Threat? clients2.googleusercontent.com w/JS:ShellCode-S[Expl]

Pondus · 2017-11-06T19:29:28.000Z

From the screenshot it seem you may have a chrome extension that try to connect to that url, that containe the exploit avast is blocking

Malware experts are notified, it may take some hours before anyone is online

system · 2017-11-06T19:32:49.000Z

Thanks… no rush, as it seems this is unlikely anything major (I hope).

Pondus · 2017-11-06T19:37:58.000Z

while waiting you can try this

https://support.google.com/accounts/answer/32050?co=GENIE.Platform%3DDesktop&hl=en

system · 2017-11-06T19:43:05.000Z

Yep, already cleared cache & cookies… also use CCleaner (updated version) and run the Windows Disk Cleanup tool.

SassDrake · 2017-11-06T20:41:27.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

CHR HKU\S-1-5-21-3719281007-1545348927-2765418579-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

Then,
Follow instructions from to open Chrome extension manager:
https://support.google.com/chrome_webstore/answer/2664769?hl=en
and remove following extensions:

hxxps://keep.google.com/u/0/
hxxps://news.google.com/nwshp?hl=en&tab=wn&ei
KDSPY

system · 2017-11-06T20:58:06.000Z

OK… just followed your instructions except I paused before removing the 3 extensions you mentioned… as you said to post the fixlog.txt before I continued. It’s attached…

system · 2017-11-06T21:37:56.000Z

Well, the Avast threat popup was STILL popping up every 20 minutes or so… and so I decided instead of waiting to hear back from you as to whether I should go ahead and remove those extensions you suggested (which you said to post the Fixlog.txt FIRST & basically wait to hear back from you before moving forward…) So, just about a minute ago, I went ahead and did the second part of your suggestion before I got your last post… to remove Keep, remove News from extensions/apps. That’s now done. But I only disabled KDSPY instead of removing as you suggested (I’m an author and use that frequently on Amazon). So, we’ll see in the next half hour or so if it pops up again…

system · 2017-11-06T23:21:59.000Z

Nope, this did NOT fix it. I was off the net for about an hour (meal time!) and just got back on the computer. About 3 seconds after opening Chrome, the same Avast pop-up appeared. And I DID remove the Keep and the News as you said. And the KDspy is not enabled. Soooo… not sure what to do now :-\

SassDrake · 2017-11-07T15:46:42.000Z

Try now to disable extensions one by one until you reach point where Avast doesn’t show messages. WHen you find it tell which one was that so we can report it to Google or Avast (if it is false positive).

Also, please attach following file to your post.

C:\ProgramData\AVAST Software\Avast\report\WebShield.txt

system · 2017-11-07T18:14:58.000Z

I will give it a try… Also, the only extensions I have ENabled at chrome://extensions are: Avast Online Security, Google Docs and Google Offline Docs. That’s it. There are several other extensions listed (which all seem to be ones that are OK) that are NOT enabled right now.

At chrome://apps, I show Asana, Google Calendar, Google Web Store, Google Docs, Google Drive.

You requested the attached:

SassDrake · 2017-11-07T18:36:30.000Z

Now this is really strange. Do you have or had extension named Blasty? I don’t see it in FRST logs.

system · 2017-11-07T19:16:20.000Z

Yes!! I had Blasty!! But it isn’t listed in the extensions or apps anymore. I can’t recall if I removed it in the last several months or not… of if it just disappeared. I know I had gotten an email from them in the last week or so saying the Beta period I had participated in during the last year was ending towards the end of this month (I think) and then if I wanted to continue their service I would need to pay (they don’t have any credit card info).

So what do you think?

system · 2017-11-07T19:26:58.000Z

Here’s the copy of the email from Blasty - received it yesterday…

Hi Gina,

Blasty is now out of Beta.

For this occasion, we launched a new version of the product with new features:
- Each Blast now triggers a DMCA takedown notice to Google, Bing, Yahoo AND the site hosting the infringement ;
- Blasty Full Power users can now override the algorithm’s rating ;
- The scanning speed has been significantly improved.
NB: expect continuous improvements.

As a former Beta-tester, you’ll be able to enjoy Blasty Basic for free until November 21st 2017.

Please keep sharing your feedback with us, good or bad. We’re taking every comment into consideration.

Happy Blasting,

photo
Olivier Zetlers - CEO & cofounder
Blasty, 41E 11th Street New York, NY 10011

SassDrake · 2017-11-07T19:38:15.000Z

Go to Chrome menu and go to Clear browsing data or use keyboard shortcut Ctrl + Shift + Delete.
In drop down menu select From the beggining of time and select only Cached images and files and Hosted app data. See attached screenshot.
Please report if problem was solved.

system · 2017-11-07T19:52:04.000Z

Just did what you told me to… now I wait to see if it works. I will say that during the last hour and half I’ve been online I have not had the Avast threat popup issue… which is amazing and nice. So, we’ll see if the additional thing you just suggested also helps the situation out. I am good about deleting stuff out of the Chrome “Clear browsing data” from beginning of time thing… EXCEPT I DON’T ever select the “Hosted app data”, though!! So, that at least is something “new” I just did

system · 2017-11-07T20:43:11.000Z

Well, that did NOT work. The Avast threat popup still pops up… I even performed the last step you suggested once again when it popped up 20 min ago. And just about 1 min ago it popped up again. ARGH! OK… so I wonder if I should go back to your step about disabling those few extensions & apps I mentioned and see if it’s any of them giving a false positive or something?? (chrome://extensions are: Avast Online Security, Google Docs and Google Offline Docs. At chrome://apps, I show Asana, Google Calendar, Google Web Store, Google Docs, Google Drive.)

SassDrake · 2017-11-07T21:11:19.000Z

Give it a try. :-\

system · 2017-11-07T23:45:18.000Z

I went through one by one disabling what few extensions I have enabled anymore… Google Docs Offline - nope still had popup; Google Docs -nope still popup; didn’t disable the Avast Online Security extension because (duh!) that better not be setting off its own threat!! That was all the extensions I had enabled. So then I went to the chrome apps – I removed Asana - nope still had popup. And I did NOT remove the Google Calendar, Google Web Store, Google Docs or Google Drive that appear on my chrome://apps page because it doesn’t make sense those would be setting off the Avast popup… right?! If you think I should remove them from chrome://apps, then I will try… Anyway, within seconds of opening Chrome a bit ago, that’s when the latest Avast popup occurred. Driving me bonkers every 20 minutes or so popping up… that’s fairly common, although there were times this afternoon it went 1 1/2 hours with no popups.

I’m lost. Do you think I should/could put into the Avast EXCLUSIONS area to NOT mark whatever this problem is as a threat & do a popup? Like if I copy/pasted in that long clients2.googleusercontent.com…blah…blah URL that it would stop doing this?

SassDrake · 2017-11-08T00:05:44.000Z

I don’t recommend to add it to exclusion just because of Avast popup. Now try with complete Chrome reinstall.
Follow this article: https://support.google.com/chrome/answer/95319?co=GENIE.Platform%3DDesktop&hl=en
Make sure you backup your bookmarks and other stuff before that make sure you check “Also delete your browsing data.” during unistall.

system · 2017-11-08T20:39:41.000Z

Well, I decided I didn’t want to mess with uninstalling Chrome and dealing with possible (new) problems there… concerns about my hundreds of bookmarks - which I DO export to an HTML file and save to my computer (and further backup my computer in several ways) but STILL concerned about dealing with the possible headache of new issues, and wondering about the whole Google/Chrome profile thing with uninstalling Chrome and what all I might have to re-setup or restore or re-create. I wasn’t totally understanding if I completely uninstalled Chrome, how much “stuff” I’d have to setup again… anyways… after a couple weeks with this Avast threat popup ordeal and about 3 days of actually trying to solve it, I give up with Avast (or AVG – as this thing originally began when I had AVG installed. Then I uninstalled it 3 days ago, installed Avast hoping it would resolve the issue, but it didn’t. I KNOW that Avast bought out AVG, so that was kinda stupid on my part switching out one for the other as they are almost the same now). So, last night I uninstalled Avast and installed Bitdefender. All works fine now - no annoying popup (which had to be some kind of false positive issue). So, NO NEED to try to suggest any additional fixes at this point… I am NOT spending anymore time on this. I do want to thank the ones who tried to help. I appreciate your efforts and your time. Too bad it just didn’t fix it.

I’m outta here now. 8)

Announcements