I can't remove "Savings Wizard" of chrome

[kuttus]

Go to the location C:\Users\Fran Ramon\AppData\Local\Google\Chrome\User Data\Default\Extensions and check if there is any folder called ajakpekbmnkgnjbpajgkdhimcbeoocam

If yes delete it.

 

[Dioniso]

I've done it, several times... but the malware that create the extension folder is located in other folder that I don't know, for that I can't attack the cause, only the consequences.

 

[kuttus]

How comfortable you are with Windows Registry editing?

 

[Dioniso]

Sometimes I use the windows registry editor, but obviously I'm not an expert.

In the windows registry editor I've searched the name "savings wizard" and "ajakpekbmnkgnjbpajgkdhimcbeoocam" but I didn't find anything.

I don't know why the folder "C:\Windows\SysWOW64" is opened by itself.

In that folder, "C:\Windows\SysWOW64", I've found 4 strange files of 100mb each one with a chinese name, I've just deleted them.

PD: I've restart and windows looks without changes, the malware continues being in chrome extension.

 

[kuttus]

Okay. Please back up your Bookmarks in GOogle Chrome.

1. Click the Chrome menu
   
   on the browser toolbar.
2. Select Bookmarks.
3. Select Bookmark manager.
4. Click the Organize menu in the manager.
5. Select Export bookmarks.

Chrome will export your bookmarks as a HTML file, which you can then import into another browser.

Find the steps here : https://support.google.com/chrome/answer/96816?hl=en

 

[Dioniso]

Done, now what I have to do? Do I have to give up chrome and install a new explorer?

 

[kuttus]

Reset your browser settings:

1. Click the Chrome menu
   
   on the browser toolbar.
2. Select Settings.
3. Click Show advanced settings and find the "Reset browser settings” section.
4. Click Reset browser settings.
5. In the dialog that appears, click Reset.

 

[Dioniso]

Done! And now the malware is active again.

[url=http://postimage.org/]
subefotos[/URL]

 

[TwinHeadedEagle]

Hi, Kuttus is away, I'll continue with you.


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[Dioniso]

I've done it, look in the first of this thread.

 

[TwinHeadedEagle]

No, I need new and fresh report.

 

[Dioniso]

Okay, done.

 

[TwinHeadedEagle]

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.

 

[Dioniso]

This time it seems that the effects or consequences of the virus has been attacked directly, now I don't see the extension "savings wizard" in chrome extensions neither in chrome://policy , It seems all has been repaired correctly because I’ve reinstalled the chrome again to be sure that It didn't appear and effectively It didn't appear

I suggest you modify this tutorial: http://malwaretips.com/blogs/savings-wizard-removal

Thank you very much for your help!

 

[TwinHeadedEagle]

Good, any other problem, or we can finish?

 

[Dioniso]

All okay! Thank you again!

 

[TwinHeadedEagle]

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.