wscript.exe infected?

essexboy · January 19, 2015, 4:07pm

Yes please as it has reverted to developer mode… Are you synching chrome

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: CHR Profile: C:\Users\Cory\AppData\Local\Google\Chrome EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

system · January 19, 2015, 5:08pm

Yes, I do have sync enabled on chrome.

Requested logfiles are attached.

essexboy · January 19, 2015, 5:48pm

OK you will need to disable Chrome synching first, then uninstall chrome
Reboot and post a fresh FRST log where I will look for remnants
Then we should be able to re-install

The problem is that at the moment you have the developer version which has no security checks so anything can be added to Chrome without your authorisation

system · January 19, 2015, 6:03pm

Chrome sync has been disabled, and chrome uninstalled.

New log files attached.

essexboy · January 19, 2015, 6:21pm

After the reboot from this could you re-install Chrome and ensure that there are no alerts

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-2661723367-4171544803-1169632980-1000\...\Run: [Google Update] => C:\Users\Cory\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-08-25] (Google Inc.) HKU\S-1-5-21-2661723367-4171544803-1169632980-1000\...\Run: [Google+ Auto Backup] => C:\Users\Cory\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3746120 2014-08-12] (Google Inc.) HKU\S-1-5-21-2661723367-4171544803-1169632980-1000\...\Run: [googletalk] => C:\Users\Cory\AppData\Roaming\Google\Google Talk\googletalk.exe [3739648 2007-01-01] (Google) CHR HomePage: Default -> hxxp://www.google.com CHR StartupUrls: Default -> "hxxp://www.google.com" CHR Profile: C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Entanglement Web App) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2014-08-20] CHR Extension: (Angry Birds) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2014-08-20] CHR Extension: (Make a GIF) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\anhnbgabclnjfceopaladlmpfpgnpdjf [2014-08-20] CHR Extension: (Google Docs) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-20] CHR Extension: (Google Drive) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-20] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-15] CHR Extension: (YouTube) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-20] CHR Extension: (AddThis - Share & Bookmark (new)) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbogdmdefihhljhfeiklfiedefalcde [2014-10-13] CHR Extension: (Google Search) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-20] CHR Extension: (Chrome Remote Desktop) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2014-08-20] CHR Extension: (Bookmark Manager) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2014-11-04] CHR Extension: (Avast Online Security) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-10-18] CHR Extension: (IE Tab) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2014-09-03] CHR Extension: (BB10 / PlayBook App Manager) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmbaalodpmjjhpobkgljnelbpblnikkp [2014-08-20] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-01-19] CHR Extension: (Poppit!) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2014-08-20] CHR Extension: (Google Wallet) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-20] CHR Extension: (App Launcher) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\odmpalfplhaahlgnkkonchfhpegdcgjm [2014-08-20] CHR Extension: (video2mp3) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\oljlcbniifdjapjocdfamhlnmpkojdkm [2014-10-12] CHR Extension: (Gmail) - C:\Users\Cory\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-20] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-23] 2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 __SHD () C:\Users\Maya\AppData\Local\EmieUserList 2015-01-15 18:13 - 2015-01-15 18:13 - 00000000 __SHD () C:\Users\Maya\AppData\Local\EmieSiteList 2015-01-14 22:03 - 2015-01-15 08:57 - 00000000 __SHD () C:\Users\Deborah\AppData\Local\EmieUserList 2015-01-14 22:03 - 2015-01-15 08:57 - 00000000 __SHD () C:\Users\Deborah\AppData\Local\EmieSiteList 2015-01-19 11:44 - 2014-08-20 19:23 - 00000000 ____D () C:\Program Files (x86)\Google CustomCLSID: HKU\S-1-5-21-2661723367-4171544803-1169632980-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Cory\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.) CustomCLSID: HKU\S-1-5-21-2661723367-4171544803-1169632980-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Cory\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.) Task: {188FADCC-1423-4816-9AD1-6FEFBECF8D1D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2661723367-4171544803-1169632980-1000Core => C:\Users\Cory\AppData\Local\Google\Update\GoogleUpdate.exe [2014-08-25] (Google Inc.) Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2661723367-4171544803-1169632980-1000Core.job => C:\Users\Cory\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2661723367-4171544803-1169632980-1000UA.job => C:\Users\Cory\AppData\Local\Google\Update\GoogleUpdate.exe C:\Users\Cory\AppData\Local\Google EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · January 19, 2015, 6:44pm

Updated log attached.

I installed the regular release version of chrome.

system · January 19, 2015, 6:47pm

After I re-installed chrome, the “threat has been detected” alert popped up again

essexboy · January 19, 2015, 6:51pm

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: Startup: C:\Users\Cory\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowsshell.vbs () EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · January 19, 2015, 6:59pm

Ran FRST. Log attached.

essexboy · January 19, 2015, 7:39pm

Has it re-appeared after the boot ?

system · January 19, 2015, 7:42pm

No… do you think it is gone? do you know what was the culprit?

essexboy · January 19, 2015, 8:01pm

It appears to have been downloaded from your chrome synch and I missed it the second time it did that

system · January 19, 2015, 8:02pm

Ok thank you. I will be more vigilant about installing chrome extensions going forward.

essexboy · January 19, 2015, 8:14pm

Run delfix again to remove the tools

system · January 19, 2015, 10:01pm

Unfortunately,after a few hours the alert has returned.

essexboy · January 19, 2015, 10:17pm

Do you have an external drive or a USB that you are plugging in ?

system · January 19, 2015, 11:12pm

There are external drives permanently connected to the computer, but none were added between the time I ran the last scan and/or fix and the time the alert re-appeared.

system · January 20, 2015, 11:24am

I think the problem might have been that I didn’t completely remove chrome from each user profile. I uninstalled chrome again, then manually deleted each C:\Users[USERNAME]\AppData\Local\Google\Chrome\User Data folder.

Then I re-installed chrome from scratch. Took me a while to manually add back each of the family member’s bookmarks, but so far no more alerts.

Let me know if there is any other scan you would like to see to confirm my pc is now clean.

Thanks.

essexboy · January 20, 2015, 3:28pm

You can run a fresh FRST if you wish

system · January 20, 2015, 4:21pm

Latest FRST logs attached.

Thanks again!

wscript.exe infected?

Announcements