So I’m here to report it manually, as I’d like to use the boot-time scan to remove it as its folder is hidden even though I’ve checked the box to show hidden files, so in other words I had a really hard time finding it, and when I found it it either runs or need some kinda magical powers to remove it (more than admin rights). Thus I thought boot-time scan. However, it is not detected as a virus, malware, or anything of the sort. Thus I came here to report it, and it’s location.
(Since no one on the internet seemed to know about it either… saw some guy in Germany ask what the file was but no one had an answer.)
What it does, I’m not completely sure, but it’s something along the line of running an IE script which blocks most sites which starts with account. , support. (i.e. support.Google, account.google) is some way associated with the SSL certificates for Chrome, also google.com, adblockplus.org etc. I don’t even know what it does with FF, sometimes when clicking a link, it opens a totally unrelated site which contains one similar word (cookies) and it seems to mess with my cookies since I’ve been unable to log into youtube until recently. (from after it’s appearance)
The location is: C:\ProgramData\AudioCodec0\cxyqcosaq.exe
The only reason why I found it was because iexplorer.exe kept popping up in task manager when I closed it, and I ended up noticing another app popping up every time in between, just to disappear a few seconds later. I checked the resource monitor to be able to read the name, but with no success on the searches. Until the program crashed and made multiple entries, which made it easy to use the [right-click]>[open file location] from the task manager.
Also I’d upload the file if I could so that you could analyze it further. However, one it would be foolish of me to do so, as people would probably download it themselves and get the same problem, and second, I’m unable to do so, as the forum doesn’t support upload of files large enough, nor .exe files.
I guess even though I didn’t check the box so that people would be able to email me, as I do not wish for unintended spam, I guess the site admins still have the right, so if you want the file contact me.