0

The website codecguide.com offers a codec pack. When installing, it secretly installed a browser plugin that looks highly suspicious. The plugin is supposedly here: http://www.codecguide.com/browsersecurity.ini Is this safe? It installed an executable s768.exe that contains the texts:

"TWndMethod MessageTMessage ;A ¯ÓI ;A Message ÔI HÔI (ÔI .ÔI PœA ðz@ øz@ ôsB 8~@ X~@ \~@ `~@ T~@ ˆx@ ¤x@ ürB œsB @sB ELoginCredentialErrorHÔI ELoginCredentialError ÔI x¢A System.Classes „ÔI "TLoginCredentialService.TLoginFunc´"@ @ System.Classes ÿÿ ØÔI #TLoginCredentialService.TLoginEvent SenderTObjectUsernamestringPasswordstringDomainstringHandledBoolean Œ@ ¸@ ¸@ ¸@ @ lÕI Œ@ Sender ¸@ Username ¸@ Password ¸@ Domain @ Handled ÄÕI -TLoginCredentialService.TLoginCredentialEvent SenderTObject Callback#TLoginCredentialService.TLoginEventSuccessBoolean Œ@ ÔÔI @ WÖI Œ@ Sender ÔÔI Callback @ Success äÖI €×I äÖI ÿÖI "

It seems to be collecting information and acting very suspiciously. It saves profile images from Skype in a separate folder, it contains a script called inject.js and some strange data files. I have made a folder of all the files that were changed during or after that installation and would like to send it to a security company.

Where can I have the installed program checked?

1
  • That text suggest (but doesn't prove!) that it was written in Delphi.
    – S.L. Barth
    Oct 6, 2016 at 11:29

2 Answers 2

2

Try using VirusTotal website where you can upload your suspicious file(s) and it will scan it for malware (Max file size is 128MB). There are other online scanners as well which may catch it.

You can also try uploading to one of these online sandbox services to analyze suspicious behavior.

If the scans don't show anything, the best way to preserve the infected machine would be to make an VM image of it using the Disk2vhd tool from Microsoft to preserve its present state so you can get back to a previous known state if you want to reproduce a certain behavior.

2
  • Thank you. Totalvirus showed two positives; AVG Generic.4FC 20161006 AegisLab Virus.Gen!c 20161006 This program is signed by Vondos Media GmbH What does that mean?
    – imonaboat
    Oct 6, 2016 at 15:02
  • Could be adware/spyware. I would recommend using AVG antivirus to remove it since that product found it. The "signed by" means the program was developed by the Vondos Media GmbH company since the exe is signed by their certificate.
    – ARau
    Oct 6, 2016 at 19:33
1

I can confirm about that. My experience was to download K-Lite from CodecGuide site and, during installation, Anvir Task Manager inform me that s768.exe wants to load and connect during system start. This wants to be an "Firefox extention" (actually is present on Firefox addons repository) but it's perform a hidden install cause you can't find nothing about in the Firefox addons panel. So i made some research and found something about it. It's related to Vondos.de company and when it's active this spyware send data to: miyagi.browser-service.net The infection include some Firefox UserData folders and you can find releted files searching in your pc for "browser-security". Also in the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Browser-Security

For reply to @Anders My browser-secutiry.ini file, after running AdwCleaner (that quarantine only the s768.exe, but not clean the releted folders) show this:

  • [Data]
  • url=http:// files. vondos.de/1.2.0/klite.exe
  • size=5704400
  • minversion=1220
  • sha1=1e0452cd7155888a65a48c6b46a03540be31888a

Hope can help. Greetings

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.