Jump to content
Sign in to follow this  
Metallica

Removal instructions for Remote Javascript staging

Recommended Posts

What is Remote Javascript staging?

The Malwarebytes research team has determined that Remote Javascript staging is a browser hijacker. These so-called "hijackers" alter your startpage or searchscopes so that the effected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by Remote Javascript staging?

This is how the start- and search-page looks:

main.png

And you may see this toolbar:

warning2.png

and this entry in your list of installed programs:

warning3.png

or this warning:

warning1.png

How did Remote Javascript staging get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Remote Javascript staging?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-consumer.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Remote Javascript staging?
  • No, Malwarebytes' Anti-Malware removes Remote Javascript staging completely.
Look at the replies to this topic for the additional guides.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Remote Javascript staging rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

protection1.png

Technical details for experts

Signs in a HijackThis log:

O2 - BHO: CrossriderApp0014813 - {11111111-1111-1111-1111-110111481113} - C:\Program Files\Remote Javascript staging\Remote Javascript staging-bho.dll
Alterations made by the installer:

File system details  ---------------------------------------------    Adds the folder C:\Program Files\Remote Javascript staging       Adds the file background.html"="2/25/2014 2:36 PM, 729 bytes, A       Adds the file Installer.log"="4/26/2014 7:23 PM, 112243 bytes, A       Adds the file Remote Javascript staging.ico"="2/25/2014 2:36 PM, 15086 bytes, A       Adds the file Remote Javascript staging-bg.exe"="4/26/2014 7:23 PM, 806400 bytes, A       Adds the file Remote Javascript staging-bho.dll"="4/26/2014 7:23 PM, 682496 bytes, A       Adds the file Remote Javascript staging-buttonutil.dll"="4/26/2014 7:23 PM, 425984 bytes, A       Adds the file Remote Javascript staging-buttonutil.exe"="4/26/2014 7:23 PM, 344064 bytes, A       Adds the file Remote Javascript staging-codedownloader.exe"="4/26/2014 7:23 PM, 566272 bytes, A       Adds the file Remote Javascript staging-enabler.exe"="4/26/2014 7:23 PM, 411136 bytes, A       Adds the file Remote Javascript staging-helper.exe"="4/26/2014 7:23 PM, 340992 bytes, A       Adds the file Uninstall.exe"="4/26/2014 7:23 PM, 676952 bytes, A    Adds the folder C:\Users\{username}\AppData\LocalLow\Remote Javascript stagingRegistry details  ------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}]       "(Default)"="REG_SZ", "Remote Javascript staging"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\Implemented Categories]       "(Default)"="REG_SZ", ""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]       "(Default)"="REG_SZ", ""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\InprocServer32]       "(Default)"="REG_SZ", "C:\Program Files\Remote Javascript staging\Remote Javascript staging-bho.dll"       "ThreadingModel"="REG_SZ", "Apartment"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\ProgID]       "(Default)"="REG_SZ", "CrossriderApp0014813.BHO.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\TypeLib]       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144484413}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111481113}\VersionIndependentProgID]       "(Default)"="REG_SZ", "CrossriderApp0014813"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122482213}]       "(Default)"="REG_SZ", "CrossriderApp0014813.Sandbox"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122482213}\InprocServer32]       "(Default)"="REG_SZ", "C:\Program Files\Remote Javascript staging\Remote Javascript staging-bho.dll"       "ThreadingModel"="REG_SZ", "Apartment"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122482213}\ProgID]       "(Default)"="REG_SZ", "CrossriderApp0014813.Sandbox.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122482213}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122482213}\TypeLib]       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144484413}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122482213}\VersionIndependentProgID]       "(Default)"="REG_SZ", "CrossriderApp0014813.Sandbox"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.BHO]       "(Default)"="REG_SZ", "CrossriderApp0014813"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.BHO\CLSID]       "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111481113}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.BHO\CurVer]       "(Default)"="REG_SZ", "CrossriderApp0014813"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.BHO.1]       "(Default)"="REG_SZ", "CrossriderApp0014813"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.BHO.1\CLSID]       "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111481113}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.Sandbox]       "(Default)"="REG_SZ", "CrossriderApp0014813.Sandbox"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.Sandbox\CLSID]       "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122482213}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.Sandbox\CurVer]       "(Default)"="REG_SZ", "CrossriderApp0014813.Sandbox"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.Sandbox.1]       "(Default)"="REG_SZ", "CrossriderApp0014813.Sandbox"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0014813.Sandbox.1\CLSID]       "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122482213}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155485513}]       "(Default)"="REG_SZ", "ICrossriderBHO"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155485513}\ProxyStubClsid]       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155485513}\ProxyStubClsid32]       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155485513}\TypeLib]       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144484413}"       "Version"="REG_SZ", "1.0"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166486613}]       "(Default)"="REG_SZ", "ISandBox"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166486613}\ProxyStubClsid]       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166486613}\ProxyStubClsid32]       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166486613}\TypeLib]       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144484413}"       "Version"="REG_SZ", "1.0"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144484413}\1.0]       "(Default)"="REG_SZ", "CrossriderApp0014813 Type Library"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144484413}\1.0\0\win32]       "(Default)"="REG_SZ", "C:\Program Files\Remote Javascript staging\Remote Javascript staging-bho.dll"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144484413}\1.0\FLAGS]       "(Default)"="REG_SZ", "0"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144484413}\1.0\HELPDIR]       "(Default)"="REG_SZ", "C:\Program Files\Remote Javascript staging"    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110111481113}]       "(Default)"="REG_SZ", "CrossriderApp0014813"       "NoExplorer"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Remote Javascript staging]       "CrAppId"="REG_SZ", "14813"       "CrPublisherId"="REG_SZ", "4693"       "DisplayIcon"="REG_SZ", "C:\Program Files\Remote Javascript staging\Uninstall.exe"       "DisplayName"="REG_SZ", "Remote Javascript staging"       "DisplayVersion"="REG_SZ", "1.34.2.13"       "Publisher"="REG_SZ", "Zoli"       "UninstallString"="REG_SZ", "C:\Program Files\Remote Javascript staging\Uninstall.exe /fromcontrolpanel=1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Remote Javascript staging\IE]       "TotalProfiles"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Remote Javascript staging\IE\Profiles]       "S-1-5-21-4016700205-1717049133-1125222536-1001"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Remote Javascript staging\Installer]       "BundledIe"="REG_DWORD", 1    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider]       "Bic"="REG_SZ", "C41C6E0191BB4C999AAC093529B936EAIE"       "Verifier"="REG_SZ", "6ed315ef655b8ddd39f2352e7beaeab1"    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onBeforeNavigate]       "14813"="REG_SZ", ""    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onRequest]       "14813"="REG_SZ", ""    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Remote Javascript staging]       "ActiveAppId"="REG_SZ", "14813"       "BhoRunningVersion"="REG_SZ", "153"       "IsBhoEnabled"="REG_DWORD", 1       "LastSetSearch"="REG_DWORD", 1398533103    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Remote Javascript staging\background]       "__onDocumentStart_script__"="REG_SZ", ""       "__onDocumentStart_script_store__"="REG_SZ", ""       "IsEnabled"="REG_DWORD", 1    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Remote Javascript staging\Code]       "AppJavaScript"="REG_SZ", " { javascript removed, full log available on request }"    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Approved Extensions]       "{11111111-1111-1111-1111-110111481113}"="REG_BINARY, ............
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 4/26/2014Scan Time: 7:33:16 PMLogfile: mbamRemoteJavascript.txtAdministrator: YesVersion: 2.00.1.1004Malware Database: v2014.04.26.03Rootkit Database: v2014.03.27.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledChameleon: DisabledOS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: MalwarebytesScan Type: Threat ScanResult: CompletedObjects Scanned: 213707Time Elapsed: 3 min, 11 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledShuriken: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 18PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111481113}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440144484413}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550155485513}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660166486613}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0014813.BHO.1, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110111481113}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0014813.BHO, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110111481113}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110111481113}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220122482213}, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0014813.Sandbox.1, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0014813.Sandbox, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111481113}\INPROCSERVER32, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Remote Javascript staging, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, HKLM\SOFTWARE\Remote Javascript staging, Quarantined, [ac3f97975a2188ae51d5314027dbae52], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [30bbf5397dfea98d180e5060ab5815eb], PUP.Optional.RemoteJavascriptStaging.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Remote Javascript staging, Quarantined, [5e8df13d2c4f75c135efd59c0ef49c64], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Zoli, Quarantined, [4ba018164a31e84e15fe94dd6d959967], Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 1PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], Files: 12PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-bho.dll, Quarantined, [82693fef87f46bcb8015e48cbd4415eb], PUP.Optional.RemoteJavascriptStaging.A, C:\Users\{username}\Desktop\Remote Javascript staging(crosreider).exe, Quarantined, [7b706fbfed8e46f01a7ba1cfad54c937], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\background.html, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Installer.log, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-bg.exe, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-buttonutil.dll, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-buttonutil.exe, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-codedownloader.exe, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-enabler.exe, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging-helper.exe, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Remote Javascript staging.ico, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], PUP.Optional.RemoteJavascriptStaging.A, C:\Program Files\Remote Javascript staging\Uninstall.exe, Quarantined, [44a7af7f384386b0dc46fe733cc6f60a], Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.

Share this post


Link to post
Share on other sites
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.