I can't remove "Savings Wizard" of chrome

I've done it, several times... but the malware that create the extension folder is located in other folder that I don't know, for that I can't attack the cause, only the consequences.
 
Sometimes I use the windows registry editor, but obviously I'm not an expert.

In the windows registry editor I've searched the name "savings wizard" and "ajakpekbmnkgnjbpajgkdhimcbeoocam" but I didn't find anything.

I don't know why the folder "C:\Windows\SysWOW64" is opened by itself.

In that folder, "C:\Windows\SysWOW64", I've found 4 strange files of 100mb each one with a chinese name, I've just deleted them.

PD: I've restart and windows looks without changes, the malware continues being in chrome extension.
 
Last edited:
Okay. Please back up your Bookmarks in GOogle Chrome.

  1. Click the Chrome menu
    SNP_2696434_en_v1
    on the browser toolbar.
  2. Select Bookmarks.
  3. Select Bookmark manager.
  4. Click the Organize menu in the manager.
  5. Select Export bookmarks.
Chrome will export your bookmarks as a HTML file, which you can then import into another browser.

Find the steps here : https://support.google.com/chrome/answer/96816?hl=en
 
Hi, Kuttus is away, I'll continue with you.


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
 
Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.
 

Attachments

This time it seems that the effects or consequences of the virus has been attacked directly, now I don't see the extension "savings wizard" in chrome extensions neither in chrome://policy , It seems all has been repaired correctly because I’ve reinstalled the chrome again to be sure that It didn't appear and effectively It didn't appear

I suggest you modify this tutorial: http://malwaretips.com/blogs/savings-wizard-removal

Thank you very much for your help!
 

Attachments

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
checkmark.png
Remove disinfection tools
checkmark.png
Create registry backup
checkmark.png
Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
 

You may also like...