found 3 trojans which were quarantined and subsequently deleted. Norton found no threats. I rescanned both with no threats found. I reran both with no results. A Norton popupshowed a blocked Threat with name: URL: BLOCK [Fake Scan] on dbmc3d8hubcc73fm9fp0.logicprolabs.com. Process is C\Program Files\Google\Chrome\Applications\chrome.exe

I went into Control Panel under Apps and Programs and didn't find any apps that were suspicious to delete, especially focusing on the last few moths.

I ran Microsoft Safety Scan which had detected 212 threats after about 4 hours but when the scan finished it reported no virused, Malware or other unwanted software.

0 comments

2 answers

Your answer

Answer 1

Remove webvaultpro.co.in and the other unfamiliar domains from Chrome’s notification permissions—the warnings match browser-notification scareware, while the completed scans do not currently establish an active Windows infection.^1^

Remove the source of the pop-ups

Do not press Block Virus, Scan, Delete Virus, or any button inside these alerts.

Open Chrome.
Select ⋮ → Settings → Privacy and security → Site settings → Notifications.
Under sites allowed to send notifications, find and remove or block:
- webvaultpro.co.in
- logicprolabs.com
- trafficflowdiscovery.com
- Any other domain that you do not recognize
Go to Settings → Privacy and security → Site settings → Recent activity.
Open each suspicious entry and choose Reset permissions or Clear data.
Go to Settings → Privacy and security → Site settings → Pop-ups and redirects and select Don’t allow sites to send pop-ups or use redirects.^2^
Open ⋮ → Extensions → Manage extensions. Remove anything unfamiliar, recently installed, or no longer used, and then restart Chrome. Google also identifies unwanted permissions, extensions, or software as causes of persistent pop-ups and redirects.^3^

If an alert prevents Chrome from closing, press Alt+F4. If necessary, press Ctrl+Shift+Esc, select Google Chrome, and choose End task. Microsoft advises closing the browser rather than interacting with frightening virus messages generated by websites.^4^

Norton identifying chrome.exe as the process means Chrome attempted to reach the blocked address; it does not by itself mean that Chrome is infected.

Interpret the Safety Scanner result

The number displayed while Microsoft Safety Scanner is running is not the result to act on; review its final result and detailed log:

Press Windows+R.
Enter %SYSTEMROOT%\debug and press Enter.
Open msert.log.
Scroll to the bottom and examine the final summary, detection names, remediation results, and any error beginning with 0x.

Microsoft documents msert.log as the detailed detection record.^5^ If it contains an error, use that exact code to determine whether the scan skipped something—for example, 0x80508026 means a detected item is inside an archive and must be identified and removed from that archive.^6^

Since Malwarebytes already quarantined and deleted its findings and repeated Malwarebytes/Norton scans were clean, do not simply repeat those same scans.

If alerts continue after Chrome cleanup

First determine whether they occur:

Only while Chrome is running: revisit notification permissions and extensions. If Chrome synchronization is enabled, also inspect extensions and permissions on other synchronized devices.
With Chrome completely closed: treat that as a separate sign that further malware verification may be warranted.

For the second case, use Microsoft Defender Offline on a supported x64 Windows 11 PC:

Save all work and close applications.
If BitLocker protects the system drive, suspend BitLocker first or have the recovery key available.
Open Windows Security → Virus & threat protection → Scan options.
Select Microsoft Defender Offline scan → Scan now.
Approve the restart and let the scan finish.

This scan runs outside the normal Windows environment and is intended to detect persistent malware such as rootkits. It does not apply to ARM Windows 11, and it requires local administrator rights and Windows Recovery Environment to be enabled.^7^

If you downloaded or installed anything from an alert, entered a password, supplied payment details, or granted remote access, change affected passwords from a known-clean device and contact the relevant bank or service provider. Fake security alerts commonly attempt to obtain credentials, payment information, or remote access.^4^

References

Answer 2

Please share your Farbar scan logs for analysis.

Download Farbar Recovery Scan Tool 64-bit FRST64.exe
If the OS language is not English, rename FRST64.exe to FRST64English.exe.
Run the program. Don't check or uncheck any options. Click "Scan".
Add the two logs, FRST.txt and Addition.txt, to a zip archive.
Share the zip file on OneDrive or GoFile.io, and post the link here.

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot. It's a safe tool used in most antimalware forums.