Can't remove UtubeADBlock extension from Chrome

[The_Mask]

Like I said in the questions. I first noticed there was a problem when chrome would open a webpage and tell me I was infected and to call whatever number. I closed it immediately everytime and I have followed the guide associated with removing the extension. However, it didn't work. I've removed a lot of threats from my computer. HitmanPro even detected FLV Player when my control panel didn't so I had it removed. The extension is still there though and I'm unsure how to get rid of it. I'm contemplating a full wipe of the hard drive and a clean OS install if I can't remove the virus soon.

 

[TwinHeadedEagle]

Hi,

Can you take a ScreenShot for me to see.

 

[The_Mask]

I tried just following the web address I provided but its just a blank page. It seems to trigger randomly and when it does that's when the page loads in and I can see the false alert.

 

[TwinHeadedEagle]

Type chrome://extensions and take a ScreenShot of that Windows...

 

[The_Mask]

Here you go.

 

[TwinHeadedEagle]

Please download zoek.zip or zoek.rar by smeenk (

) from here or here and save it to your Desktop.
Unpack the archive...

• Close any open browsers
• Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:
  
  

  pibihmlifcaffllogohcppampjdjknfn;a
  UTubeADBlock;z

• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"

 

[The_Mask]

Ok so I ran the script and got two errors. I attached a screenshot of them in addition to the log file.

 

[TwinHeadedEagle]

Ok, let's try to remove it

Run zoek again, but now with this script

C:\ProgramData\UTubeADBlock;fs
C:\ProgramData\YoutubeAdblocker;fs
C:\Users\All Users\UTubeADBlock;fs
C:\Users\All Users\YoutubeAdblocker;fs
C:\Users\Matt\AppData\Local\Packages\windows_ie_ac_001\AC\{7413E51F-D04A-5155-1D17-71BAC324E14A}\YoutubeAdblocker.2.7.dat;f
C:\Users\Matt\AppData\LocalLow\{7413E51F-D04A-5155-1D17-71BAC324E14A}\YoutubeAdblocker.2.7.dat;f
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\{CA42BBF6-6650-A15A-BBCD-9ED0A307C257}\UTubeADBlock.2.7.dat;f
autoclean;
emptyalltemp;
emptyclsid;

 

[The_Mask]

alright, here is the log file and I got another two more errors. One was the script error from last time and a new registry edit error attached below.

 

[TwinHeadedEagle]

Ok, how is the situation now?

 

[sissy]

The same thing happens to me , I was infected to install a video codec , even though the options unchecked my PC was flooded with malicious programs that could remove , along with others who did not know he had, with his tutorials ( thanks a lot ! ) But damn extension is there as you mocking me ! She has full access my settings and deleted all my extensions and speed dial and installed extensions and links to their websites friends . I tried to find the id number in the programs folder but not found in the system folder permission , to me , only the owner of this notebook ! , I was denied ! As I did this before and had given me permission earlier, I think the extension has anything to do with it , is it possible? also tried to find a clue in the source code but did not find , do not know what else to do but erase the HD even by uninstalling and reinstalling chrome did not solve the problem . ( please excuse my bad english ! )

As you can see in the image on the message extension says (in Portuguese ) ' this extension is managed and can not be removed or disabled '. It is impossible to clear the disable option, you can not tell from the picture but it is shaded, whitish.

I'm furious at the audacity of these people !

[/URL][/IMG]

 

[The_Mask]

Ok, how is the situation now?

It's still there

 

[TwinHeadedEagle]

Let's try Zoek script once more

kbpdoenkoedoobdaalkkihnhjgekmoeg;a
kbpdoenkoedoobdaalkkihnhjgekmoeg;z
YoutubeAdblocker;z

 

[The_Mask]

Here is the log file. Also got the first set of errors again.

 

[TwinHeadedEagle]

We will try with more powerfull tool:


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[TwinHeadedEagle]

That's good, but you should follow my instructions, maybe there is still something left...

 

[The_Mask]

Here are the logs

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.




Please download aswMBR and save it to your desktop.

Double click aswMBR.exe to start the tool.

• Select Yes if prompted to download the Avast database.
• Click Scan
• Upon completion of the scan ( Scan finished successfully ) click Save log and save it to your desktop, and post that log in your next reply for review.
  Note: do NOT attempt any Fix yet.

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Here are the logs. I already ran the adwcleaner before I started the thread so I attached that as well the one I just did.

How is the situation now?

It's still there

 

[TwinHeadedEagle]

Can you take one more Screen Shot of this extension for me to see...

 

[The_Mask]

Here it is again

 

[TwinHeadedEagle]

Download fresh version of FRST from here

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

FRST is updated to fight these extensions. Open, press Scan and attach produced report.