Lingering malware after removal of Chromestera.

[mbs5380]

First some background.

I accidentally installed the Chromestera virus a few weeks ago. I immediately uninstalled the main program from Settings -> Apps and ran a virus and malware scan. It didn't catch everything as these three issues remain.

1. There is a related app called "Chromestera Update" that shows up in the list under Settings -> Apps. When I try to uninstall I am given a message "This action is only valid for products that are currently installed".

2. There is a Chrome extension called "AzaleaRhododendron 4.7". The enable/disable switch is grayed out and clicking "Remove" does nothing.

3. This may or may not be related to the other two, but I am also getting redirected to other search engines when doing a google search.

I now ran the Malwarebytes and FRST scans as directed. I included the two requested logs plus the scan log from Malwarebytes. The three issues above persist.

Malwarebytes quarantined a folder "C:\APPS-HELPER" and also replaced one registry item. You will see this in the third output log "mb_scan.txt" which I also attached. These actions didn't resolve the three issues stated above.

I would appreciate any help!

 

[nasdaq]

Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Remove this program in bold using the Control Panel > Programs > Programs and Features...
Chromstera Update (HKLM\...\Chromstera Update 1.0.0.0) (Version: 1.0.0.0 - Chromstera Browser Research)

You may have to delete manually.

How to Manually Remove Program Entries from the Apps & Features List

How to Manually Remove Program Entries from the Apps & Features List - MajorGeeks

There may come a time when you find that you've uninstalled a program in Apps & Features (Windows 10) or AddRemove Programs (Windows XP, 7, Vista, 8) but the entry is still there. This problem happens when a registry entry wasn't correctly removed during the uninstall.

www.majorgeeks.com

Follow the instructions on the page.
<<<>>>

Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

 

[mbs5380]

Sorry for the delay. I needed to get to a good save point in a project I'm working on and back everything up just in case something goes wrong. I'm will now follow the steps posted and report back.

 

[mbs5380]

The problem is fixed. Thank you!

 

[nasdaq]

Hi,

Looking good. Stay safe.