Re-install ChromeUnless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.
1. If you have bookmarks, let's save them by exporting them -
Export Bookmarks2. Then I need you to go
Google Sync and sign into your account
3. Scroll down until you see the
"Stop and Clear" button and click on the button. At the prompt click on
"Ok"4. Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here -
Google Chrome6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.
THENCAUTION : This fix is only valid for this specific machine, using it on another may break your computer Open
notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
ShellIconOverlayIdentifiers: [1SecureIconsProvider] -> {FC9D8189-520A-4417-AED7-9EAC810C6FBA} => C:\ProgramData\Microsoft\Secure\Icons\SecureIconsProvider.dll [2014-11-03] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-812850279-2120288313-3926495763-1120\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.<html>
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.<html>
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.<html>
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.<html>
HKU\S-1-5-21-812850279-2120288313-3926495763-1120\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.<html>
BHO: Searoch-NeeWTab -> {000A4B1A-237B-A38C-206A-177A6B0B0980} -> No File
BHO: UTuberuAdBllockker -> {0C8754A2-DAE5-7227-F14C-8868748FD13D} -> No File
BHO: YoutubeAdblocker -> {31F781AE-406A-4740-9137-5DCB9BBA5B80} -> No File
BHO: greatSAuver -> {B72C4728-E3B7-F21B-A6E1-FAB34D104FBD} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
BHO-x32: No Name -> {CDF4F5C0-010C-1618-54F3-616874662DF6} -> No File
BHO-x32: No Name -> {D5974A72-C81C-4DC3-BE77-A8A7BBC8864E} -> No File
BHO-x32: No Name -> {FF6C3CF0-4B15-11D1-ABED-709549C10000} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Winsock: Catalog9 01 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 02 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 03 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 04 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 05 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 06 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 07 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 08 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
Winsock: Catalog9 20 C:\Program Files (x86)\SpeedBit Video Accelerator\SBLSP.dll [168136 2012-03-27] (SpeedBit)
FF Homepage: hxxp://www.<html>
FF user.js: detected! => C:\Users\pkabiaru.THENEST\AppData\Roaming\Mozilla\Firefox\Profiles\alw7ciai.default\user.js [2015-04-28]
CHR HKLM-x32\...\Chrome\Extension: [ffdcfjdljhbehggjdkdioajnknjcpbjb] - No Path Or update_url value
2015-04-01 18:19 - 2015-03-28 21:41 - 00000000 ____D () C:\ProgramData\{98094f2b-d1f0-b7fc-9809-94f2bd1f3caf}
2015-04-01 18:19 - 2015-03-28 21:35 - 00000000 ____D () C:\ProgramData\{031296a2-ee5f-eb40-0312-296a2ee55a8b}
Task: {55009867-850C-471D-B07C-417B655587F1} - System32\Tasks\SBWUpdateTask_Time_7c4e86d4-001E101F50A4 => C:\Program Files (x86)\Common Files\Speedbit\SbUpdate\SBUpdate.exe [2014-05-06] (Speedbit Ltd.) <==== ATTENTION
Task: {72A7A784-DE03-402E-82D8-21C73499A8F0} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {85AE1C6D-C69C-484D-9595-F5875D627C04} - System32\Tasks\SBWUpdateTask_Logon_7c4e86d4-001E101F50A4 => C:\Program Files (x86)\Common Files\Speedbit\SbUpdate\SBUpdate.exe [2014-05-06] (Speedbit Ltd.) <==== ATTENTION
Task: {939A6786-446C-414C-844E-21FC7A72B9C6} - System32\Tasks\SBWUpdateTask_Time_7c4e86d4-E4D53DBCF922 => C:\Program Files (x86)\Common Files\Speedbit\SbUpdate\SBUpdate.exe [2014-05-06] (Speedbit Ltd.) <==== ATTENTION
Task: {975B44CF-7170-46BF-BD35-F05B85C02C02} - System32\Tasks\{7105C198-2CF3-4A5F-9DCB-F75C6E8E45AD} => pcalua.exe -a "C:\Program Files (x86)\Optimizer Pro\OptProUninstaller.exe" -d "C:\Program Files (x86)\Optimizer Pro"
Task: {EDD631B8-DB4D-4F60-8FDC-CC5EDC8E6A4D} - \BitGuard No Task File <==== ATTENTION
Task: {F78E667D-CF97-4637-849F-72CA0208C6C4} - System32\Tasks\SBWUpdateTask_Logon_7c4e86d4-E4D53DBCF922 => C:\Program Files (x86)\Common Files\Speedbit\SbUpdate\SBUpdate.exe [2014-05-06] (Speedbit Ltd.) <==== ATTENTION
Hosts:
C:\ProgramData\Microsoft\Secure
C:\Program Files (x86)\SpeedBit Video Accelerator
C:\Program Files (x86)\Common Files\Speedbit\SbUpdate
C:\Program Files (x86)\Optimizer Pro
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as
fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
NEXTPlease download
AdwCleaner by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S0].txt as well.
