1

I had a very few Chrome tabs open (see appendix) and other safe websites. Suddenly, without any prompt or action from me, chrome starts downloading the file "NEW!_iPhone7_LEAKED_PHOTO.JPG.exe" which looks very much like a malware. The file gets saved into my download folder without any action on my side.

I have Windows 8.1 with Windows Defender running. I ran a custom scan on the file using my Windows Defender and it's clean, and also ran it by virustotal]1 which confirms it's clean. (Still it could be a zeroday exploit).

My question is how do I analyze how and why chrome decided to download this file?

In case it's relevant, here is the list of tabs I had open: Gmail, Google Spreadsheets, my gas company, this shopping website, and the world population.

  • 1
    That filename looks so much like malware it's not even funny. Remember that when a (good) antivirus program thinks something is bad, it's very likely bad; the reverse is not necessarily true: just because all antivirus programs say something is clean, doesn't mean it is. If something seems malicious, don't trust it just because an antivirus tool says it's fine. – cpast Dec 23 '14 at 8:36
  • What exactly were you doing before the file was downloaded? Did you open Chrome, and at some point you found this file? – RoraΖ Dec 23 '14 at 13:15
2

Unless you had the foresight to enable performance measurements on your system, its not possible. as for the tabs open. its possible to have chrome download a file directly from command-line (so any program on your system could have done this, not just your open tabs). also a webpage might have had an "injection" either in-between you and its server. or on the server, or on your machine. you should check your extensions, and inspect what software is actually running on your machine (is there any mal-/crap-/spy- ware present. very your result with more than 1 scanner. and USE COMMON SENSE.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.