Question

Help! hacked? webcore awesomium a virus?

I did something incredibly stupid. I was on Ancestry.com
and tried to click on a link to access something on their site .I got a pop up saying the link wouldn't work because of pop up blocker or something like that. It gave a phone number for how to get it fixed. I've actually had issues on Ancestry and been directed to call with problems.

This time I got someone who asked how old my system was and had me type in a www. address and input a code. As soon as I did that I had a bad feeling and hung up. I restarted the laptop and from that point on got a pop up every time I tried a link on any web site with the same message but a different number every time.

I copied all of my important files to dvds. I had a problem with using my recovery discs and the laptop was a 2008 model so I bought a new laptop. I went to open a file for my taxes and inside the file there was another file that said debug and there were no other files. That didn't make sense. I opened that up and inside was this message [0409/133412:INFO:(0)] WebCore is now online.
[0409/133412:INFO:(0)] Running Awesomium 1.7.4.2

Every other file is intact. I'm panicked that I've been hacked as a result of my stupidity. Any help would be most appreciated.

Discussion is locked

Follow
Reply to: Help! hacked? webcore awesomium a virus?
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: Help! hacked? webcore awesomium a virus?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Comments
- Collapse -
Answer
Re: file

- You opened a file (for your taxes) from your DVD on your new laptop, if I understand your story well. What file? What program did you use to open it?
- Inside that file was another file. That's strange. Usually files don't contain other files (unless it's zip-file or something like that). What was that other file? What program did you use to open it?
- How do you mean a file "says" something? Somehow, I don't think it was an mp3-file that said "debug!" on your speakers, but I might be wrong.
- Did those files (the file on the dvd and the file inside it) have a creation and a change date? If so, what?

Kees

- Collapse -
Sorry...should've been more clear.

In my haste to get this posted, I wasn't at all clear nor did I use the right terminology. Thanks for responding so quickly. The pop up didn't "say" anything, it was written as a full page description. I just remembered that I still had the number in my phone and googled it. Others posting about this number reminded me of some of the content. The message identified me as a century link customer (which is my internet provider) and that I had pop up issues which needed to be fixed and to call to get it squared away. In the past I've had problems with other sites since I use pop up blockers and some content won't load on various web sites. The pop up and message was essentially the same each subsequent time I tried to click on a link for Ancestry or any other web site from that point on but the phone number changed each time.

Once I realized my stupidity and kept having problems I knew I'd need to format the laptop because no virus software or malware was ever detected. I created dvds from my desktop files that were in the old laptop. Inside the desktop tax file folder there were copies of previous returns. The system restore had problems (but that's another story) hence the purchase of the new laptop.

I loaded the dvd that contained the tax folder (as well as other files from the desktop) in the dvd drive today. I opened the dvd from drive and all my folders were listed and contained what was expected. I opened the tax folder and inside that there was a text document (not a folder as I first wrote) named as "debug", When I opened that document what was inside were the words [0409/133412:INFO:(0)] WebCore is now online. [0409/133412:INFO:(0)] Running Awesomium 1.7.4.2 It was dated 4/9/15, the same day as the call I made. The files that I copied to the dvd were dated with various dates but all the folders were dated 4/10, the day I created the dvd. I hope that explains it better.

- Collapse -
Re: debug

That seems some kind of log file. Log files don't contain anything harmful. And since you did whatever you did on the old laptop, and not on the new one, nothing is wrong.

You do run an antivirus on your new laptop, don't you?

Kees

- Collapse -
I use Kaspersky Pure 3.0 and ...

I used 4 or 5 malware detection programs in trying to find the problem. There were no detections. My program file didn't have anything unexpected. As mentioned in response to Bob Profitt's reply, where did the files go? There was never a debug document in the folder before. I didn't look into each folder before I copied them but no other folders so far are missing any content. There's no one else but my husband and me in the house. The laptop never leaves home and I know he has zero interest in tax files. They shouldn't have disappeared. Did my inputting a code when I was on the phone give the person on the other end access to my computer despite the fact that I shut down the laptop right away?

- Collapse -
Re: files

No, they shouldn't have disappeared.

What website did you go to, when that pop-up came? What did that popup exactly say? What kind of code did you type in on that website? It could be one of those scams indeed. So it was a good idea to shut down.

But it's somewhat unlikely that whatever malware was on that old laptop came via those DVD's to your new laptop. Although, of course, only you know what exactly you put on those DVD's with what program and what you did with them on your new laptop.

Kees

- Collapse -
No what I was wondering...

The person on the phone first asked me to type in a web address. On the page that came up I typed in a code that was about 8 or 9 digits with dashes in between them.

I know in my anxious state I'm probably not explaining myself well. I opened the tax files a few weeks ago and all the content was there. I didn't open it again right before I copied it to the blank DVD. I'm wondering if it's possible I gave remote access and the person opened my files and took out the tax files and anything else they wanted.

I know copying DVDs is old school. I didn't have enough space on my portable hard drive and it was midnight and the DVDs were handy.

I have a back up from a few months back on the portable hard drive. The old laptop was Windows 7 home premium. Then new laptop is Windows 8.1. Is there a way to extract the files onto this laptop to view and find the tax files?

- Collapse -
corrupted tax filing

I've used turbo tax for years. BUT this year the initial preparation of the 1040 was $4000 off. My tax planning is very accurate. I waited a bit, then used the hands on feature. The ensuing results were as predicted. WEBCORE is a virus, but it benefits the United States Treasury. Frankly, I am surprised that now average citizens consider themselves too ******** to use paper filing forms yet alone FREE tax prep. Just for grins, I am only 62 years old. greg

- Collapse -
paper files means the refund takes longer

paper filing means it will take longer to get a refund and more likely to have errors. It has absolutely nothing to do with the persons ability or age.

- Collapse -
I Know A Number Of Folks That Use The Paper Method

Family members, etc. Usually it's because their tax computatitions are extremely easy and only require 1040EZ forms.. But even with that version, you can still have the refund deposited directly into you bank account. It usually only takes two or three weeks for the refund to be deposited.

Hope this helps.

Grif

- Collapse -
I had this problem show up today

I was playing Canasta on Pogo.com when suddenly my screen started flickering between two open windows for the game. I had to close the browser and found a 'debug' text file on my desktop. the contents read as follows:
[0228/121118:INFO:(0)] WebCore is now online.
[0228/121118:INFO:(0)] Running Awesomium 1.7.5.1
[0228/121121:INFO:Awesomium.NET(0)] Registering Javascript Callbacks
[[0228/121118:INFO:(0)] WebCore is now online.
[0228/121118:INFO:(0)] Running Awesomium 1.7.5.1
[0228/121121:INFO:Awesomium.NET(0)] Registering Javascript Callbacks
[0228/121123:WARNING:Awesomium.NET(0)] System.TimeoutException: The operation has timed out. The child process or the I/O thread, are busy. Please try to create the object again.
at Awesomium.Windows.Controls.WebControl.CreateGlobalJavascriptObject(String name)
at Awesomium.Core.JavascriptHelper.Register()
[0228/121123:INFO:Awesomium.NET(0)] Registering Javascript Callbacks
[0228/121333:INFO:Awesomium.NET(0)] Destroyed View: 101


I saw a similar debug file on the desktop of my sister's win 10 laptop last week.

While I have no idea what this means, I would recommend blocking Awesomium.net in your firewall/antivirus program.

- Collapse -
Re: awesomium.net

There's a good chance it's not the website (then the blocking doesn't have any effect), and there's a good chance that if it is a website and you block it, your game doesn't work anymore.

- Collapse -
Answer
Sounds OK.

I'd check my Add/remove programs control panel and remove this. https://www.google.com/search?q=Awesomium&ie=utf-8&oe=utf-8 finds it's a tool used by many legitimate apps but it's blown up so you need to uninstall that.

This is used for TurboTax too.

As to the browser, RESET YOUR BROWSER to clear that up. Since I don't see which browser I can't be more specific.
Bob

- Collapse -
The tax files used to be in that folder

Unfortunately, with the old laptop erased of content, I can't recover anything beyond the dvds of files I made. I'd opened the tax files a few weeks ago and used them so I know they were in there. I don't know what happened to them and why the text document mentioned above is in it's place. That's the scary part.

BTW, I just found out I still have problems on Chrome on my new laptop when signed into my email address. I had to sign in under my husband's email address or the same messages come up. I'm not usually this stupid and gullible but I seem to have fallen into a rabbit hole this time.

Thanks for any assistance.

- Collapse -
Did you RESET your browser...

as Bob suggested?
Dafydd.

- Collapse -
Re: tax files

Why did you erase the old laptop? As long as it is turned off, everything on it is totally harmless, and if it really has some virus (which is far from sure if I read your story), you can safely get your other files off by booting to some Linux disk. Now it seems you lost them.

You use Chrome on your new laptop. Did it come with it or did you install it yourself? Then you sign into an email address (or you sign in under an e-mail address). What do you mean with that exactly? And then you get some message, but you didn't tell what messages.
Did that happen also before you copied your files back from those DVD's? That wasn't so urgent, I think.

Two other remarks:
- Burning files to DVD is rather old-fashioned. The last 10 years or so most people use USB-sticks to copy files between machines.
- Don't you have a backup of those tax-files? Do you make a backup at all?

Kees

- Collapse -
Answer
Reassurance on that webcore message...

I realized in reading this string that most comments/answers were directed at your backup strategies, etc. I wanted to address what innocent action you might take that results in this specific download and message. Webcore Awesomium is a "helper" program that helps browsers do certain things. If a website says "do you want to view this document in a more readable form (Acrobat PDF), (which often makes it easier to print) and you say "yes" , this little program will facilitate that because the page you are viewing in your browser is optimized for viewing online and not for viewing as a standalone doc that could also be printed easily.

I realize that other actions you took (such as being given a new URL to type in) were troubling, but I wanted to reassure you that if you were checking your download file today and saw this message again (likely in a "note" type file), there might be a legit reason for it.
I wish you the best for a Happy New Year.

- Collapse -
But why do we keep seeing the note?

I keep seeing the same txt in a note on notepad. It pops up periodically on my desktop. There is no "Webcore" or "Awesomium" to uninstall in the Control Panel. Anyone know why the note message keeps popping up? That's the disconcerting part but I too have not seen anything else about it to worry about. Thanks

- Collapse -
Time to hit this other forum.

Bleepingcomputer has a process where they have you run other scans and sometimes if it's benign they'll tell you so. Time to get in line.

- Collapse -
Answer
No.
- Collapse -
Answer
Advice virus

I think you need to be careful when visiting the pages of the website , because today there are many website attached malicious viruses , I have to remember the previous phase 1 website , and also click on it with all information in the computer my are stolen every since then I never slid on the website again.

Font Coding Edited By Moderator.

Post was last edited on September 19, 2016 9:40 AM PDT

- Collapse -
Answer
awesomium is a sdk for C++ and .net languages

It is to help view html pages so the virus is properly called webcore and have you checked if it is a virus it might be a program that has to be repaired.
Useful Links:
Microsoft answer
TurboTax AnswerXchange
Another TurboTax AnswerXchange

Also Try Searching for it in task manager and startup files.
Also if your really worried take it to a place that can remove it or put Linux on it or buy a raspberry pi and use that.
Raspberry pi pc

- Collapse -
Answer
It's from a Quicken component

This log is generated from Quicken. I don't know what setting to use to move it elsewhere

- Collapse -
edit:

To get rid of it, delete your Quicken desktop shortcut, and create a new shortcut on the taskbar.

It's possible other software causes this, it's "Awesomium", same answer, move the shortcut to the taskbar.

- Collapse -
Answer
I've come across this "debug" file.. in my tax folder

After much research & forums, i have learned its a helper file of sorts for easier/quicker viewing or printing of files. I found it in my turbo tax folder.. here is what the turbo tax site says about it..

"TurboTax AnswerXchange Home
TurboTax FAQ TurboTax FAQ

TurboTax for Windows Creates Cache Folder and Debug File in Tax File Save Location

You may have noticed a couple files located in the same folder as your .tax file that you saved. There is a file folder called Cache and a file called Debug saved there.

These files are TurboTax configuration files, and pose no harm to your system or your tax file. You shouldn't experience any problems if you accidentally delete them either, we just wanted to make sure you knew they were ours and there is no issue caused by them."

CNET Forums

Forum Info