Chrome_Elf dll is missing, infection?

[horse_3]

Hello, I am seeking help with a question/problem. I was browsing the internet and noticed that my chrome was working slower than usual, so I decided to close it and start it up again. While restarting chrome I got an error that said something about Chrome_Elf dll missing, however chrome still restarted itself. I ran Malwarebytes to check for infection and noticed that on the first scan it scanned for less objectives than usual and was much faster with the scan. I restarted my computer and this time the scan took longer than usual and there was less objectives scanned.

I have included FRST.txt, Addition.txt and the latest scan with Malwarebytes. I have also ran adwcleaner with clean results.

Addition.txt

FRST.txt

MBAM_scan.txt

[AdvancedSetup]

Hello @horse_3 and

Let me have you run the following. Make sure you fully disable your antivirus to run this scanner.

 

Please visit this web page and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

 

Thanks

Ron

 

[horse_3]

I realised I didnt do a thing from the guide, so I will post the text file soon

Edited December 5, 2017 by horse_3

[horse_3]

Ok, so here is the combofix file with careful following of the guide. The first time I ran it I didn't close all windows (chromes,skype). If needed I have also included the first combofix log (It is named combofix_firstScan). 

ComboFix.txt

ComboFix_firstScan.txt

[AdvancedSetup]

Okay, that looks pretty good overall.

You can navigate to this path and check if chrome_elf.dll is listed:

C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94

If you restart the computer again and launch Chrome do you still get this error message?

Ron

 

Edited December 6, 2017 by AdvancedSetup

[horse_3]

There is no error message, however the chrome_elf.dll is still listed. Here is some FRST logs just in case.

FRST.txt

Addition.txt

[AdvancedSetup]

Can you show me a screen shot of what you're seeing?

 

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

 

Thanks

Ron

 

[horse_3]

Here is the fixlog and the screenshot. Before doing the fix and the screenshot I had reinstalled chrome the and dll file was still there but the modification date was different than before. Prior to the reinstall it was 5th of December, and now it is as seen on the screenshot.

Fixlog.txt

[AdvancedSetup]

Are you still getting an error when Chrome launches?

 

[horse_3]

No, there is no error at the moment.

[AdvancedSetup]

Great, hopefully I think we've resolved it. I'll go ahead and close your topic, but if you find that there is still any issues please let us know.

Take care and stay safe out there

Ron

 

[horse_3]

Ok, I must thank you again for the swift responses and help!

[AdvancedSetup]

You're quite welcome @horse_3

Have a great week.

Ron

 

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!