Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Browser Guard

- - - - -
Started by Metallica , Nov 22 2021 09:21 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 22 November 2021 - 09:21 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Browser Guard?

The Malwarebytes research team has determined that Browser Guard is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.
This one uses the name of a legitimate extension to attrackt more users.

How do I know if my computer is affected by Browser Guard?

You may see this entry in your list of installed extensions:

main.png

and these warnings during install:

warning1.png

warning2.png

warning3.png

How did Browser Guard get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was downloaded from the webstore:

webstore.png

after a redirect from their website:

website.png

How do I remove Browser Guard?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes for Windows to your desktop.
  • Double-click MBSetup.exe and follow the prompts to install the program.
  • When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
  • Click on the Get started button.
  • Click Scan to start a Threat Scan.
  • When the scan is finished click Quarantine to remove the found threats.
  • Reboot the system if prompted to complete the removal process.
Is there anything else I need to do to get rid of Browser Guard?
  • No, Malwarebytes removes Browser Guard completely.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes as well as the real Browser would have protected you against the Browser Guard hijacker. It would have blocked their domain, giving you a chance to stop it before it became too late.

protection1.png


protection2.png


Technical details for experts

Possible signs in FRST logs:

CHR Extension: (Browser Guard) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn [2021-11-22]
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0
       Adds the file background.js"="9/20/2021 1:55 PM, 5226 bytes, A
       Adds the file content.js"="9/20/2021 1:06 PM, 2002 bytes, A
       Adds the file domain_list.js"="8/23/2021 1:11 PM, 560260 bytes, A
       Adds the file icon.png"="11/22/2021 2:18 PM, 3045 bytes, A
       Adds the file manifest.json"="11/22/2021 2:18 PM, 7818 bytes, A
       Adds the file protector.js"="9/20/2021 1:04 PM, 297 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_locales\de
       Adds the file messages.json"="11/22/2021 2:18 PM, 536 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_locales\en
       Adds the file messages.json"="11/22/2021 2:18 PM, 529 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_locales\es
       Adds the file messages.json"="11/22/2021 2:18 PM, 552 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_locales\fr
       Adds the file messages.json"="11/22/2021 2:18 PM, 555 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_locales\it
       Adds the file messages.json"="11/22/2021 2:18 PM, 526 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_locales\pt_BR
       Adds the file messages.json"="11/22/2021 2:18 PM, 543 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_metadata
       Adds the file computed_hashes.json"="11/22/2021 2:18 PM, 95677 bytes, A
       Adds the file verified_contents.json"="9/20/2021 1:22 PM, 3893 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\_metadata\generated_indexed_rulesets
       Adds the file _ruleset1"="11/22/2021 2:18 PM, 357699 bytes, A
       Adds the file _ruleset2"="11/22/2021 2:18 PM, 360019 bytes, A
       Adds the file _ruleset3"="11/22/2021 2:18 PM, 359163 bytes, A
       Adds the file _ruleset4"="11/22/2021 2:18 PM, 357011 bytes, A
       Adds the file _ruleset5"="11/22/2021 2:18 PM, 358931 bytes, A
       Adds the file _ruleset6"="11/22/2021 2:18 PM, 360043 bytes, A
       Adds the file _ruleset7"="11/22/2021 2:18 PM, 359339 bytes, A
       Adds the file _ruleset8"="11/22/2021 2:18 PM, 272395 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\rules
       Adds the file rules_1.json"="8/23/2021 1:11 PM, 985439 bytes, A
       Adds the file rules_2.json"="8/23/2021 1:11 PM, 988187 bytes, A
       Adds the file rules_3.json"="8/23/2021 1:11 PM, 987562 bytes, A
       Adds the file rules_4.json"="8/23/2021 1:11 PM, 987225 bytes, A
       Adds the file rules_5.json"="8/23/2021 1:11 PM, 990138 bytes, A
       Adds the file rules_6.json"="8/23/2021 1:11 PM, 991247 bytes, A
       Adds the file rules_7.json"="8/23/2021 1:11 PM, 990344 bytes, A
       Adds the file rules_8.json"="8/23/2021 1:11 PM, 721757 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\eijenmglnpmjhinahemfkokpomhbpjjn\1.0.10_0\web
       Adds the file background.svg"="8/23/2021 1:11 PM, 1666 bytes, A
       Adds the file block.html"="8/23/2021 1:11 PM, 1510 bytes, A
       Adds the file script.js"="8/23/2021 1:11 PM, 806 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn
       Adds the file 000003.log"="11/22/2021 2:20 PM, 122 bytes, A
       Adds the file CURRENT"="11/22/2021 2:18 PM, 16 bytes, A
       Adds the file LOCK"="11/22/2021 2:18 PM, 0 bytes, A
       Adds the file LOG"="11/22/2021 2:18 PM, 371 bytes, A
       Adds the file MANIFEST-000001"="11/22/2021 2:18 PM, 41 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings]
       "eijenmglnpmjhinahemfkokpomhbpjjn"="REG_SZ", "BD32B9AC1E4CF87ACEE56CA822046B94522D61CF21DF00773D7D582C53648CA7"
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/22/21
Scan Time: 2:27 PM
Log File: f2c10246-4b97-11ec-a4c6-080027235d76.json

-Software Information-
Version: 4.4.10.144
Components Version: 1.0.1499
Update Package Version: 1.0.47505
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}-PC\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 243090
Threats Detected: 11
Threats Quarantined: 11
Time Elapsed: 2 min, 1 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 1
PUP.Optional.Cardinaldata, HKCU\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|eijenmglnpmjhinahemfkokpomhbpjjn, Quarantined, 15730, 635567, , , , , , 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.Cardinaldata, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn, Quarantined, 15730, 635567, , , , , , 
PUP.Optional.Cardinaldata, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\EIJENMGLNPMJHINAHEMFKOKPOMHBPJJN, Quarantined, 15730, 635567, 1.0.47505, , ame, , , 

File: 8
PUP.Optional.Cardinaldata, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, 15730, 635567, , , , , 81F50C28EC7EE70E65BDFE1D3353829E, 5A1D28154A96A774AE053E9A83692AAEFDD75F6AFA42242A066F28AE4D5D8293
PUP.Optional.Cardinaldata, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, 15730, 635567, , , , , AC42984995712BF29C561F5F9DE90418, 13B857F0720A158546786F78A3417D053AB05A33FAB1284A5C51FD430BE46EFA
PUP.Optional.Cardinaldata, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn\000003.log, Quarantined, 15730, 635567, , , , , 2F23D9B1A95BC7E77A09E4474AD0634E, 05984D9F1F10326B725733D6A71B39CB0EDFF73FF43F60F3ED6B1D89457E9892
PUP.Optional.Cardinaldata, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn\CURRENT, Quarantined, 15730, 635567, , , , , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
PUP.Optional.Cardinaldata, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn\LOCK, Quarantined, 15730, 635567, , , , , , 
PUP.Optional.Cardinaldata, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn\LOG, Quarantined, 15730, 635567, , , , , 84707930E55536E2751D9B0847FD9C67, 5FC9BB3B6D1D43FD78A73A93769A72483140170A16137B05AA6B7DA905601147
PUP.Optional.Cardinaldata, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eijenmglnpmjhinahemfkokpomhbpjjn\MANIFEST-000001, Quarantined, 15730, 635567, , , , , 5AF87DFD673BA2115E2FCF5CFDB727AB, F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
PUP.Optional.Cardinaldata, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\EIJENMGLNPMJHINAHEMFKOKPOMHBPJJN\1.0.10_0\DOMAIN_LIST.JS, Quarantined, 15730, 635567, 1.0.47505, , ame, , BBE86324A14A1D61A59B803A5A72CE65, E7FDC839D4043AD9562312A9C358C506E6B748D7221C8FF0A5DCA35BF4CCE0E0

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.