- Apr 7, 2023
- 1
Hello. I've tried everything I can possibly think of in order to get rid of this virus. It showed up as a hijacked extension of my google chrome. It deleted all my other extensions and caused my chrome to constantly open and close. It repeatedly pinged pogothere.xyz but was blocked by my computer. I've completely wiped chrome multiple times and it keeps coming back. Finally, I just straight up wiped every essence of chrome off my computer, but it STILL continues to come back under a folder called Chrome_display in my app data folder. Chrome isn't even downloaded, but it just waits there until I reinstall it and then it hijacks my extensions again.
It recreates itself every hour 25 minutes after the hour. Same folder, same JS and JSON file. I've run hitmanpro, malware bytes, deleted every single program off my computer that I've installed in the last two weeks. Went through my registry and deleted anything to do with google or chrome. I'm completely at my wit's end.
The extension calls itself Shampoo. Here is a copy/paste of the json file it creates.
"name": "Shampoo", "version": "18.0", "description": "Shampoo", "action": { "default_icon": { "128": "settings.png" }, "default_title": "Shampoo" }, "icons": { "128": "settings.png" }, "permissions": [ "management", "privacy", "browsingData", "tabs", "webNavigation", "webRequest", "declarativeNetRequest", "storage", "alarms", "contextMenus" ], "host_permissions": [ "file:///chrome://*/*", "*://*/*" ], "content_security_policy": { "extension_page": "script-src 'self' 'unsafe-eval'; object-src 'self'" }, "background": { "service_worker": "background.js" }, "manifest_version": 3,
It comes with a png of a cog wheel called "settings.png" and a javascript file called "Background"
My antivirus will pick this file up and delete it, but it comes back. I delete it manually, it comes back. I have never had a virus like this before. I consider myself mildly tech savvy but this one has me completely scratching my head. Any advice would be much appreciated. Once I delete these files all antivirus software comes back clean.
It recreates itself every hour 25 minutes after the hour. Same folder, same JS and JSON file. I've run hitmanpro, malware bytes, deleted every single program off my computer that I've installed in the last two weeks. Went through my registry and deleted anything to do with google or chrome. I'm completely at my wit's end.
The extension calls itself Shampoo. Here is a copy/paste of the json file it creates.
"name": "Shampoo", "version": "18.0", "description": "Shampoo", "action": { "default_icon": { "128": "settings.png" }, "default_title": "Shampoo" }, "icons": { "128": "settings.png" }, "permissions": [ "management", "privacy", "browsingData", "tabs", "webNavigation", "webRequest", "declarativeNetRequest", "storage", "alarms", "contextMenus" ], "host_permissions": [ "file:///chrome://*/*", "*://*/*" ], "content_security_policy": { "extension_page": "script-src 'self' 'unsafe-eval'; object-src 'self'" }, "background": { "service_worker": "background.js" }, "manifest_version": 3,
It comes with a png of a cog wheel called "settings.png" and a javascript file called "Background"
My antivirus will pick this file up and delete it, but it comes back. I delete it manually, it comes back. I have never had a virus like this before. I consider myself mildly tech savvy but this one has me completely scratching my head. Any advice would be much appreciated. Once I delete these files all antivirus software comes back clean.