As far as I can tell this malware works by overriding the meaning of the "New Tab" address in chrome (chrome://newtab), replacing the real editable start page with a fake (non editable) copy of the default start page. I found a useful comment on Reddit- Found a solution to the chrome://newtab yahoo/bing/etc search hijacker : r/chrome Unfortunately it seems to spray bad links all over the users profile (mostly directed via Yahoo) so a profile reset or a clean reinstall of Chrome may be the only options.

How can I set Kaspersky Service 21.22 (AVP21.22) startup type to manual, and also stop the service after exiting Kaspersky Free? The Self-Defence settings are all turned off: * Security settings / Self-Defence settings / Enable Self-Defence = OFF * Security settings / Self-Defence settings / Block external management of application services = OFF But I still have no access to the service: sudo sc config avp21.22 start= demand [SC] ChangeServiceConfig FAILED 5: Access is denied. sc qprotection avp21.22 [SC] QueryServiceConfig2 SUCCESS SERVICE avp21.22 PROTECTION LEVEL: ANTIMALWARE LIGHT. Windows 11 Pro, v10.0.26100.6584 Kaspersky Free 21.22.7.466(a)

Also, do a Chrome config reset, also check in Your Windows -> Control Panel -> Programs and Features, if there is a suspicious app installed.

@colin_e Also, did you check with AdwCleaner ?

Please check the system requirements of Ksos, ksos is not supported in Datacenter mode of Windows server

Hi, thanks for coming back to me. >> Please provide version of K. product installed. Hmm. I've been using KAV for years, but every couple of years they change the UI, and now I find this very basic question isn't so easy to find the answer for? Annoying that this information does not seem to exist in the main application UI (surely this can't be true?) HoweverI found it under the right-click context menu of the systray icon- Kaspersky Standard 21.227.7.466 (a) Virus database is up to date >> That looks like just a fake / false infection pop-up warning coming from a site, just a site notification in Your browser, not a real infection. Yes that does seem to be the case. They do quite a good job of mimicing OS notifications. I originally thought that the popups were independent of the browser, however I was mistaken. This user uses Google Chrome as their default browser. A couple of days ago they noticed that their Chrome home page had changed from their personal set of preferred links to a generic set of home links (YouTube, Netflix etc.). I have checked and they have no Chrome extensions installed, so it seems this home page has been hacked or overridden and this is where the popups are being triggered. Kinda worrying that the Chrome config can be changed in this way without the user realising. Any hints on cleaning up the start page would be welcome. Worst case I can remove and reinstall Chrome, but i'm rather concerned if the same thing could happen again on a "driveby" basis, i.e. if this can happen just because the user visits the wrong web site.

Welcome to Kaspersky Community. Please provide version of K. product installed. That looks like just a fake / false infection pop-up warning coming from a site, just a site notification in Your browser, not a real infection. The funny thing is that WebAdvisor it's a real product but from McAfee, not AVG. If You are using MS Edge, check this: https://support.microsoft.com/en-us/microsoft-edge/manage-website-notifications-in-microsoft-edge-0c555609-5bf2-479d-a59d-fb30a0b80b2b#:~:text=Select Settings > Cookies and site,select either Remove or Block Similar steps can be done in all the browsers. I would recommend installing an extension to avoid adds in browsers: uBlock Origin -> FireFox uBlock Origin Lite -> Chrome, MS Edge, Opera

Welcome to Kaspersky Community. Please provide version of K. product installed. I guess all the Android / Google / Samsung Store updates in Your SA52 are up-to-date. Did You reboot or Power off / on the device?