Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Not Sure What I'm Dealing With Here....But I'm Deeply Worried

crdownload malware vanishing

  • Please log in to reply

#16
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Now hear this:

 

I've realized that the phenomena of (a) newly opened Google search screens initially consisting of a large blue rectangle and (b) small blue boxes appearing when I scroll down (using a plug-in mouse) only occur when Geeks to Go is already open.  If I close the Geeks to Go tab, the problems go away.  And it's worth observing that the blue rectangles/blue Google screen are exactly the same shade of blue used on the Geeks to Go forum pages.  Quite what the significance of this is, I have absolutely no idea.

 

Rogue Killer detected one item:

 

RogueKiller Anti-Malware V14.0.4.0 (x64) [Jan  6 2020] (Free) by Adlice Software
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits
Started in : Normal mode
User : Home [Administrator]
Started from : C:\Users\Home\Desktop\RogueKiller_portable64.exe
Signatures : 20200107_091128, Driver : Loaded
Mode : Standard Scan, Scan -- Date : 2020/01/08 08:42:43 (Duration : 00:51:52)
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[Miner.Gen (Malicious)] (folder) Microsoft -- C:\Windows\SysWOW64\Microsoft -> Found
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Edited by Waste of Space, 08 January 2020 - 03:40 AM.

  • 0

Advertisements


#17
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Your blue problem sounds like it's video driver related but you have the latest that available in the Microsoft catalog and Intel says you are on your own because the product is end of life.  Perhaps it's related to your Adblock or one of your other extensions.  Go to

chrome://extensions/

(you will have to copy and paste or just type it in since the forum doesn't recognize it as a URL)

Turn off all non Chrome Apps.  Restart Chrome.  Do you still get the blue?  If not it's one of you extensions so go back in a turn on a few and restart Chrome see if you can isolate it to a single Extension.  If it's AdBlock turn it off and try Ublock Origin

https://chrome.googl...hjbkeiagm?hl=en

instead.  Does it work better?  (It's the adblocker I use)

 

 

 

 

 

C:\Windows\SysWOW64\Microsoft does not exist on my PC but it's a Win 10.  Let's look to see what is in there.

 

copy the next line:

 

dir  /s  C:\Windows\SysWOW64\Microsoft  > C:\Users\Home\Desktop\junkm.txt

 

then open an Elevated Command Prompt:

 

http://www.howtogeek...-in-windows-10/
http://www.eightforu...indows-8-a.html

 

Right click , right click and Paste or right click and Edit then Paste and the copied line should appear.  Hit Enter.

 

Close the command prompt and find the junkm.txt file on your desktop.  Open it and copy the text (Ctrl a, Ctrl c) move to a reply and Ctrl v.

 


 


  • 0

#18
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Well, I only run four Chrome extensions:  Docs, Sheets, Slides and AdBlock. I tried switching them all off one by one and then relaunching Chrome in each instance, but with Geekstogo open, the blue phenomenon still persists.

 

As for the elevated Command Prompt, the outcome (if I did it right) was simply File Not Found. "Volume in drive C has no label.

 Volume Serial Number is 9C8A-17EB"
 
Quite where this leaves Rogue Killer's conviction that C:\Windows\SysWOW64\Microsoft is a threat to my PC, I have no idea.

 

I'm beginning to think I should just learn to live with the ol' blue boxes and rectangles.  After all, they only manifest when I visit Geeks To Go.

 

My sincere thanks for all your help and for your apparently inexhaustible patience.


Edited by Waste of Space, 08 January 2020 - 09:51 AM.

  • 0

#19
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Let RogueKiller remove the thing it found.  If it won't let us look at it then it's probably evil.


  • 0

#20
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Maybe these two links will make some sense to you?  They make me hesitate to delete C:\Windows\SysWOW64\Microsoft

 

https://answers.micr...0e-83d5b3c36701

 

https://answers.micr...f2-378ce42c19b9


  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Since the CMD dir command didn't find it the folder is superhidden which is not normal.  Let's try a different command to make sure:

Copy the next line:

 

dir /a /s C:\Windows\SysWOW64\Microsoft> C:\Users\Home\Desktop\junkm.txt

 

Open an elevated command prompt

right click and paste or edit then paste or sometimes just right click and the copied line will appear.  Hit Enter.  This command should definitely return something since if it can't find the Microsoft folder then it will list files and folders in SysWOW64


  • 0

#22
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Thanks.

 

The elevated Command Prompt resulted in this:

 

Volume in drive C has no label.
 Volume Serial Number is 9C8A-17EB
 
 Directory of C:\Windows\SysWOW64\Microsoft
 
25/08/2015  18:10    <DIR>          .
25/08/2015  18:10    <DIR>          ..
25/08/2015  18:10    <DIR>          Crypto
               0 File(s)              0 bytes
 
 Directory of C:\Windows\SysWOW64\Microsoft\Crypto
 
25/08/2015  18:10    <DIR>          .
25/08/2015  18:10    <DIR>          ..
25/08/2015  18:10    <DIR>          RSA
               0 File(s)              0 bytes
 
 Directory of C:\Windows\SysWOW64\Microsoft\Crypto\RSA
 
25/08/2015  18:10    <DIR>          .
25/08/2015  18:10    <DIR>          ..
25/08/2015  18:10    <DIR>          MachineKeys
               0 File(s)              0 bytes
 
 Directory of C:\Windows\SysWOW64\Microsoft\Crypto\RSA\MachineKeys
 
25/08/2015  18:10    <DIR>          .
25/08/2015  18:10    <DIR>          ..
               0 File(s)              0 bytes
 
     Total Files Listed:
               0 File(s)              0 bytes
              11 Dir(s)  18,276,253,696 bytes free

  • 0

#23
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Looks like at one time you had an RSA key that you used to log in to a company server. 

Looked like this:

http://www.tokenguar...urID-SID700.asp

We used to have them for people to login who dialed up using modems when I worked at DirecTV. 

Here is more than anyone wants to know about RSA:

https://en.wikipedia..._(cryptosystem)

 

As the folders and subfolders are all empty deleting the folder will have no effect (other than to make RogueKiller happy) but since it's empty you can leave it.


  • 0

#24
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Well figured:  what's now my home PC was formerly one of the networked PCs in my workplace.  I liberated it when we had new PCs installed.

 

Maybe I should indeed let Rogue Killer have its way, just in case the same anomaly comes to light again at some point in the future and I can't recall that we ever had this exchange.

 

So then, what can I say?  Imagine me doffing my cap and tugging my forelock in your general direction, R Kinner.  You're doing the Lord's work, like.

 

(Not the Lord of Darkness, obviously.)

 

My thanks.


Edited by Waste of Space, 11 January 2020 - 08:08 AM.

  • 0

#25
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Your choice.

 

Where are we now?


  • 0

Advertisements


#26
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Still got the blue thing going on, but I'm sure I can live with it if I have to.

 

As for anything else, I'm finding that if I go to YouTube and click to play a video, the comments beneath the video aren't viewable, because in their place is that thing that just goes round and round and round, like when a video is sorting itself out before streaming properly (unsure of the technical term)  -  only in this instance it doesn't sort itself out and the comments are never viewable.  Started a few days back.

 

Whether this is a problem with YouTube or with my PC, I don't know, but the videos themselves seem to stream okay so I'm tempted to assume it's YouTube's problem.

 

Other than that, things seem okay at present.  Mind you, I may change my mind about that if I suddenly find that my bank accounts have been mysteriously emptied.  But as far as I can see, the old log-burning PC isn't about to crumble just yet  -  probably due to your assistance.


  • 0

#27
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Let's rule out Chrome as the source of the problem.  Try downloading Firefox:

 

https://www.mozilla....US/firefox/new/

 

Then go to Youtube and see if you have the same problem.


  • 0

#28
Waste of Space

Waste of Space

    Member

  • Topic Starter
  • Member
  • PipPip
  • 77 posts

Right, then (and sorry for the delay  -  I'm not a well man at present).

 

I downloaded Firefox, went to YouTube and all comments were on display. Yet Chrome persists in not showing them and gives me the little wheel thing going round and round instead.  Ain't that the durndest thing?

 

Should I delete Chrome and download it afresh?  Or is Chrome somehow too much for my PC to handle all of a sudden?


Edited by Waste of Space, 14 January 2020 - 10:53 AM.

  • 0

#29
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Delays are no problem.  I don't keep track.  Hope you feel better soon.

 

You may want to export your profile first:

https://smallbusines...file-79321.html

 

You can try resetting Chrome:

 

https://support.goog...r/3296214?hl=en

before uninstalling/reinstalling

 

You will have to reinstall your extensions.


  • 0






Similar Topics


Also tagged with one or more of these keywords: crdownload, malware, vanishing

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP