1

I am in the midst of a malware cleanup, as a result of making the rookie mistake of trying out an .exe file from an unreliable source. Anyway, the malware seemingly turned out to be some sort of adware, the kind that embeds annoying ads in the pages while you are browsing. Right now I'm taking care of that (I least I hope so, since I've been making intensive use of ProcessExplorer, Autoruns, Malwarebytes Anti-Malware and Spy Hunter 4 for the last hours). However, there still remains a tricky modification performed by the malware that I still don't know how to fix. Whenever I run Chrome or Firefox, those processes are executed with an additional argument that points to an annoying russian website, like so:

firefox.exe "http://typhirosapile.ru"
chrome.exe "http://typhirosapile.ru"

EDIT: "http://typhirosapile.ru" redirects to "http://traffic-media.co" which seems to be linked to malwares according to google search.

(I know this because that's how the processes are getting called according to the "command line" column in the Task Manager, Windows 7)

My educated guess is that there must be some kind of file or registry that tells Windows how to execute Firefox / Chrome processes by default, and somehow the malware modified those files by adding the annoying russian website as an extra argument.

Is my guess correct? And how can I fix this?

Thanks in advance.

Improve this question

4 Answers 4

Reset to default
1

Ok, so I fixed my own problem.

The problem was not found in the registry. There was no need to reinstall neither Chrome nor Firefox either.

The solution turned out to be way easier than I expected. The malware basically modified the shortcuts of Firefox and Chrome to make them point to a malicious launcher called SalterLauncher.exe with arguments 1 0 and 2 0 respectively. This .exe was located in C:\Users\ {my user}\AppData\Roaming\HPSalter. So basically I killed a process that was having a handle on files within that folder, unchecked the process in Autoruns to prevent it from running again in the future, shift+deleted the entire folder and finally recreated the shortcuts for Firefox and Chrome in my desktop. And now the problem is solved!

Thank you guys for your advises though.

Improve this answer
2
  • Glad you got it sorted, but please don't assume the issue is dealt with - I would strongly suggest running a malware scan or something to clear out any possible remaining nasties.
    – seagull
    Jul 14, 2016 at 16:30
  • I've run Spy Hunter 4's scan, Malwarebytes's scan, AdwCleaner's scan, now I'm running JRT by Malwarebytes too, and I've already checked every process in ProcessExplorer and Autoruns. Should I do something else?
    – Pablo Messina
    Jul 14, 2016 at 16:41
0

Try using RevoUninstaller (it also makes a sys restore so that you can back if you mess something up) to completely delete all of the files associated with Chrome/Firefox then do a reinstall.

Improve this answer
0

Download these free tools and run both (as admin), they clean adwares that can't be identified or deleted by average user (e.g. hidden in registry, taskscheduler, etc).

They also show you, and save a report of (JRT only) files, processes and registry keys that where culprit/suspicious and removed.

1: Junk removal Tool (JRT) by Malwarebytes.

2: AdwCleaner.

Improve this answer
0

If you believe it to be an entry in the registry, then it would be easy enough to use "RegEdit" or a faster registry search program. Search for "typhirosapile" in there and seek and destroy. Just remove the URL parameter.
It could be helpfull or nessisary to Run_As administrator regedit to have access to all of the registry items.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .