Gosave2.0 & NextCoup1.0

[lowfrequency6]

Hi, I need help removing Gosave2.0 and Nextcoup1.0 I tried removing these extensions from all browsers, but they keep reappearing. I have also tried using anti-virus software, but no success.
I have attached frst.txt.

Any advice will be appreciated. Thanks!!

 

[argus]

Hi.


1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://mysearch.avg.com/search?cid={28B50EC8-2041-47BE-A353-95BD46085B6E}&mid=8599caaf19c747d39d14d1c5bcd4b5ee-77fbb4c2830d7649144850dc0d35fdecb2fa6cd4&lang=en&ds=oc011&coid=avgtbdisoc&cmpid=&pr=sa&d=2014-02-05 22:33:42&v=17.3.1.204&pid=safeguard&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {B2B3FD35-BFA3-4BA6-9723-FE84D34722FB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3291326&CUI=UN33792020862717520&UM=2
BHO-x32: No Name -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} ->  No File
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File
Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File
CHR Extension: (GoSave) - C:\Users\ysuriel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dglcafpifmnkebgnbgljbjlndimgmclb [2014-10-19]
CHR Extension: (NextCoup) - C:\Users\ysuriel\AppData\Local\Google\Chrome\User Data\Default\Extensions\glagdgcddjjgjpmokomdbbinehdcjidf [2014-10-19]
C:\Users\ysuriel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dglcafpifmnkebgnbgljbjlndimgmclb
C:\Users\ysuriel\AppData\Local\Google\Chrome\User Data\Default\Extensions\glagdgcddjjgjpmokomdbbinehdcjidf
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
EmptyTemp:

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.







******************** Next ***************************







Please download Zoek tool by Smeenk (

) from here and save it to your Desktop.
Unpack the archive...

• Close any open browsers and temporarily disable your AntiVirus program. (if it is necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool. Please wait while the tool does not start...
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:
  
  

  QuickScan;
  autoclean;

  
  
• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"

 

[lowfrequency6]

Hi again, so I followed the instructions and ran zoek. I have attached the zoek-results.log. Please let me know what are the next steps. Thanks again! I really appreciate the help.

 

[argus]

Re-run zoek and run this script:

emptyfolderscheck;delete
autoclean;
bopakagnckmlgajfccecajhnimjiiedh;chr
njljkdinboobkmkihgcohanchjnjpgjk;chr
C:\Users\ysuriel\AppData\Local\CRE;fs
dglcafpifmnkebgnbgljbjlndimgmclb;chr
glagdgcddjjgjpmokomdbbinehdcjidf;chr
emptyalltemp;
emptyclsid;
ipconfig /flushdns >> %temp%\log.txt;b
ipconfig /flushdns;b

Chrome installation is altered by malware. Reinstall is needed.

 

[lowfrequency6]

I uninstalled google chrome. Do you want me to reinstall it? I also re-ran zoek and attached the results. Please advise me on the next step. Thanks again.

 

[argus]

You can install Chrome again.




• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.