Virus installing chrome extension from ProgramData folder

Question

Hi, It loooks like I have the same issue as described in the post below:

https://answers.microsoft.com/en-us/protect/forum/all/hi-i-need-help-with-a-very-stubborn-virus-who/59977fb0-e116-4101-b7c4-04087f3acfb9?page=1

Here Is the content of the folder that installs the extension "UEmbedDoc" on Google Chrome.

When I search something on google it opens a new tab with a fake search engine.

The Path "C:\Program Files (x86)\OptimizationProgram\Micrqex_Yllcfg.dll" doesn't exist on my PC.

Can anyone help me get rid of it?

Attached the autoruns log: https://drive.google.com/file/d/1WPdlWL9EImjNKSplosgyNX33Q\_njmUve/view?usp=sharing

Thank you in advance!

Answer 1

Hi, I can't seem to get Autoruns to load the log, but usually scanning with Malwarebytes removes this mal extension.

https://www.malwarebytes.com/mwb-download

Let me know how things go. If Malwarebytes can't remove it, post logs from FRST.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Answer 2

That's good to hear! :)

Answer 3

Hi, I can't seem to get Autoruns to load the log, but usually scanning with Malwarebytes removes this mal extension.

https://www.malwarebytes.com/mwb-download

Let me know how things go. If Malwarebytes can't remove it, post logs from FRST.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ 

Thank you very much _AW_!

Malwarebytes has managed to detect and remove it.

It looks like it is gone for now.