What is this: Koadrecckud?

[hobie]

I found this directory in my users\ken\AppData\LocalLow\Microsoft directory today. There is an EXE running with about a dozen instances of Vvsmmqswym.exe which has a description of Google Chrome. I didn't install Chrome and can't find it installed. I tried to Google it but nothing shows up.

 

[richc46]

Sounds like a virus.
Download Malwarebytes and make a full scan
Make a full scan with your anti virus
Make a full scan with eset online anti virus

 

[ThrashZone]

Hi some follow up links to review to run scanners,
Review Jacee’s instructions to run Adwcleaner here post #7,
Ignore the title of the thread,
http://www.sevenforums.com/system-security/316404-instant-savings-app.html
Screen shot of the download button to use for Adwcleaner
You can use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
See this tutorial on how to download and run Malwarebytes,
http://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html
Also use the Custom scan option not the Threat scan,

Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to remove anything it finds
http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

 

[jamis]

Had a similar issue last week. Browser highjack. Manually deleted things and then ran MSERT which found the responsible trojan. See this thread.

http://www.sevenforums.com/browsers-mail/356471-ie11-browser-hijacked-google-chrome.html

Microsoft Safety Scanner - Free Virus Scan with the Microsoft Safety Scanner

 

[hobie]

msert found: Win32/Chroject.D!dll

 

[jamis]

msert found: Win32/Chroject.D!dll

That was the one that infected my system. Hasn't returned.