JS:ScriptIP-inf [Trj]  HELP!

system · 2014-03-27T17:12:07.000Z

I did install Dyyno broadcaster as a video streaming tool, but I never use it and don’t mind getting rid of it.

system · 2014-03-27T17:17:46.000Z

I deleted Dyyno broadcaster through add/remove programs. d//led and ran your fix and attached the log file. I rebooted and no luck.

essexboy · 2014-03-27T18:24:28.000Z

And this is only in chrome, no other browser ?

Please RIGHT-CLICK HERE and Save As (in IE it’s “Save Target As”, in FF it’s “Save Link As”) to download Silent Runners.
[*]Save it to the desktop.
[*]Run Silent Runner’s by doubleclicking the “Silent Runners” icon on your desktop.
[*]You will receive a prompt:
Do you want to skip supplementary searches?
click NO
[*]If you receive an error just click OK and double-click it to run it again - sometimes it won’t run as it’s supposed to the first time but will in subsequent runs.
[*]You will see a text file appear on the desktop - it’s not done, let it run (it won’t appear to be doing anything!)
[*]Once you receive the prompt All Done!, open the text file on the desktop, copy that entire log, and paste it here.
NOTE If you receive any warning message about scripts, please choose to allow the script to run.

system · 2014-03-28T23:14:33.000Z

Hey I just saved Silent Runner and Avast popped up saying it was blocked.

Infection Blocked
URL: h_www_silentrunners_org__Silent Runners_vbs
Infection: VBS:Malware-gen
Relax, your avast! just saved you from a virus.
Protect yourself against other types of threats by upgrading now.

Should I still continue with this process or shut down avast? Is this file ok to continue with?

essexboy · 2014-03-29T12:28:03.000Z

Temporarily disable Avast to let this run, meanwhile I will upload as an FP

system · 2014-03-29T14:25:35.000Z

Hey,

I ran SR as you suggested and I wasn’t sure if I did it correctly the first time as the process went very quickly and I received the completion prompt. I tried to run it a second and third time, but the completion prompt never came up… not sure if this is something you can only run once or not. I have attached the three text files that were produced.

system · 2014-03-29T14:30:36.000Z

I ran it once more and got the completion prompt.

I attached the txt for you.

essexboy · 2014-03-29T14:57:26.000Z

Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that

system · 2014-03-29T16:37:05.000Z

I ran the fix and attached the log. After reboot, the virus pop up still persists.

: (

essexboy · 2014-03-29T16:39:38.000Z

OK I will have to have a think about this one. All I can say at the moment is that a programme is trying to update a server list using a bad URl.

I will be back later after rummaging through my tools. As it stands it is just chrome that is affected

system · 2014-03-30T22:00:11.000Z

Thank you again for all your help. I am not sure what you mean by URI.

The virus is only impacting Chrome. Have a great weekend.

polonus · 2014-03-30T22:12:29.000Z

Hi flatcoke,

uri and URL are terms often mixed up, read about what an uri is here: http://nl.wikipedia.org/wiki/Uniform_Resource_Identifier
URL is a form of an uri.

polonus

essexboy · 2014-03-31T13:18:08.000Z

The problem with something like this is that no antimalware or antivirus programmes will detect it. Hence all the manual searches

I do not believe that the shortcuts are infected but we can try this next

Could you download and run short cut cleaner from here http://www.bleepingcomputer.com/download/shortcut-cleaner/

Once done could you post the log

system · 2014-03-31T14:28:02.000Z

I ran the program and attached the log for your review. After reboot, the virus still popped up. I’m surprised this thing hasn’t gotten more widespread given that it is so hard to find.

essexboy · 2014-03-31T15:24:44.000Z

As it is only in Chrome there is no way to look for a common denominator in the other browsers. Also extensions within Chrome can autoupdate without the user knowing, although I believe that is changing soon.

Having another look at all logs

system · 2014-03-31T17:19:42.000Z

One thing to mention now that you bring up other browsers.

Though I do not get the virus pop up message from Avast when launching IE, I did notice that IE crashed a few times for an unknown reason. I am trying to use it now, but can’t replicate the crash. Not sure if this intermittent crashing for IE is related to the virus pop up within Chrome.

essexboy · 2014-03-31T17:34:10.000Z

Could you run an all users OTL scan please and I will have another look at chrome, also could you have chrome closed when you run the scan

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[]Select LOP and Purity
[]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
c:\program files (x86)\Google
c:\program files\Google
dir “%systemdrive%*” /S /A:L /C
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

system · 2014-04-02T22:00:03.000Z

Hi Essexboy…

So I turned on my computer today and launched chrome and oddly the virus pop up did not come up. I don’t know why this is or if it was a fluke so I rebooted and started chrome again. Same thing… no virus pop up came up… I just saw your last message to run an OTL scan, but haven’t tried that.

Any thoughts on what happened to the virus? Logically I don’t see why the pop up would disappear… is it possible that it took time for the last fix to work? That doesn’t make sense to me…

Some things that have changed, I added a chrome extension cal Adblock pro to block google ads… I have also noticed that Avast has had a few virus definition updates recently.

Is it possible that the adblock extension is preventing the virus from starting?
is it possible that the new virus definitions added to Avast allowed Avast to remove the virus completely?

Anyway, I’m hoping this is the end of it all. Is there any final scan you would want me to do to determine if this problem, is in fact, resolved?

essexboy · 2014-04-03T13:02:18.000Z

Hmm weird, I do not feel it was an FP as you appear to be the only one. An Avast update may have removed the offending file, although you should have been informed of that

Leave it for a day or so and if it does not return consider it fixed

system · 2014-04-03T16:35:34.000Z

Thank you again for all your help on this. You rock man.

Announcements