How to get rid off "chunk~2dcc5aaf7" /Backdoor:Win32/WebShell ?

[strangers have the best candy;]

Hello, everyone! Would someone be so kind as to teach me how to get rid of this specific file? Please. https://i.postimg.cc/hvCsfskK/aaaaa.png <<<

[strangers have the best candy;]

Originally posted by Alice Liddell:

It says it right there to delete but if it cannot be deleted there, you will have to delete it in Safe Mode as with most viruses, malware, etc...

I tried with my antivirus program, with malware cleaner, but every day keeps popping up.

[ReBoot]

Factory-reset your system. Cleaning an infected system after the fact is more difficult (as you've just found it out) and Error-prone (you cna never be sure the malware is actually gone)?

[Iceira]

Try the restore to previous working windows restore point if you are lucky its not there.

[strangers have the best candy;]

Originally posted by Alice Liddell:

Originally posted by VALENTINKAAAAAAA:

I tried with my antivirus program, with malware cleaner, but every day keeps popping up.

Reboot is correct to factory reset the system completely reinstalling Windows after Clean-Slating the SSD/HDD in BIOS which may take several hours.

And please do yourself a BIG FAVOR, STOP VISITING MALICIOUS WEBSITES!

If something is "too good to be true" most likely it is a scam.

If you roll-back to an earlier restore point, that Trojan will still appear.

Take this very seriously because this is in fact a true Trojan and NOT a false-positive.

-----------------------------------------------------------------------


It was downloaded actually from the Steam update, that's why I am asking here.
Your prompt response is much appreciated.

[ReBoot]

Originally posted by VALENTINKAAAAAAA:

Originally posted by Alice Liddell:

Reboot is correct to factory reset the system completely reinstalling Windows after Clean-Slating the SSD/HDD in BIOS which may take several hours.

And please do yourself a BIG FAVOR, STOP VISITING MALICIOUS WEBSITES!

If something is "too good to be true" most likely it is a scam.

If you roll-back to an earlier restore point, that Trojan will still appear.

Take this very seriously because this is in fact a true Trojan and NOT a false-positive.

-----------------------------------------------------------------------


It was downloaded actually from the Steam update, that's why I am asking here.
Your prompt response is much appreciated.

That didn't happen. If Steam updates downloaded malware, that would be all over the news? Not even gaming news,news in general.

[strangers have the best candy;]

Originally posted by ReBoot:

Originally posted by VALENTINKAAAAAAA:

-----------------------------------------------------------------------


It was downloaded actually from the Steam update, that's why I am asking here.
Your prompt response is much appreciated.

That didn't happen. If Steam updates downloaded malware, that would be all over the news? Not even gaming news,news in general.

----------------------------------------------------------
it is possible, because i am using windows 8.1 : )

[Aluvard]

Originally posted by VALENTINKAAAAAAA:

Originally posted by ReBoot:

That didn't happen. If Steam updates downloaded malware, that would be all over the news? Not even gaming news,news in general.

----------------------------------------------------------
it is possible, because i am using windows 8.1 : )

It's not possible because everyone would get it - people on newer OS, people with different AV etc., yet only you have a problem.

For me it looks like false positive from your AV. Which brand is it?

[ReBoot]

Originally posted by VALENTINKAAAAAAA:

Originally posted by ReBoot:

That didn't happen. If Steam updates downloaded malware, that would be all over the news? Not even gaming news,news in general.

because i am using windows 8.1

Dumb jokes aren't a good discussion technique when you're asking for help. One could think, your whole thread is a joke.

[strangers have the best candy;]

Originally posted by ReBoot:

Originally posted by VALENTINKAAAAAAA:

because i am using windows 8.1

Dumb jokes aren't a good discussion technique when you're asking for help. One could think, your whole thread is a joke.

-------------------------------
Nothing more than you trolling my theme. Don't troll if you have nothing constructive to say. Go buy something, like a puzel.
https://help.steampowered.com/bg/faqs/view/4784-4F2B-1321-800A

[N3tRunn3r]

Do NOT reset your machine
Do NOT use a recovery
Do NOT use any rollback

DO a fresh & clean install, delete ALL disks and partitions while doing so ::

Reformat/reinstall a fresh and clean W10/W11:
Win11: https://www.microsoft.com/software-download/windows11

Win10: https://www.microsoft.com/software-download/windows10

W10/11 Clean Install

https://www.microsoft.com/en-us/windowsinsider/cleaninstall

1. Plugin your USB with Windows 10/11 install media
   
2. Keep your correct IRST drivers ready inside an extra folder, to be save ..
   
3. Open Windows Start menu
   
4. Restart your PC while holding the Shift key to boot into the Windows Recovery Environment (WinRE). Once in the Windows Recovery Environment, choose to boot from the USB drive.

Once your drives and partitions are ALL deleted & formatted in setup, continue..

During later stage of fresh install, @ Language Selection

1. cut LAN/WLAN
   
2. "Shift + F10" to open console
   
3. type:

   oobe\bypassnro

4. auto-reboots
   
5. select:

   "I don't have internet"
   "Continue with limited setup"

6. Install your "LOCAL ACCOUNT" and disable all telemetry stuff during setup
   >> Profit

Later you can even setup a PIN in Windows Options without being online/Microsoft account, and if you like - and I suggest it - uninstall Windows OneDrive straight after you enter your freshly installed Windows and disable UAC (User Account Control)!! Afterwards let your machine connect to the internet and use Windows Update and Microsoft Store Apps update.

If updates are done, install AntiVir as "ESET Premium" and "Mozilla Firefox + uBlock Origin" (by Raymond Hill). Then search for more and specific drivers manually, as latest NVIDIA drivers, more special Chipset drivers, latest BIOS firmware, etc ..

https://www.mozilla.org/firefox/new/

https://addons.mozilla.org/firefox/addon/ublock-origin/

https://www.eset.com/int/home/free-trial/

Less is always more .. especially in IT

https://www.av-comparatives.org/comparison/

https://www.av-comparatives.org/tests/summary-report-2023/


Good Luck !!

[Elucidator]

There is a lot of fear mongering here.
Jeez.

Relax OP, its not that serious.


Your AV found a thread of the type "Trojan Backdoor" (Windows executable) in a javascript file called "chunk~2dcc5aaf7.js"

Javascript files cannot execute without a browser running them, which means they don't do anything untill some browser reads and runs the js file, to show something or whatever.
Although this information is useless right now, because you have probably used this file multiple times already and its currently in use by a browser indeed.

A backdoor trojan lets someone connect to your computer by opening up a port and using a tool now running on your system. (Let's not get ahead of ourselves at "what else" it may be doing.)

Usually Antivirus software blocks access to the javascript file, so it cannot run, and you cannot start it by doubleclicking. (it needs to be opened up by a browser, or something with a browser inside, such as steam or discord, or whatever.)

The file is located in D:\CS\steamui
----

Now I can answer your questions:

No, the file wasn't brought to your computer by Steam.
This file indeed exists within the Steam Client, but it rarely updates. You see, it is one of the files responsible for how Steam looks and feels.

I suspect you have installed a custom Steam theme and unfortunately, it appears that custom theme contains a virus. The website owner you downloaded the theme from has malicious intentions seemingly.

Here's how you can resecure your system:
> Close the Steam Client and keep it closed for a while.
( The steam client is currently using the file, because it contains code that decide its looks. This is why you cannot remove it right now. )
> Go to VirusTotal and upload the file chunk~2dcc5aaf7.js to it, see what they have to say.
> Download MalwareBytes Antimalware
> Install MalwareBytes Antimalware
> Run MalwareBytes AntiMalware
> Let malwarebytes antimalware update
> Scan your computer using MalwareBytes Antimalware

It should get rid of the virus and whatever it did on your system.

The page results on VirusTotal should show what the virus is doing exactly. If it is designed to steal information, then you will need to change passwords.

Malwarebytes may find other virusses on your computer; get those checked with Virus Total as well.



Edit:
Just saying, but this guide makes no sense here for a number or reasons:
https://steamcommunity.com/discussions/forum/1/4551533524171091239/#c4526764179302823770
1. It is clear the OP doesn't know what to do and just panicks because "Virus", much like a lot of people. The language you throw out will likely not make sense to them. Prepare as such to be asked: "What is a partition?". ... "delete all disks", they might understand this as "destroy your disks", even though you more literally mean "run disk format and unlist all disks from detection as holding a valid filesystem".
2. Most people do not even own a USB storage drive. They just buy a computer as is and use it. As such they cannot go through those steps. You need to gather what they understand first before going to the next phase if you want to explain anything.
3. If you want to instruct someone how to install windows 11 cleanly (yes, the guide is for windows 11, not for 10, its specific), then you cannot skip over what comes before all of that quickly. You make a guide about the easiest to grasp parts? That's.... just dumb.
4. It doesn't skip other crucial steps, only the original oobe "online" check. e.e; -shake my head-
The OP declared they use Windows 8.1, which means---- indeed, perhaps they cannot run Windows 11 due to a lack of TPM 2.0. And so your guide will not help them, at all. Not one bit right now.

All that guide will do is scare them into buying a new computer, much like what other people do. Also that compare site only seems to list AntiVirus software sources that pay to get listed; its too commercial. Perhaps the scores are paid for as well. You can't trust that. I mean, where is MalwareBytes? Some of the best reputation AVs aren't listed.

[strangers have the best candy;]

Originally posted by Elucidator:

There is a lot of fear mongering here.
Jeez.

Relax OP, its not that serious.


Your AV found a thread of the type "Trojan Backdoor" (Windows executable) in a javascript file called "chunk~2dcc5aaf7.js"

Javascript files cannot execute without a browser running them, which means they don't do anything untill some browser reads and runs the js file, to show something or whatever.
Although this information is useless right now, because you have probably used this file multiple times already and its currently in use by a browser indeed.

A backdoor trojan lets someone connect to your computer by opening up a port and using a tool now running on your system. (Let's not get ahead of ourselves at "what else" it may be doing.)

Usually Antivirus software blocks access to the javascript file, so it cannot run, and you cannot start it by doubleclicking. (it needs to be opened up by a browser, or something with a browser inside, such as steam or discord, or whatever.)

The file is located in D:\CS\steamui
----

Now I can answer your questions:

No, the file wasn't brought to your computer by Steam.
This file indeed exists within the Steam Client, but it rarely updates. You see, it is one of the files responsible for how Steam looks and feels.

I suspect you have installed a custom Steam theme and unfortunately, it appears that custom theme contains a virus. The website owner you downloaded the theme from has malicious intentions seemingly.

Here's how you can resecure your system:
> Close the Steam Client and keep it closed for a while.
( The steam client is currently using the file, because it contains code that decide its looks. This is why you cannot remove it right now. )
> Go to VirusTotal and upload the file chunk~2dcc5aaf7.js to it, see what they have to say.
> Download MalwareBytes Antimalware
> Install MalwareBytes Antimalware
> Run MalwareBytes AntiMalware
> Let malwarebytes antimalware update
> Scan your computer using MalwareBytes Antimalware

It should get rid of the virus and whatever it did on your system.

The page results on VirusTotal should show what the virus is doing exactly. If it is designed to steal information, then you will need to change passwords.

Malwarebytes may find other virusses on your computer; get those checked with Virus Total as well.



Edit:
Just saying, but this guide makes no sense here for a number or reasons:
https://steamcommunity.com/discussions/forum/1/4551533524171091239/#c4526764179302823770
1. It is clear the OP doesn't know what to do and just panicks because "Virus", much like a lot of people. The language you throw out will likely not make sense to them. Prepare as such to be asked: "What is a partition?". ... "delete all disks", they might understand this as "destroy your disks", even though you more literally mean "run disk format and unlist all disks from detection as holding a valid filesystem".
2. Most people do not even own a USB storage drive. They just buy a computer as is and use it. As such they cannot go through those steps. You need to gather what they understand first before going to the next phase if you want to explain anything.
3. If you want to instruct someone how to install windows 11 cleanly (yes, the guide is for windows 11, not for 10, its specific), then you cannot skip over what comes before all of that quickly. You make a guide about the easiest to grasp parts? That's.... just dumb.
4. It doesn't skip other crucial steps, only the original oobe "online" check. e.e; -shake my head-
The OP declared they use Windows 8.1, which means---- indeed, perhaps they cannot run Windows 11 due to a lack of TPM 2.0. And so your guide will not help them, at all. Not one bit right now.

All that guide will do is scare them into buying a new computer, much like what other people do. Also that compare site only seems to list AntiVirus software sources that pay to get listed; its too commercial. Perhaps the scores are paid for as well. You can't trust that. I mean, where is MalwareBytes? Some of the best reputation AVs aren't listed.

Thank you, thank you.

[Sensimilla]

Originally posted by Elucidator:

There is a lot of fear mongering here.
Jeez.

Relax OP, its not that serious.


Your AV found a thread of the type "Trojan Backdoor" (Windows executable) in a javascript file called "chunk~2dcc5aaf7.js"

Javascript files cannot execute without a browser running them, which means they don't do anything untill some browser reads and runs the js file, to show something or whatever.
Although this information is useless right now, because you have probably used this file multiple times already and its currently in use by a browser indeed.

A backdoor trojan lets someone connect to your computer by opening up a port and using a tool now running on your system. (Let's not get ahead of ourselves at "what else" it may be doing.)

Usually Antivirus software blocks access to the javascript file, so it cannot run, and you cannot start it by doubleclicking. (it needs to be opened up by a browser, or something with a browser inside, such as steam or discord, or whatever.)

The file is located in D:\CS\steamui
----

Now I can answer your questions:

No, the file wasn't brought to your computer by Steam.
This file indeed exists within the Steam Client, but it rarely updates. You see, it is one of the files responsible for how Steam looks and feels.

I suspect you have installed a custom Steam theme and unfortunately, it appears that custom theme contains a virus. The website owner you downloaded the theme from has malicious intentions seemingly.

Here's how you can resecure your system:
> Close the Steam Client and keep it closed for a while.
( The steam client is currently using the file, because it contains code that decide its looks. This is why you cannot remove it right now. )
> Go to VirusTotal and upload the file chunk~2dcc5aaf7.js to it, see what they have to say.
> Download MalwareBytes Antimalware
> Install MalwareBytes Antimalware
> Run MalwareBytes AntiMalware
> Let malwarebytes antimalware update
> Scan your computer using MalwareBytes Antimalware

It should get rid of the virus and whatever it did on your system.

The page results on VirusTotal should show what the virus is doing exactly. If it is designed to steal information, then you will need to change passwords.

Malwarebytes may find other virusses on your computer; get those checked with Virus Total as well.



Edit:
Just saying, but this guide makes no sense here for a number or reasons:
https://steamcommunity.com/discussions/forum/1/4551533524171091239/#c4526764179302823770
1. It is clear the OP doesn't know what to do and just panicks because "Virus", much like a lot of people. The language you throw out will likely not make sense to them. Prepare as such to be asked: "What is a partition?". ... "delete all disks", they might understand this as "destroy your disks", even though you more literally mean "run disk format and unlist all disks from detection as holding a valid filesystem".
2. Most people do not even own a USB storage drive. They just buy a computer as is and use it. As such they cannot go through those steps. You need to gather what they understand first before going to the next phase if you want to explain anything.
3. If you want to instruct someone how to install windows 11 cleanly (yes, the guide is for windows 11, not for 10, its specific), then you cannot skip over what comes before all of that quickly. You make a guide about the easiest to grasp parts? That's.... just dumb.
4. It doesn't skip other crucial steps, only the original oobe "online" check. e.e; -shake my head-
The OP declared they use Windows 8.1, which means---- indeed, perhaps they cannot run Windows 11 due to a lack of TPM 2.0. And so your guide will not help them, at all. Not one bit right now.

All that guide will do is scare them into buying a new computer, much like what other people do. Also that compare site only seems to list AntiVirus software sources that pay to get listed; its too commercial. Perhaps the scores are paid for as well. You can't trust that. I mean, where is MalwareBytes? Some of the best reputation AVs aren't listed.

very informative i would have reinstalled windows just to be safe but you clearly know your stuff better than me respect for typeing all this to help a stranger. love to see it

[davidb11]

I mean, normally reinstalling everything from scratch should be the final option after everything else has failed. No one should be pressing the nuclear option right off the bat ever.


If you got it from an awkward steam custom skin, that does suck, and I didn't know those could do that, but fair point.