Kaspersky flagging a repeated download

[Blinx]

Hey everyone,

Tonight when I search on Google via chrome, 3 times I’ve had below pop up, I’ve never seen it before:

 

HEUR:Trojan-Clicker Script GhostPlugin.gen

 

It tells me it’s a Trojan type and that the object is: https://youronlinesearches.com/script/r.php?a=3201&uid=52863x0000xzzz7.

ZZZZZZZZZ

 

However Kaspersky tells me that it has blocked the download each time, this while I’m on Google via chrome, I’ve never seen this before and the only sites I go on are legit ones.

 

I have done a quick scan and it comes back with nothing found, Kaspersky tell me:

 

Event: Malicious object detected

User: ***** (I’m not inc this for privacy)

Usertype: Initiator

Application name: chrome.exe

Application path: C:\Program Files|Google|Chrome/Application

Component: Safe Browsing

Result description: Detected

Type: Trojan

 

 

Can anyone help?

 

 

[Berny]

@Blinx Welcome 

Please disable / enable one by one your Chrome extensions ?

[Blinx]

6 hours ago, Berny said:

@Blinx Welcome 

Please disable / enable one by one your Chrome extensions ?

I have since gone into chrome & reset it, removing all extensions except all googles pre-installed ones and Kaspersky. I have also gone into the user local folder > Google > Chrome > Extensions and deleted any remaining folders after that reset

The only extensions I had installed very volume recorder & volume boost that I had for months all with high user rating & recommended.

 

However when I went into the user local extensions folder for chrome there were folders left after reset, which I deleted, could it of been any of those?

[harlan4096]

Probably, still you can run tool AdwCleaner, and see what it finds... also check Chrome Synchronization feature if enabled, it can revert some malicious extension.

[Blinx]

31 minutes ago, harlan4096 said:

Probably, still you can run tool AdwCleaner, and see what it finds... also check Chrome Synchronization feature if enabled, it can revert some malicious extension.

I’m guessing AdwCleaner is a separate program? Also where do I find the Chrome Synchronization feature?

[harlan4096]

Yes: https://adwcleaner.malwarebytes.com/adwcleaner?channel=release

 

Run it, and copy/paste the scan result log here, before removing anything.

 

https://support.google.com/chrome/answer/185277?hl=en-GB&co=GENIE.Platform%3DDesktop&sjid=14195971132183084704-EU