Malware from Chrome Extension Suspected - Long Custom Scan

[mikerf]

I'm running the latest versions of Windows 10 & Malwarebytes for Windows.

My system appears to be infected with malware which I suspect came from a Google Chrome extension. Yesterday my PC started running very slowly and I noticed I received numerous Google Chrome notifications in the Windows message center (refer to the images below). After unsuccessfully performing a "Clean up computer" from the Advanced settings in Chrome, I performed a clean install of Chrome (uninstalling the previous installation & deleting the Chrome folder in Windows). I have not logged back into my account from within Chrome so extensions haven't been reinstalled.

After reinstalling Chrome, I started a Custom Scan of my entire hard drive. The scan has been running for over 21 hours. It is still running. Over 680,000 items have been scanned and there has only been one (1) detection thus far:  PUP.Optional.Ask. The offending file is: c:\users\mike\desktop\mike\appdata\local\temp\apnic.dll.

I've let the scan run this long so I'm hesitant to stop it; however, I need to be able to regain the use of the infected computer as soon as possible. Is there any way for me to know how close the scan is to being done? Should I allow the custom scan to complete or is there a better course of action for me to take at this point? What are the steps I should take to resolve this and be certain my computer is no longer compromised?

Thank you.

[kevinf80]

Hello mikerf and welcome to Malwarebytes, Disable smart screen ONLY if it interferes with software we may have to use: https://support.microsoft.com/en-us/microsoft-edge/what-is-smartscreen-and-how-can-it-help-protect-me-1c9a874a-6826-be5e-45b1-67fa445a74c8 Please remember to enable when we are finished.... Next, Disable any Anti-virus software you have installed ONLY if it stops software we may use from working: https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/ Please remember to enable AV software when we are finished running scans.... Next, Lets grab some logs and see whats going on, continue with the following: Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab. Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following:   Open Malwarebytes Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans"   Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... Thank you, Kevin....

[mikerf]

Hi Kevin,

Attached are the log files you requested.

I've included the log from the Custom Scan I was running. After cancelling the Custom Scan I quarntined the PUP. I then followed your procedure.

Thank you,
Mike

Custom Scan.txt Threat Scan.txt AdwCleaner[S00].txt AdwCleaner[C00].txt FRST.txt Addition.txt

[kevinf80]

Hiya mikerf,

Thanks for thos logs, continue:

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from. NOTE. It's important that both files, FRST or FRSTEnglish, and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The following directories are emptied:   Windows Temp Users Temp folders Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Flash Player cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. Next, Download Sophos Free Virus Removal Tool and save it to your desktop. If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete..... Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...   Double click the icon and select Run Click Next Select I accept the terms in this license agreement, then click Next twice Click Install Click Finish to launch the program Once the virus database has been updated click Start Scanning If any threats are found click Details, then View log file... (bottom left hand corner) Copy and paste the results in your reply Close the Notepad document, close the Threat Details screen, then click Start cleanup Click Exit to close the program If no threats were found please confirm that result.... The Virus Removal Tool scans the following areas of your computer: Memory, including system memory on 32-bit (x86) versions of Windows The Windows registry All local hard drives, fixed and removable Mapped network drives are not scanned. Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan. Saved logs are found here: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs Let me see those logs in your reply... Thank you, Kevin.

fixlist.txt

[mikerf]

Hi Kevin,

I've ran FRST with fixlist.txt and it appeared to complete successfully. After restarting my system I installed and then began running Sophos earlier this morning. I know your notes say the scan is very thorough and takes hours. However, Sophos has been running for at least 6 hours and the progress bar hasn't budged (see below). Is that normal behavior? You'll recall I had to prematurely stop a Malwarebytes Custom Scan after over 725,000 items were scanned.  The item being scanned ("Scanning item") by Sophos appears to update on average 2-3 times per second. If that's accurate & there are over 725,000 to scan then the scan would take over 80 hours. Certainly that can't be the case, can it? Or, is there something else I should do  right now instead of waiting for the scan to complete?

I'd send you the log file generated after running FRST with fixlist.txt; however, it's only on the PC that's being scanned and I don't want to run anything on that PC while the scan is being performed, as your notes suggested.

Thank you,
Mike

[kevinf80]

I`ve never known Sophos scan to take 80 hours, I suppose it really depends on the amount of data that has to be scanned. I see from your logs you have two drives, each with approximately 1500GB of data used... Hard to say how long that scan will take...

If you want you could stop Sophos and run a quick scan with a different scanner, that will be much quicker and will only scan critical areas. If it finds anything we could then revert to a full scan to double check your system... Let me know if that is what you want to do...

[mikerf]

Kevin,

Note: I accidentally clicked 'mark as solution.'

I'd rather play it safe than sorry. Does the Sophos progress bar work properly? That is, is it normal for the green progress indicator to stay pegged to the left side?

-Mike

[kevinf80]

Hiya Mike,

Yes the Sophos progress bar does work correctly as far as I`m aware, like I said before scan time really depends on the amount of data to be scanned...

Thank you,

Kevin...

[mikerf]

Hi Kevin,

So the progress bar still hasn't budged. I'd like to do the alternate scan. I can come back and do the more thorough Sophos scan toward the end of the week, if necessary. What's the other scan you'd like me to try? (Note: The Malwarebytes Threat Scan I performed after quarantining the PUP came-up clean.)

Thanks,
Mike

[kevinf80]

Hiya Mike,

Download "Microsoft's Safety Scanner" and save direct to the desktop Ensure to get the correct version for your system.... https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Right click on the Tool, select Run as Administrator the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\msert.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time....   If the quick scan does find anything, you can follow up with a Full scan, again scan time will be lengthy...   Thank you,   Kevin.

[mikerf]

Hi Kevin,

I'm performing the quick scan using Microsoft Safety Scanner now. Attached is the log file that was generated from performing the fix using FRST.

- Mike

Fixlog.txt

[mikerf]

Hi Kevin,

The quick scan completed without error. See attached msert.log as well as the Fixlog.txt attached to my previous post. What would you suggest I do next?

Thanks,
Mike

msert.log

[kevinf80]

Hiya Mike,

How do you feel your system is responding now, any issues or concerns..? I see no reason to go for a full scan unless you suspect there are still issues.

Thanks,

Kevin.

[mikerf]

Hi Kevin,

It appears as though the issue has been resolved; however, I'm not quite comfortable saying that yet. I decided to kick-off a Full Scan using Microsoft Safety Scanner. I'm going to let it run overnight and see how far it gets. As long as there aren't any infected files detected when I check on it in the morning, I'll start using the computer again and see how see how it performs over the next day or two. I'll repost here soon; hopefully, to mark this case solved.

I really appreciate all of your assistance.

Thanks again,
Mike

[mikerf]

I Kevin,

I just checked on the Full Scan from Microsoft Safety Scanner. 47 minutes in it says it has scanned over 1.8M files & it has detected 2 infected files. I'm now planning to let it run to completion unless you'd like me to proceed otherwise?

Thanks,
Mike

[kevinf80]

Hiya Mike,

Thanks fot the update, yes please let the full scan run to completion..

Thank you,

Kevin.

[mikerf]

Hi Kevin,

Late last night the Microsoft Safety Scanner was indicating over 30 Files detected yet I awoke this morning to:

Attached is the msert.log.

Why would the dialog say files were detected yet the results of the scan say all is good?

Nonetheless, my system is performing well this morning and it's looking more likely that, with your help, the matter has been resolved. As I said, I'll post back to this thread in a day or two and let you know how it's going.

Let me know if there's anything else you'd recommend I do, corrective or preventative.

Thank you again,
Mike

msert.log

[kevinf80]

Hiya Mike,

To truly answer your question, you need to understand how the Microsoft security apps actually operate, since that's part of why this sort of situation can be confusing to those who don't.
The "Files Infected" count displayed on the Microsoft Safety Scanner, scan in progress screen or any of their other security products for that matter, is actually just a preliminary status indication that there are items which may contain malware. In many cases these specific items have been found in the past to be related to malware, but they are all really just small fragments that have matched signatures, but aren't yet truly confirmed as the specific malware that might include them.
Near the end of the scanning process around 95% complete, the Microsoft scanners all perform a MAPS (Microsoft Active Protection Service) request via internet to the the Microsoft cloud servers in order to upload their initial findings and request confirmation that these findings are either truly malware or instead possible false positive detections or incomplete fragments of inactive malware.
Though the entire process isn't displayed, the clues to this are the following 2 lines in your first log.

No infection found

Successfully Submitted MAPS Report

So what actually happened is that the scanner found possible malware fragments, communicated with the MAPS servers and confirmed there weren't any active malware that it can identify running and completed its operation by reporting these final results as well as uploading its reporting to MAPS as a record.

This final step is important, since as I stated above "there weren't any active malware that it can identify running" on your device, but that doesn't necessarily mean there might not be something that Microsoft's Security Intelligence has yet to determine is a new form of malware. What this report does is allows Microsoft to collate this information within the automated MAPS cloud system and look for such possible new malware patterns, along with those from the millions of other Windows Defender and other scanners operating in real time on many systems.
So there's nothing truly wrong with what the Safety Scanner found and likely no true malware, since this activity is fairly common, but the operation of all of these Microsoft scanners is really far more complex and deep than most people understand.

Let me know if/when you confident we can clean up and close out your thread...

Thank you,

Kevin.

[mikerf]

Kevin,

Thank you for the explanation. Conceptually that makes sense.

My system has been running very well today. In fact, the performance is better than it has been in months and I believe I'm as comfortable as I'm going to be that this matter has been resolved. I truly appreciate your assistance with this. In gratitude, I donated to your PayPal account.

I hope it's alright with you, I just have a couple of last questions:

• Can you provide a link to documentation on how to use FRST? I was a software developer for 18 years. I'd like to get a general idea of the steps that were taken by your script to remediate my PC.
• Is there a best practice guide or equivalent for Malwarebytes that's available online? I thought I was well-protected from getting malware on my system. Perhaps I'm not running scheduled scans often enough or my settings are suboptimal.

Thank you so much,
Mike

[kevinf80]

Hiya Mike, 

I’m not at home until Thursday evening, internet access is somewhat sporadic where I’m at. I will try to reply again when I can with the information you’ve requested…

Regards,

Kevin..

[AdvancedSetup]

Good day,

Here are some links @mikerf

FRST Documentation

http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/?PageSpeed=noscript

Here is the Support link for Malwarebytes

https://support.malwarebytes.com/hc/en-us/categories/360002458014-Malwarebytes-for-Windows

 

TIPS to help prevent infection

https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/

 

If you need something more please let us know

Thank you

 

[kevinf80]

Hiya @mikerf

Thanks for the update, good to hear your system is well again. Thanks to @AdvancedSetup for the links you requested...

Continue to finish up:

Uninstall Sophos AV http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Also delete the following: C:\ProgramData\Sophos Next, Right click on FRST here: C:\Users\Mike\Desktop\Malwarebytes\Technical Support\FRST.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST to uninstall That action will remove FRST and all created files and folders... Next, Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ Consider the following: Disable Remote Desktop: https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html Disable Windows Telemetry: https://helpdeskgeek.com/windows-10/how-to-disable-windows-10-telemetry/ Malwarebytes Browser Guard (Free) for Firefox: https://addons.mozilla.org/en-GB/firefox/addon/malwarebytes/ Malwarebytes Browser Guard (Free) for Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Will also work for Opera and Edge.. PatchMyPC, keep all your software upto date - https://patchmypc.com/home-updater#download From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[mikerf]

AdvancedSetup, Thank you for the links you provided.
 

Hi Kevin,

Thanks so much for all your help. I'll perform the clean-up steps you provided soon. In the meantime, I noticed or I should say Malwarebytes noticed that the web page you provided on thewindowsclub.com for Creating a System Restore Point references a PUP on restoro.com. I believe Malwarebytes did its job & my system is still alright. However, looking at my notifications in Malwarebytes, I see I received a similar notification back in January. Please let me know if there's any further corrective action(s) you believe I should take.

Thank you,
Mike

Blocked website.txt

[kevinf80]

Hiya Mike,

I would not be too concerned, Malwarebytes has made the block so your system is quite safe. I`ll remove that link from my closure c/r due to that alert...

Regards,

Kevin.

[mikerf]

Hi Kevin,

I performed the final clean-up steps you provided, reclaiming over 5GB of disk space. All traces of the virus appear to be removed. My PC is running well. Thank you for the prompt, expert direction you provided. The hours I spent along with your assistance resolving this matter pale in comparison to the time I would've spent had I needed to rebuild this PC or reconfigure a new one.

Thank you kindly,
Mike