Solved GoSave 2.0 keeps coming back on my Chrome

[Ellie Otani]

Zoek.exe v5.0.0.0 Updated 29-11-2014
Tool run by Ellie on Wed 12/03/2014 at 1:09:19.49.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ellie\Desktop\zoek.exe [Scan all users] [Script inserted]

===== Runcheck 1:11:22.98 =====

--- Create Environment Variables 1:11:24.82
--- Create System Restore Point 1:11:32.41
--- Checking Input 1:11:54.85
--- AU AppData Check 1:12:07.17
--- Remove From Windows Installer 1:12:11.58
--- Empty Folders Check 1:16:21.44
--- Registry HKLM Software Check 1:16:21.47
--- Quick Launch Shortcut Check 1:16:50.00
--- IE Startpage Check 1:17:04.48
--- Program Files DB Check 1:19:41.65
--- C:\Users\Default\AppData\Roaming DB Check 1:21:45.28
--- C:\Users\Default User\AppData\Roaming DB Check 1:21:45.28
--- C:\Users\Ellie\AppData\Roaming DB Check 1:21:45.28
--- C:\Windows\SysNative\config\systemprofile\AppData\Roaming DB Check 1:21:45.28
--- C:\Windows\sysWoW64\config\systemprofile\AppData\Roaming DB Check 1:21:45.28
--- C:\Windows\serviceprofiles\networkservice\AppData\Roaming DB Check 1:21:45.28

 

[argus]

Helllo,

Before we begin, please note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The logs can take some time to research, so please be patient with me.
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
• Instructions that I give are for your system only!
• Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
• Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
• Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[Ellie Otani]

Thank you for your help. I also noticed that the programs I disabled from the start-up list. such as "Pokki" keeps coming back in the list. I appreciate your help. Logs attached.

 

[argus]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.



Uninstall Chrome


Chrome installation is altered by malware. Reinstall is needed.

Close all Chrome windows and tabs.
Go to the Start menu > Control Panel.
Click Programs and Features.
Double-click Google Chrome.
Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.

 

[Ellie Otani]

Thanks. I left the PC at home and came to work. I will try to de-install and re-install the Chrome tonight and let you know how it is. Is there any way to confirm the virus is removed? Should I run the Farbar recovery scan one more time?

 

[argus]

No, just uninstall Chrome.

 

[Ellie Otani]

I could not uninstall Chrome with Start menu > Control Panel> Programs and Features. Attached message came up and said Chrome is in use, but Chrome is used only with the message itself and nothing to close. I used IObit power installer and deleted all Chrome related files and down loaded Chrome and re-installed. The book mark came back and so as GoSave!!

I still have Pokki in my start menu (in msconfig), but I do not see it if I use autoruns.............. So, I cannot delete it. I am puzzled.

 

[argus]

Turn off Chrome in Task Manager

or

Download Revo Uninstaller
http://www.revouninstaller.com/start_freeware_download.html

Uninstall Chrome

Scan with Farbar Recovery Scan Tool
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[Ellie Otani]

Thank you for your time. Scan reports are attached.

 

[argus]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Ellie Otani]

I completed the task you instructed and attached the Fixlog.txt.

 

[argus]

Is everything ok now?

 

[Ellie Otani]

I just ran the fix program you sent me. The Chrome is still showing GoSave 2.0. Should I now uninsall and reinstall Chrome to see if GoSave is gone?

 

[Ellie Otani]

Hi, Argus. I could uninstall chrome with browsing data. When I got the Chrome running message, I opened up task manager and killed all Chrome related programs running. After I completed the uninstall, I downloaded the latest Chrome, but I cannot complete the installation. See the message. Now what should I do?

 

[Ellie Otani]

This is the log of the Chrome installation error by "sawbug" Chrome suggested to take.

 

[argus]

Uninstall Chrome

Chrome installation is altered by malware. Reinstall is needed.

Close all Chrome windows and tabs.
Go to the Start menu > Control Panel.
Click Programs and Features.
Double-click Google Chrome.
Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.

 

[argus]

http://www.revouninstaller.com/start_freeware_download.html

Revo uninstaller

 

[Ellie Otani]

I will run Revo uninstaller and try to re-install Chrome tonight. Thanks.

 

[Ellie Otani]

I could re-install Chrome and no more GoSave. I could also remove all Pokki files (including start-up) using Revo uninstaller. Thanks a lot. Now my PC is clean and crisp

 

[Ellie Otani]

Hi, Argus. Can you help me again? You fixed my daughter's PC with GoSave Chrome extension. I now struggle with my son's PC with persistent BuyNSave extension. I ran Malwarebytes, SuperAntiSpyware, and ADW Clearner, forced uninstall Chrome, but I cannot install Chrome again. I rolled back the system before I ran ADW cleaner, but Chrome still does not work. I think I changed internet setting, as I am getting internet connection errors and HTTP 403 errors. Can you help with this issue?