1

I was tricked into downloading a .exe file in the Google Chrome browser, expecting a simple text file. I did click on the link that started the download, and I did click once on the download on the bottom left of my browser, where Chrome normally shows the downloadeds.

In these cases, I expect Chrome and/or Windows to give me a warning about not running downloaded executables from untrusted sites, but I didn't get any. Chrome simply ran the executable showing me some kind of installer for some kind of download manager. Off course I killed the process as soon as I saw I ran the executable. But I don't know if this opportunity the executable had, is enough to cause damage.

A scan by virustotal on the executable shows a lot of hits: 

AVG               Generic.7E5
AVware            InstallCore (fs)
AhnLab-V3         PUP/Win32.InstallCore
Avira (no cloud)  PUA/InstallCore.Gen4
Bkav              W32.HfsAdware.FEB6
ESET-NOD32        a variant of Win32/InstallCore.ACZ potentially unwanted
GData             Win32.Adware.InstallCore.GF
Ikarus            PUA.InstallCore
K7AntiVirus       Adware ( 004d2b271 )
K7GW              Adware ( 004d2b271 )
Malwarebytes      PUP.Optional.BundleInstaller
NANO-Antivirus    Trojan.Win32.InstallCore.ebwcin
Qihoo-360         HEUR/QVM06.1.0000.Malware.Gen
Sophos            Install Core Click run software (PUA)
Symantec          SMG.Heur!gen
VBA32             Malware-Cryptor.InstallCore.gen
VIPRE             InstallCore (fs)
Yandex            PUA.InstallCore!

My questions:

  • How can it be that Google Chrome just went ahead and ran the file without any warning?
  • This file (.exe) was a software installer, and once running I killed it with task manager. Could this technically already have harmed my pc, even though I didn't install the product the installer was offering?
  • Or could it be that Chrome and/or Windows recognized the file as an installer and therefore just let me run it, assuming I can always decline the installation later on? The installer was signed by PromptSpeedy (Fried Cookie Ltd), GlobalSign CodeSigning CA - SHA256 - G2 and GlobalSign.
  • If not, what steps should I take to prevent further damage now having already run this file once already?

More details on the file can be seen here: https://www.virustotal.com/nl/file/cdd371ffcef65b9a3fa3856ad5d4f3935319715c35bedf6cce06ae3ae9d5a4e5/analysis/1462894859/

Improve this question
7
  • 1
    What happens when you download a file is configure by you, the browser, only does what its been configured to do. If you indicate you don't want to be asked in the future on what to do ,when a file has a particular extension, thats what it will do.
    – Ramhound
    May 10, 2016 at 16:09
  • 2
    Possible duplicate of How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?
    – Ramhound
    May 10, 2016 at 16:09
  • @Ramhound : I don't remember ever configuring Chrome to quietly accept running executables. Do you know where I can see this configuration in Chrome?
    – nl-x
    May 10, 2016 at 16:12
  • To make things clear: as of now, I have NO indication what-so-ever that I am infected. I just want to know how this happened, and know if there are ways to see if I'm infected. I have no new default start page in any browser, no unexplained new backgrounds, no weird processes in task manager or anything. My question is NOT about how to remove malicious stuff.
    – nl-x
    May 10, 2016 at 16:21
  • 1
    You had two questions, within your question, that indicate otherwise that your not looking for ways to remove malware. Download a file on Chrome
    – Ramhound
    May 10, 2016 at 16:29

2 Answers 2

Reset to default
1

"could this technically have harmed my PC?"

YES, it was an executable which was loaded into memory and running under your user account with your permissions, possibly even elevated as an installer.

Whether it did or not, who knows? But it was delivered under shady circumstances (file name redirection; leveraging the "hide extensions default"), and is flagged as an adware installer.

Probably it was simply asking for permission to infect your computer with needless adware: a kind of gentleman's agreement to rip you off.

Improve this answer
5
  • The only saving grace is that fact the application was signed by a CA, which means, it was more likely adware then malware.
    – Ramhound
    May 10, 2016 at 17:03
  • @Ramhound : please elaborate. This is exactly the kind of answer I was looking for. What does a CA certification stand for in this matter? Does CA for example check if an installer doesn't drop a payload even without installing anything? Or does it do a background check on the applicant?
    – nl-x
    May 10, 2016 at 17:22
  • @nl-x - CA stands for Certificate Authority. There isn't anything to elaborate on from my perspective.
    – Ramhound
    May 10, 2016 at 17:35
  • @Ramhound ah, ok, that I already knew. I just don't know how far a CA check goes. thanks anyway
    – nl-x
    May 10, 2016 at 17:38
  • When an application is signed, by a CA, several things happens. Microsoft and Google ( where Firefox uses Google's features ) safe browsing are less likely to flag the file. In addition more recent versions of Windows also check the "trustworthyness" of a file, and trust files that are signed by a CA, to be more trustworthy. All of this does not change the fact, that the next version of Cryptowall, couldn't be signed by a CA. A certificate signed by a CA, means that a real person requested and paid for the certificate, which means more malicious actions are less likely to happen.
    – Ramhound
    May 10, 2016 at 17:44
1

Setting for this prompt is found in "Start Menu" > "Internet Options" > "Security" > (Internet) > "Custom level..." > "Launching applications and unsafe files" > choose one of the following options;

  • Disable
  • Enable
  • Prompt (recommended)

UAC settings also plays a role in preventing files from running.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.