MB found backdoor.bot on new Chrome tabs, but none found

[NoSorcery]

I should begin by saying I'm paranoid about security, going so far as to use a separate user account in Win 7 from the administrator account, keeping everything up to date, occasionally going through and just poking around the system to see if anything's amiss, etc.  I'd like to think I know what I'm doing when it comes to being cautious about malware, so this one was pretty sneaky.

 

I started getting backdoor.bot warnings in the MB dialog box, so I started looking into this.  I ran both MBAM and MBAR and they both come up clean.  Avast never warned me of anything.  So I rebooted, and there were no more MB warnings.

 

However, I then found out that there was a program running called SearchIndexer.exe, but instead of saying "Windows search provider" or whatever, it was showing up with a description of "klkjzvjkawetoinkbf" (not that, but something similar, with all random letters).  So then I ran AdwCleaner and it found an extension in Chrome with that same name, plus a registry key that may have also been related, and let it remove those.

 

I still have Windows Update access, Windows Firewall was still on, and I never lost internet access.  But I decided to install ZoneAlarm because it alerts you to PUP trying to get outbound, and WF doesn't.

 

So I have a few questions...

 

1) I don't remember allowing this extension to be installed.  Is there some way it might have installed itself without my approval?

 

i2) If #1 is "yes", Is there something else besides MBAM resident that I an install to prevent this from infecting me in the first place?

 

3) What else should I run to ensure I'm infection-free?

 

Thanks in advance.

[TwinHeadedEagle]

Hello,

 
 

1) Yes, it can.

2) It is not always possible.

3) Run the scan below

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[NoSorcery]

 

 

• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

 

Done.

 

FRST.txt

Addition.txt

[TwinHeadedEagle]

Your PC seems clean. This is already reported as false detection and it is fixed. You need to update MalwareBytes before scanning and this detection will vanish.

[NoSorcery]

Phew, I was worried there for a minute.  I wonder what that crazy extension was though.  Alright, thanks for the help.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!