error while cleaning, Event occurred on a new file created by iexplore.exe

[Ma3243 0]

Hi,

 

when visiting a certain web page with IE, I am getting "error while cleaning", "Event occurred on a new file created by the application: C:\Program Files (x86)\Internet Explorer\iexplore.exe" from Nod32. When this pop-up appears, I select "Delete" from the options offered, which seems to succeed. When visiting this site again, the same thing happens. This started two days ago and from then on I am always getting this error when going to this site with IE. The same thing happened when visiting one other web site with IE. Going to other sites causes no such error message. This is the relevant line in the log file (I just replaced real username with <username>):

 

27.9.2017 7:56:46 Real-time file system protection    file      C:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PM434MSX\addthis_widget[1].js JS/TrojanDownloader.Pegel.BH trojan deleted      <username>  Event occurred on a new file created by the application: C:\Program Files (x86)\Internet Explorer\iexplore.exe (6E59DB3532A3371D53FEF1D2BA12E548D583FFC1).      12FB3B97A3308B429C6EF44CB8E6A52875E7D85F  27.9.2017 7:56:15

 

I can see no such file in Windows Explorer (Show Hidden Files, Folders, and Drives option is enabled). In fact, there is no "Temporary Internet Files" folder in "C:\Users\<username>\AppData\Local\Microsoft\Windows" at all.

 

This is a Windows 7 machine, Windows updates are installed. System restore to last week did not help. Nod32 smart scan found no threat (virus signature database is 20.9.2017). I tried using Eset online scanner, which performs an in-depth scan and has the latest virus signature database but it also found no threats.

 

Is my machine infected or is this a false positive? I am not sure what to do so if anyone could help me I would really appreciate it.

[Marcos 5,298]

Please continue the discussion in the existing topic here: https://forum.eset.com/topic/13244-addthis_widgetjs-alert-spam/

To prevent duplicate topics, we'll draw this one to a close.