Google Chrome Extension Can't Be Removed

[suthey1]

I have a Google Chrome extension "CelestialQuasaror" that can't be removed. It states that it is managed by the admin, has access to all data on all websites, manages apps, extensions and themes. I've tried MalwareBytes, which also found malware, which was all quarantined. I don't know how long this has been an issue, as it is my son's computer and he just mentioned it today. When looking at installed apps, Chrome is no longer found, and Chromstera has taken its place. When "Chrome" is opened, a chrome window opens, but random search engines open within chrome. Please help me get this off of his chrome.
Thanks!

 

[suthey1]

To help speed up the process, I've downloaded Farbar Recovery and run it on his machine. Attached are the resulting files.

 

[nasdaq]

Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

This fix will remove the bad Exension.

Before you proceed with running the fix syggested please delete this browser in bold.

Remove this program in bold using the Control Panel > Programs > Programs and Features...

Chromstera Browser (HKLM\...\Chromstera Browser 1.0.0.0) (Version: 1.0.0.0 - Chromstera Solutions)

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please let me know if all is well.



Please post the Fixlog.txt and let me know what problem persists.

 

[lokamoka820]

It sounds like you're dealing with a managed extension. Here's a quick step-by-step guide:

1. Type "chrome://policy" in your Chrome address bar and hit enter.
2. If you see any policies, click "Show Value" to see more details.
3. If the policy is related to the troublesome extension, you'll need to remove it.
4. To do this, go to your Windows Start Menu, type "regedit" to open Registry Editor.
5. Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome".
6. Look for the extension ID and delete it.
7. Restart your browser.

 

[suthey1]

Posting the fixlog.txt. FYI - removing the program wasn't possible. It wasn't even listed in the program list. I did go into the registry and delete all keys with Chromstera in them.

The problem seems to be solved, but I noticed there is one item in the fix that didn't complete....is that something that still needs to be addressed?
Thanks!

 

[nasdaq]

Hi,

Please run a Scan with the Farbar program and just post the FTST.TXT for my review.

 

[nasdaq]

Do you still need help?