Question I have a Trojan Horse infection in Chrome that cannot be removed. (scope_dirxxxxxxx) ?

[ozturkozgr]

Hello. I use the extensions I always use in Chrome, but as seen in the images, a new attack has developed. I cannot detect the malware or third-party plugin that triggers this attack. Or I don't understand if the leak is due to a vulnerability in Chrome. I tried uninstalling or disabling many extension, but to no avail. The same add-ons are also available in the Edge browser, but the malware operates through Chrome. Do you have any ideas? What path should I follow? I'm also hesitant to completely delete my browser settings and add-ons.

Image https://ibb.co/d48h01C

Ekran-g-r-nt-s-2024-06-22-210634 hosted at ImgBB

Image Ekran-g-r-nt-s-2024-06-22-210634 hosted in ImgBB

ibb.co

 

[Secret-Squirrel]

I don't think that third-party extensions are causing this because the malware is active in your Temp folder.

Eset is also saying that the malware is modifying the Chrome EXE file. It also says that you need to restart your computer - have you been doing this?

If you have then try a different malware remover such as Malwarbytes - the on-demand scanner is free and is ideal for one-time detection and removal.

 

[ozturkozgr]

Of course I reboot but the same thing triggers again. An exploit calls the malware and helps it launch an attack, but I can't find it. I scanned with Malwarebytes.

 

[Zerk2012]

If you have malware and can't get rid of it then you need a full system wipe and reinstall of windows.
You will loose everything on the drives so I hope you have important information that can't be replaced backed up.

 

[Secret-Squirrel]

As a test, and if you're logged into your Google Account in Chrome, log out, close Chrome, get Eset to eradicate the malware, then reopen Chrome but don't log back in. Does the problem return?

 

[Secret-Squirrel]

How are you getting on? I have another plan if my advice from yesterday didn't help.

 

[ozturkozgr]

How are you getting on? I have another plan if my advice from yesterday didn't help.

I haven't followed your advice yet, but last night I deleted all add-ons and restarted the browser and the same thing happened again. As far as I understand, it is not caused by the plug-in, there is another infection in Chrome. I will try what you said and I will write to you again. You can also share your alternative suggestion. Actually, I am going to format the computer, but there are too many settings and applications, I am lazy.

 

[Secret-Squirrel]

Actually, I am going to format the computer..............

Don't do that until you've tried my suggestion about using Chrome while signed out. If my hunch is correct, the problem will return even after formatting and reinstalling Windows.

By the way, now that you've said that you deleted all your Chrome extensions, my second plan won't help.