kosearch still appearing

[lydan54]

Hi, I followed all the steps on the tutorial for removing this google extension (malware) but it is still appearing and when I search smething it redirects me to yahoo or bing. Please i´ve done everything I'll be happy if somebody helps me please

 

[nasdaq]

Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Ensure that you are in an Administrator Account
Double-click to run it. When the tool opens click Yes to disclaimer.
Check the boxes as seen here:

Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Please attach the logs for my review.
How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

https://deeprybka.trojaner-board.de/eset/eng/attachlogs.png

I will review the FRST.TXT and Addition.txt logs and advise.
Wait for further instructions

p.s.
This program is updated often.
If it's identified as suspicious by your Anti-Virus program trust it if Downloaded from the link I provided.
OR, you should restore the program from the Quarantine folder.
====

 

[lydan54]

Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Ensure that you are in an Administrator Account
Double-click to run it. When the tool opens click Yes to disclaimer.
Check the boxes as seen here:

Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Please attach the logs for my review.
How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

https://deeprybka.trojaner-board.de/eset/eng/attachlogs.png

I will review the FRST.TXT and Addition.txt logs and advise.
Wait for further instructions

p.s.
This program is updated often.
If it's identified as suspicious by your Anti-Virus program trust it if Downloaded from the link I provided.
OR, you should restore the program from the Quarantine folder.
====

Thanks for replying, here are the files

 

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

 

[lydan54]

Hi,

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

I did as you told but the problem still persists

 

[nasdaq]

Hi,

Sory I missed a TASK this fix will clean it.

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt.

If the problem persist after the Restart of the computer execute this Microsoft Program.

Microsoft Safety Scanner - MSERT.exe

Please make sure you have the latest Windows 10 updates before proceeding.


Please set File Explorer to SHOW ALL folders, all files, including Hidden ones.
Please use this Guide for Windows 10 or 11. https://support.microsoft.com/en-us...d-folders-in-windows-97fbc472-c603-9d90-91d0-
Follow the instructions.

Then Download the Microsoft Scanner for this site:

Microsoft Safety Scanner Download - Microsoft Defender for Endpoint

Get the Microsoft Safety Scanner tool to find and remove malware from Windows computers.

learn.microsoft.com

Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.


This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

p.s.
There are more information for you to read in the download link.

<<<>>>

 

[lydan54]

Hi,

Sory I missed a TASK this fix will clean it.

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt.

If the problem persist after the Restart of the computer execute this Microsoft Program.

Microsoft Safety Scanner - MSERT.exe

Please make sure you have the latest Windows 10 updates before proceeding.


Please set File Explorer to SHOW ALL folders, all files, including Hidden ones.
Please use this Guide for Windows 10 or 11. https://support.microsoft.com/en-us...d-folders-in-windows-97fbc472-c603-9d90-91d0-
Follow the instructions.

Then Download the Microsoft Scanner for this site:

Microsoft Safety Scanner Download - Microsoft Defender for Endpoint

Get the Microsoft Safety Scanner tool to find and remove malware from Windows computers.

learn.microsoft.com

Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.


This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

p.s.
There are more information for you to read in the download link.

<<<>>>

 

[nasdaq]

Hi,

Looking good.

Is the problem persisting?

If so what is it?

Run the Farbar Scan one more time and post fresh logs for my review.

 

[lydan54]

Hi,

Looking good.

Is the problem persisting?

If so what is it?

Run the Farbar Scan one more time and post fresh logs for my review.

Yes, the problen still persists. When I search on my main page wich should be google, when I search something, the oage changes to laxsearch and then it redirects me to a searcher like bing or sometimes yahoo.
I noticed that in my extensions bar is no longer laxsearch which I couldnt get rid off earlier but somehow is still working?
Should I try desinstalling and re installing chrome?

 

[nasdaq]

Hi,

This version of this program is not recommended

SYSTEMAX Software Development - PaintTool SAI Development Room

www.systemax.jp

(explorer.exe ->) (SYSTEMAX Software Development) [Archivo no firmado] C:\Users\dylan\Downloads\Paint Tool SAI 2.0 (64bit)\sai2.exe
Keep it at your own risk.
<<<>>>

This task is still present.
Task: {754A4BC2-26C2-4452-8AD1-27177760D513} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem126.0.6441.0{D33F0926-983A-4796-B698-ED22C344D936} => "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6441.0\updater.exe" --wake --system (Ningún archivo)

Syncing may be the issue.

If the problem persists and Chrome is Synced with other Devices reset it.

Chrome Secure Preferences detection always returns

Browser-related remediation (especially concerning preference/configuration files) can be particularly troublesome given the safeguards built into the browsers, along with syncing mechanisms and other complications associated with Internet browsers. The issue you're experiencing is likely caused ...

forums.malwarebytes.com

Sign in and sync in Chrome - Computer - Google Chrome Help

When you sign in to Chrome with your Google Account, you can get your info on all your devices and use additional Chrome features. When you sign in You can get your bookmarks, passwords, and

support.google.com

Execute the suggested fix.

Restart the computer normally before you re-sync the devices.
===========

How it it now?

 

[lydan54]

Hi,

This version of this program is not recommended

SYSTEMAX Software Development - PaintTool SAI Development Room

www.systemax.jp

(explorer.exe ->) (SYSTEMAX Software Development) [Archivo no firmado] C:\Users\dylan\Downloads\Paint Tool SAI 2.0 (64bit)\sai2.exe
Keep it at your own risk.
<<<>>>

This task is still present.
Task: {754A4BC2-26C2-4452-8AD1-27177760D513} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem126.0.6441.0{D33F0926-983A-4796-B698-ED22C344D936} => "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6441.0\updater.exe" --wake --system (Ningún archivo)

Syncing may be the issue.

If the problem persists and Chrome is Synced with other Devices reset it.

Chrome Secure Preferences detection always returns

Browser-related remediation (especially concerning preference/configuration files) can be particularly troublesome given the safeguards built into the browsers, along with syncing mechanisms and other complications associated with Internet browsers. The issue you're experiencing is likely caused ...

forums.malwarebytes.com

Sign in and sync in Chrome - Computer - Google Chrome Help

When you sign in to Chrome with your Google Account, you can get your info on all your devices and use additional Chrome features. When you sign in You can get your bookmarks, passwords, and

support.google.com

Execute the suggested fix.

Restart the computer normally before you re-sync the devices.
===========

How it it now?

Omg I did all that and I think reseting the configuration did it thank u so much!

 

[nasdaq]

Hi,

Good work. Stay clean.