How to remove Critical Chrome Update virus

Critical Chrome Update is the fake alert that drops Kovter.C malware on the computer

Critical Chrome Update is the scam that displays fake alerts about the needed browser or system updates and this way tricks people into installing other possibly malicious programs to the computer. If you are constantly redirected and such pop-ups go to your screen repeatedly, you should check your computer for Chrome virus – a potentially unwanted program that can be secretly running on the system. 

Note that Critical Chrome Update virus is totally malicious as it can emerge on your screen after clicking on one of Traffic Junky ads.^[1] This ad-supported network is known to be serving promotional content on adult-only websites, and therefore visitors of these domains fell victims to KovCoreG malvertising attack^[2] that pushes Kovter virus to victims’ computer. Installation of severe malware as such can also be a result of constant alerts about alleged updates.

Critical Chrome Update scam is a social engineering attack or a campaign based on technical support scam tactics. Unfortunately, such messages and various alerts can lead to the installation of rogue tools, applications, useless programs.

However, scams like this, in most cases, deliver messages and redirect to questionable or even malicious domains as hosts:

• iexaidlepro.org
• johphblogger-hints-and-tips.org
• tahxiintimes-niedersachsen.org

These pop-ups can also provide messages with phone numbers that claim to connect victims with the technical support team. Nevertheless, they are fake, and official technical support services are not delivering messages like this, especially are not encouraging to call questionable numbers. As a result, remove Critical Chrome Update virus without interacting and calling the provided number or contacting people behind the threat in any other way.

To go back to your previous browsing, get an automatic anti-malware tool and clean the machine fully. The proper scam removal requires tools like SpyHunterCombo Cleaner, MalwarebytesMalwarebytes so that the system gets fully recovered.

A detailed scheme of the Critical Chrome Update scam functionality

After managing to compromise the Traffic Junky ad network, which serves ads via popular adult-oriented sites such as Pornhub, cybercriminals are now capable of serving deceptive via common web pages. As a result, unsuspecting users can easily get infected with click-fraud malware known as Kovter Trojan.

Users who click on such ads are exposed to a malvertising attack that redirects them to deceptive pages that are picked based on their web browser used. Following the browser type and version, victims receive bogus offers to install one of these updates:

• Critical Chrome Update
• Critical Firefox Update
• Adobe Flash Player update (Microsoft Edge/Internet Explorer users).

The final alert is picked using a JavaScript code that is the same as the one used in Neutrino and NeutrAds.

Research reveals that the attack chain starts with a redirect from advertisingms[.]com domain which corrupts the final link and throws the victim to a compromised malware-serving site. According to Proofpoint, this domain “inserts a call hosted behind KeyCDN,” which happens to be a giant content delivery network.

Critical Chrome Update scam suggests installing an update for the popular web browser, however, instead of updating the browser, it drops a ZIP archive that contains a runme.js file. Once executed, it addresses the server responsible for the social engineering attack.^[3] The .JS file the downloads two files to victim’s computer – .flv and .mp4 format file.

FLV file consists of three random digits, and the rest of them belong to an RC4 key. The MP4 record is encrypted with this key and hex-encoded. The MP4 file also stores a Powershell script that contains shellcode used to download and execute AVI file (Kovter virus).

Particular functions of the virus

Once executed, Kovter virus establishes itself into Windows Registry rather than dropping some files on the system. This way, malicious software attempts to avoid detection. Besides, the virus sets up specific autorun entries, which runs the malware as soon as the victim starts the computer.

The malware operates silently, and the only noticeable problem is a slight decrease in the computer’s performance. However, the majority of users might not suspect anything if they do not have anti-malware programs installed on their PCs.  

It is possible to notice and avoid possible infections

Dieviren.de team says^[4] that the trick to avoid installing the malicious Critical Chrome Update or Urgent Chrome Update, as well as malware delivered via deceptive versions of Flash Player or other well-known programs is to never install updates from random Internet sites.

Although cybercriminals use various techniques to trick victims into clicking on malicious advertisements, the method that is based on fake “updates” is actually very common and can be recognized easily. Such a technique mainly gets used to deliver more severe malware and directly infect the machine with threats.

When deceptive advertisement looks legit and includes official logos of the promoted software, it seems to be trustful and people tend to click on such content. However, you should never rely on the pop-up that claims you need to install or update anything randomly. The official software creators and providers are not showing such messages on browsers.

If you suspect that you need an update for Chrome – simply visit the official browser’s developers’ site and check whether there is an update available. However, when installing an application or direct program/ software update be aware of the additional installations. Choose Advanced or Custom options to avoid any unwanted applications. 

Remove Kovter.C virus and stop the scammy messages

If you were redirected to a site containing Critical Chrome Update virus, close the web page immediately. If it downloaded the malicious ZIP file to your computer automatically, do not open it and delete it as soon as possible.

However, if you launched the deceptive record, run anti-malware software as soon as you can (ideally, do it after performing a clean system boot).

To finish the removal, update your anti-malware software and scan your computer several times. It is essential to delete Kovter Trojan as soon as possible as it can perform a series of illegal activities on your computer.

You should remove virus with updated anti-spyware to be totally sure that all the related files, applications, and even malware get eliminated during one system check.