Solved chromesearch.today hijaked Google Chrome

[Tyburne]

Hi there,

through tiredness fueled stupidity, I accidentally installed an infected Extension when searching for a special piece of software. Thus, chromesearch.today hijacked my browser and searching as well as any attempts to fix it myself didn't yield any kind of proper result, so I really need some proper help.

So far, uninstalling Chrome, resetting Chromeand running adwCleaner or Malwarebytes did nothing after the initially found extension, though there seems to be some residue, that installs chromesearch.today as a locked search engine for Chrome upon reinstalling.

Attached you will find the FRST Report!

 

[TwinHeadedEagle]

Hello,


Is this a company/business computer?

 

[Tyburne]

No business computer. Just my private gaming desktop at home. Other than that just a VPN Client and CAD/CAM software for university (I study mechanical engineering).

 

[TwinHeadedEagle]

That's fine. Is this extension still present?

 

[Tyburne]

The extension (Bitmotion New Tab Extension) itself is gone, and I don't get the Bitmotion New Tab Page anymore, but within googles settings the search engine is still locked in as chromesearch.today and can't be changed. The New Tab Page still differs from the original google one, too (lacking the google logo).

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.



When the fix is done, you will find Date|Time archive on your Desktop.

Please upload it via this link:

Submit a Malware Sample

 

[Tyburne]

Done, at least I hope so. FRST installs as a German version on my machine, so I tried "entfernen" (delete), as there is no "fix" button.

 

[TwinHeadedEagle]

I need this file from your Desktop uploaded.

26.10.2017_17.19.18.zip

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.



Let me know if this fixed the issue.

 

[Tyburne]

Done.

 

[TwinHeadedEagle]

How is the situation now?

 

[Tyburne]

Worked like a charm, everything back to normal. You guys are true heroes! Thanks so much!