When I launched ISESteroids (Start-Steroids), I clicked its update option and Chrome warned that the destination website was unsafe. I continued anyway, after which Avast-style pop-ups appeared repeatedly claiming that the computer was infected and lacked antivirus protection. Closing Chrome, clearing cookies and the temporary directory, and rebooting did not stop them. Task Manager and Sysinternals Autoruns also didn't reveal an obvious process launching the alerts. While preparing a Veeam Agent recovery USB, I checked Chrome's extensions and found one I didn't recognize. I removed it, rebooted, and the pop-ups disappeared, so a restore was no longer necessary. Has anyone seen this behavior, and what should I check next?
4 Answers
The unfamiliar Chrome extension may have been responsible, especially since removing it fixed the problem after a reboot. Check the extensions list, notification permissions, startup pages, and installed applications for anything added around the same time. Run a full scan with a trusted, up-to-date security tool as well.
Assume that anything entered or stored on the machine could have been exposed until you know more. From a clean device, rotate important passwords, API keys, certificates, and other credentials kept in scripts, configuration files, or environment variables. Also review sign-in and access logs for anything unusual.
The update source is worth treating cautiously. If the project’s website was compromised or its domain was redirected to a scam page, an update package could potentially have been tampered with. I’d avoid launching that updater again until the publisher verifies the release and its hash or signature.
Check the browser’s notification permissions. A site may have been granted permission to send notifications, which can produce convincing fake virus warnings through Windows even after the browser window is closed. Remove permissions for anything unfamiliar, then clear the browser’s site data.
The unusually long gap between module updates and the recent update are both reasons to investigate, although they don’t prove the package was compromised. It’s safest to download only from a verified source and compare published checksums.