No replies to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is AdvancedBrowserModule?

The Malwarebytes research team has determined that AdvancedBrowserModule is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by AdvancedBrowserModule?

You may see these browser extensions:

Chrome

Firefox

Opera

and you will see this warning if you look at the properties of the extension:

How did AdvancedBrowserModule get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove AdvancedBrowserModule?

Our program Malwarebytes can detect and remove this potentially unwanted program.

• Please download Malwarebytes to your desktop.
• Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
• Then click Finish.
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of AdvancedBrowserModule?

• No, Malwarebytes removes AdvancedBrowserModule completely.
• If you are using Opera, you may have to remove the Extension manually under Opera > Extensions click the x behind Name of the rogue and click OK in the prompt to confirm.
• If you are using Chrome, you may have to remove the Extension manually under Tools > Settings > Extensions. Remove the checkmark and click on the bin behind the Name of the rogue entry.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes would have protected you against the AdvancedBrowserModule hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Possible signs in FRST logs:

 FF Extension: Browser Exels - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\[email protected] [2017-01-04]
 CHR Extension: (Google Exels) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg [2017-01-04]
 OPR Extension: (Google Exels) - C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb [2017-01-04]
 C:\Users\{username}\AppData\Roaming\BrowserModule

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0
       Adds the file background.js"="12/2/2016 12:25 AM, 1904 bytes, A
       Adds the file manifest.json"="11/24/2016 11:55 PM, 650 bytes, A
       Adds the file popup.html"="1/30/2015 6:29 PM, 661 bytes, A
       Adds the file svzal.js"="12/2/2016 12:25 AM, 442 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\css
       Adds the file options.css"="2/26/2016 7:44 PM, 1631 bytes, A
       Adds the file popup.css"="2/26/2016 7:52 PM, 1561 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\img
       Adds the file icon19.png"="11/5/2016 9:40 PM, 317 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\lightbox
       Adds the file lightbox.css"="3/30/2014 11:45 AM, 3874 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\mbchx
       Adds the file rgpvokjeg_.png"="8/22/2016 9:11 PM, 23994 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\BrowserModule
       Adds the file component.log"="1/4/2017 9:00 AM, 10 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default
       Adds the file browcorp_settings.json"="12/2/2016 12:24 AM, 261 bytes, A
       Adds the file viewer.svg"="12/2/2016 12:54 AM, 149 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\staged
       Adds the file [email protected]"="12/2/2016 12:34 AM, 32997 bytes, A
       Adds the file [email protected]"="12/2/2016 12:34 AM, 32377 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0
       Adds the file background.js"="12/2/2016 12:23 AM, 1902 bytes, A
       Adds the file manifest.json"="9/23/2016 1:50 PM, 546 bytes, A
       Adds the file svzal.js"="12/2/2016 12:23 AM, 442 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0\mbchx
       Adds the file rgpvokjeg_.png"="8/22/2016 9:11 PM, 23994 bytes, A

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/4/17
Scan Time: 9:19 AM
Logfile: mbamAdvancedBrowserModule.txt
Administrator: Yes

-Software Information-
Version: 3.0.5.1299
Components Version: 1.0.43
Update Package Version: 1.0.922
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 353600
Time Elapsed: 9 min, 13 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 10
PUP.Optional.StartPage, C:\USERS\{username}\APPDATA\ROAMING\BROWSERMODULE, Delete-on-Reboot, [78], [335017],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0\mbchx, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.FakeExels, C:\USERS\{username}\APPDATA\ROAMING\OPERA SOFTWARE\OPERA STABLE\EXTENSIONS\DCMFFKMBAPNLKAABFKJABPAJOHIGLHEB, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\lightbox, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\mbchx, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\css, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\img, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\FNGMHNNPILHPLAEEDIFHCCCEOMCLGFBG, Delete-on-Reboot, [1912], [335034],1.0.922

File: 18
PUP.Optional.StartPage, C:\USERS\{username}\APPDATA\ROAMING\BROWSERMODULE\COMPONENT.LOG, Delete-on-Reboot, [78], [335017],1.0.922
PUP.Optional.BrowCorp, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NCH5MQSA.DEFAULT\BROWCORP_SETTINGS.JSON, Delete-on-Reboot, [2473], [357597],1.0.922
PUP.Optional.BrowCorp, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NCH5MQSA.DEFAULT\VIEWER.SVG, Delete-on-Reboot, [2473], [357600],1.0.922
PUP.Optional.BrowserModule, C:\USERS\{username}\DESKTOP\ADVANCEDBROWSERMODULE .EXE, Delete-on-Reboot, [2558], [349583],1.0.922
PUP.Optional.FakeExels, C:\USERS\{username}\APPDATA\ROAMING\OPERA SOFTWARE\OPERA STABLE\EXTENSIONS\DCMFFKMBAPNLKAABFKJABPAJOHIGLHEB\1.1.9.2_0\MANIFEST.JSON, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0\mbchx\rgpvokjeg_.png, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0\background.js, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Roaming\Opera Software\Opera Stable\Extensions\dcmffkmbapnlkaabfkjabpajohiglheb\1.1.9.2_0\svzal.js, Delete-on-Reboot, [1912], [335021],1.0.922
PUP.Optional.BrowCorp, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NCH5MQSA.DEFAULT\EXTENSIONS\[email protected], Delete-on-Reboot, [2473], [357596],1.0.922
PUP.Optional.FakeExels, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\FNGMHNNPILHPLAEEDIFHCCCEOMCLGFBG\52.0_0\MANIFEST.JSON, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\css\options.css, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\css\popup.css, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\img\icon19.png, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\lightbox\lightbox.css, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\mbchx\rgpvokjeg_.png, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\background.js, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\popup.html, Delete-on-Reboot, [1912], [335034],1.0.922
PUP.Optional.FakeExels, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\52.0_0\svzal.js, Delete-on-Reboot, [1912], [335034],1.0.922

Physical Sector: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.