Solved IE11 Browser Hijacked By Google Chrome

[jamis]

Not a plea for help, but a warning of sorts. Yesterday, IE11 on this system appeared to get hijacked by something in an advertisement. SWMBO (the only user on this box that uses IE11) was on the Daily Mail web site and the CPU usage went through the roof. I'm guessing a third party pixel element in one of the multitude of pictures and ads this site has. There were two pop up messages displayed on top of the web page. One stated that Google Chrome had crashed. The other said the same thing and offered to report the problem. I didn't bite on that one. Task Manager showed multiple copies of "pjjisiyz.exe" running and more would start if you ended one. I signed off the user session and logged in as Administrator. I stopped the browser service, ended all of the copies of the executable, but they would restart as soon as the original user would log back in. I searched the system for the executable and only found it by lopping off the last two characters of the name. It was in a folder called "DSLQJTBZPRI". This folder was in a folder called "PlayReady". The path was C:\Users\"userid"\AppData\LocalLow\Playready. I deleted the PlayReady folder, followed by CCleaner with secure deletion (7 times overwrite) and the problem went away. Here's the twist. Google Chrome is NOT installed on this system. There is no reference to it on the hard drive nor in the registry. It's not listed in the programs section of the Control Panel either. Wish I could get SWMBO to quit using IE, but until I'm unable to fix the problems of using it, I guess I'm stuck. Just wanted let folks know. System is current with all patches.

 

[sweatyHotdogs]

you wouldn't have these kind of problems if you use sandboxie... or any isolation softwares... useful specially if your target user isn't tech head and just wanna browse the web...

 

[Layback Bear]

I believe your system is infected.
I recommend going to the Security section of our forum and ask for help.

http://www.sevenforums.com/system-security/

 

[Gornot]

jamis, I honestly hope you have at least a couple of IE's TPLs installed from the iegallery. they do a pretty good job of blocking unwanted ads, and setting the popup blocker to "block all" effectively reduces the chance of the PC getting infected by a lot.