Solved Fake google chrome entry in task manager causing popups and system slowness

[Martin DiGirolamo]

Hello,

First off, I'm a new member to the forum and I would like to express my sincere appreciation for help resolving this problem. I'm usually able to clean up malware but have not been successful in this case. As I've read through the furum, I've noticed other posts with a similar issue so this must be something new going around.

The issue I have is popups (always three windows) which became noticeable about five days ago and prompted my actions. I have two accounts on the infected PC and the issue is present on one account while the other account is free of the issue. As I investigated, I noticed a fake google chrome entry in the processes tab of the task manager. Its name is "cphngsji.exe*32" and its listed description is "google chrome." There are 10 to 15 entries in the task manager and it varies increasing and decreasing randomly. The randomly increasing and decreasing entries are visible and correspond to peaks and valleys in the CPU usage trace on the performance tab of the task manager. I also have an issue with the CPU fan running a great deal of the time when the infected account is active. This began several months ago and I now believe it is a result of this infection.

So far I have run my antivirus (McAfee), a tool called SUPERAntiSpyware Free Edition. They were able to find and fix other bugs but not this one. I also ran a McAfee tool called 'GetSusp' which identified three PUP's and one Assumed Dirty File. I ran AdwCleaner which found and cleaned several items (the PUP's identified by 'GetSusp'). After all this I still have the issue. Lastly, I ran AdwCleaner, ASWMBR & FRSTscan and saved the txt files and have attached them below. They are reflective of the current state of the PC.

Please advise on what you would like me to do next. Thanks!

 

[argus]

Helllo,

My name is Argus and and I will be helping you with your computer problems.

Before we begin, please note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The logs can take some time to research, so please be patient with me.
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
• Instructions that I give are for your system only!
• Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
• Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
• Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

 

[Martin DiGirolamo]

Hello Argus,

Thanks so much for the fast reply and help! I was able to run FRST with the fixlist.txt in the same directory and then run AdwCleaner per your instructions. I generated the two corresponding txt files as instructed and attached them below.

I checked the task manager for the presence of the malware file "cphngsji.exe*32" and it is gone which is great news! Please advise on what if anything I need to do next.

Thanks

 

[argus]

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

 

[nissimezra]

the first thing to do is preform a clean boot. if the problem solved you know that something was added to the startup entry that can be disabled.
http://support.microsoft.com/kb/929135
http://support.turbine.com/link/por...e/88/How-do-I-perform-a-Clean-Boot-of-Windows

 

[argus]

The virus, rootkit, etc. is not needed startup.

C:\Users\Kelly\AppData\LocalLow\Adblock Plus for IE\hpfpqpt\yvrkwypcf\cphngsji.exe

This is not a startup.

 

[nissimezra]

The virus, rootkit, etc. is not needed startup.



This is not a startup.

thanks for replay bro
something need to trigger a file to run, there are three option, double click, add startup entery to the RUN in the registry or startup folder, and schedule task.
thats as far as I know if there is another way to trigger a file after reboot I will be happy to learn.

cheers

 

[Martin DiGirolamo]

Hello Argus,

I downloaded and ran DelFix per your instructions and cleaned up the tools downloaded to clean up the virus. Two quick question:

1) What virus did I have? Is it now becoming commonplace?
2) What's a typical donation for this help?