Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

[HKEY_CURRENT_USER\Software\Microsoft\Windows\


  • Please log in to reply
2 replies to this topic

#1 doubleohseven

doubleohseven

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:01:33 PM

Posted 27 March 2015 - 07:33 PM

CurrentVersion\Explorer\FileExts\..json

 

Hi Every and hope your having a good weekend,

 

I have found a file on the desktop that litteraly tracked my phone on gmail account settings and it was called marionette.js

 

I then tried to copy the folder but ended up with just a text doc that was static.

 

I then did a reg clean with cc and found this title and it said that this is a file left over after uninstallation.

 

I did superantispyware.... nothing but have been sure about one thing...everwhere I go and log into gmail on iphone....its on the account and that means the .json means someone cloned mt gmail?!!!!

 

or am I eating too much brownie?

 

im totally os challenged and only kmow how to text or dial from 1-9...help me out?


Edited by hamluis, 28 March 2015 - 05:43 PM.
Moved from Win 7 to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,400 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:33 AM

Posted 28 March 2015 - 12:39 PM

What Is Marionette.js?

 

I see no reason at all why any files pertaining to this should be on your desktop

 

Louis



#3 doubleohseven

doubleohseven
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:01:33 PM

Posted 28 March 2015 - 01:07 PM

Hello thank you, here is the update...

 

the registry key is left over from a javascript program called marionette that clones gmail accounts with no trace of doing so

 

look up marionette.js online and you will see it is not very common but does exist

 

HOW CAN I SEE IF ANY SPYWARE IS HIDING BEHIND CSRSS.EXE OR OTHER WINDOWS OR BETTER

 

HOW CAN I SEE IF MY WINDOWS 7 NETBOOK 32BIT IS RUNNING SPYWARE KEYLOGGED ETC?

 

The folder on the desktop had .json files, its gone, I tried to save it but it only gave me one page of code where I could read marionette.js therefore looked that up....

 

todays quote....you may be done with the past, but the past ain't done with you" kill bill 2?

 

thanks!

 

Mod Edit:  Moved to Am I Infected - Hamluis.


Edited by hamluis, 28 March 2015 - 05:44 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users