Chrome.exe

[dugrn]

Over the last few days when I’m running google chrome and I turn the volume up or down on my pc a large “chrome.exe” appears next to the typical vertical  windows volume graphic. It only appears when I’m playing sound via chrome.  I decided to see if I can turn it off. While doing some research I discovered that this is possibly a virus.  One on the things the article said to look for was the amount of google chrome processes that are running in task manager. In task manager it says 13 separate chrome processes. The only window open was YouTube on one test and Hulu on the other. I’ve scanned with both Malwarebytes and defender. They turn up nothing.

 

suggestions?

[dugrn]

I decided to run an offline scan . The first time it started to run it quit on its own before it even started to scan. The second time it started like normal but gave me this screen which I’ve never seen before.

[Maurice Naggar]

Hi dugrn,

My name is Maurice. I will be helping and guiding you, going forward on this case.

That last screen grab is Windows Defender.  Does your pc run on Windows 10 ?

Tell me also,had the Windows Defender scan finished?  and if so, did you notice the results ?

.

First suggestion:

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

also, if you use Chrome or Firefox browser, install the Malwarebytes beta browser extension.  There is one for Chrome & another for Firefox.

To get & install the Malwarebytes beta Chrome extension,

Open this link in your Chrome browser: https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup.

 

To get & install the Malwarebytes beta Firefox extension.

Open this link in your Firefox browser: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

.

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

[dugrn]

Hi Maurice

 

To answer your first question, I am running Win 10-Pro with bitlocker.  The defender offline scan did not finish.  I have tried a couple of more times over the weekend and it would not even run.  This mornig I decided to do a bit of research and I performed the following:

I did all the steps on this post: https://www.howto-connect.com/windows-defender-not-working/

When I got to "System File Checker Scan: I got the following after the scan

I then proceeded to check if defender had been turned off.  I opened RegEdit. in HKEY LOCAL MACHINE I opened Windows defender.  On the right panel there was there was no DWORD so I rightclicked and created one callin ot DisableAntiSpyware and gave it a value of "0"

 

Once I did this I was able to run Defender offline scan but it again did not finish.  Over the weekend I did run ESET Poweliks cleaner. The poweliks trojan seems to be related to the chrome.exe process I was having.  The scan was negative.

I have uploaded the logs file from the support tool as well

 

mbst-grab-results.zip

[Maurice Naggar]

Remarks:  Please do not do fixes on your own while this case is open / on-going.

I can help should the Windows Defender be disabled.

By the way, back to something you mentioned at the start { " In task manager it says 13 separate chrome processes " ).

There would be basically one line in Task Manager for each tab of Chrome that was open.

.

I notice Malwarebytes Browser Extension is on Chrome.  That is good to know.  It will help the Chrome browser.

There is no poweliks here.  I have yet to see signs of virus or infection.  Please do try to not self-diagnose or self medicate the PC.

.

[ 1 ]

I have listed below, as a start, a cleanup custom fix.  One of the things it will do is to set Windows Defender to standard Windows 10 defaults.

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRSTENGLISH tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) in the Downloads folder 

The tool named FRSTENGLISH.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRSTENGLISH

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Kindly attach the Fixlog.txt with your next reply. 

 

[ 2 ]  Next

I would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner.

 

Please download the  Malwarebytes AdwCleaner from here:
Click the blue Download button.   ( do not pay attention to the other text displayed on that screen).

Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

 

Go to the folder where you saved Adwcleaner. Double click AdwcleanerGUI  to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Then click on Dashboard button.

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.   Let it remove what it finds.

NOTE:  When it comes to the section "

Pre-installed applications

You can skip that.

Please find and send the Adwcleaner "C" clean report.

In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".

Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply.

 

We will do more later.  Thanks for your continued patienc.

fixlist.txt

[dugrn]

Hi Maurice

 

when i open FRSTEnglish i get a yellow user control window that says "do you want to allow this app from an unknown publisher to make changes to you device?  FRSTEnglish.exe

Publisher: Unknown

File origin: Hard drive on this computer

 

Is it okay for me to click "yes"

 

 

[Maurice Naggar]

YES click Yes

The message you see & is a common security prompt from Windows.

The FRST is a safe & widely used tool.   We would not ask you to run something "dodgy".

Please go forward, as outlined.

Thanks.

 

[dugrn]

OK I will run soon.  BTW

 

I keep having to change my password to access malwarebytes forums.  After each passowrd reset the forum will not accept my passord on the next login.  This applies to my laptop and iphone

 

[Maurice Naggar]

On the latter, please send a personal message to Advancedsetup .

[dugrn]

Hi Maurice

 

I have completed the 2 steps you requested.  FRSTEnglish and AdwCleaner.  Logs attached

AdwCleaner log report.txt Fixlog.txt

[Maurice Naggar]

Hi,

Thanks for the reports.  Adwcleaner found no adware ; no P U P.  That is good.

The Fix run was good; just as desired.  You should see now that Windows Defender can be run on demand.

How is the situation as regards Chrome & the original issue ?

[dugrn]

Widows defender still not running

When I run Chrome with just a blank page I'm getting 11 Google Chrome process.  I decided to run Edge for this replay at the same time and it has 9 processes.

I did notice the "Tamper Protection" inside the "virus % threat protection settings" was switched to off after the last steps we completed.  I turned it back on

[Maurice Naggar]

To this point, there is yet to be a known security program to find & report a infection.

Open Malwarebytes

Click the Settings menu followed by the Protection tab.

Scroll down to Scan Options and turn the Scan for rootkits setting on.

 

Next, click the icon button at left marked SCAN.   Run a threat scan with Malwarebytes.  Let me know what it reports.

[dugrn]

Here is the log for scan with rootkits

MWBlog.txt

[Maurice Naggar]

Thanks for the Malwarebytes scan report.  This reports no malware  & no P U P.  

You can check this system using another free tool at Microsoft.  For another opinion.

The Microsoft Safety Scanner is a free stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

take a minute to locate & then send the log that it made, named msert.log

It should be at C:\Windows\debug\msert.log

Sincerely.

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks