Chrome Addons Quarintine

[Jnk1296]

I have never been warned about these detections before yesterday, but last night i received a scan result for 677 instances of PUP.Optional.HijackModifiedExtension. Results spanned across six different Chrome extensions, including AdBlock Plus and Chrome User-Agent Spoofer, and moving the findings into quarantine deleted the extensions outright. These were also detected by Malware Database v2015.11.06.01, but I've declined to move them to quarantine at this time.

 

 

results.txt

[miekiemoes]

Hi,

 

We will look into this and remove detection where needed.

Thanks for reporting!

[miekiemoes]

Hi,

 

Please dequarantine the files and zip and attach the following files for me please:

 

C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\manifest.json
C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\manifest.json
C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.0_0\manifest.json
C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.9.1_0\manifest.json
C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\djflhoibgkdhkhhcedjiklpkjnoahfmg\1.0.43_0\manifest.json
C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\manifest.json

 

Thanks!

[miekiemoes]

I actually don't think these are false positives after all though - I rather have this feeling that these extensions have been "Hijacked/Injected" with additional code that shouldn't belong there.... That's why I need these files.

I am pretty sure that, if you have Mbam quarantine these again and you reinstall these extensions, that Mbam won't flag these anymore.

[Jnk1296]

Here are the files you requested.

manifests.zip

[miekiemoes]

Hi,

 

This is no False positive. As I suspected, these extensions have been hijacked where malicious code was appended to set the update_url for these extensions to "mynamedomain.koko"

So I suggest to have malwarebytes remove these extensions anyway and reinstall the extensions afterwards.

[Jnk1296]

Ah, lovely. I noticed that "mynamedomain.koko" as well, but somehow didn't make the connection. Thanks.