Started with "BrowserModifier:Win32/Suptab!blnk", now hijacking accounts

[Amalgam]

I'm at the end of the line here. My friend downloaded a suspicious program from Sourceforge and I can't get rid of the malware that came along with it. I consider myself a tech-savy person but I just can't find the source of this evil thing that's infected my computer. I've uploaded an MBR check and the FRST logs including shortcuts.

The main reason I know the malware still exists is that it keeps writing in redirects to sweetpageurl on chrome. I can remove them manually or through anti-malware but they keep reappearing. I am in serious need of help or I might have to reformat and lose about 500 pdfs worth of medical study notes.

Please help me!

 

[TwinHeadedEagle]

Hello,

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

 

[Amalgam]

Hello, sir.

I've uploaded the requested logs.

 

[TwinHeadedEagle]

You can try to reinstall Chrome. I don't see active infection in your logs.

 

[Amalgam]

Just reinstalled chrome and ran Adwcleaner. Found 18 threats. I've attached the log to this post.

 

[Amalgam]

I think chrome refuses to let anything change the secure preferences file that the sweetpageurl thing is on. So every time I try to remove it, I get a "Chrome detected that some of your settings were corrupted by another program and reset them to their original defaults." message in chrome's settings. It's all because I sync my chrome through my google account. Any solutions?

 

[TwinHeadedEagle]

Did you login into your Google account?

 

[TwinHeadedEagle]

Ah yes, I see.

You need to reset your sync.

Reset your Chrome sync - Chrome Help

 

[Amalgam]

That did the trick. The question now is if my phone has been infected by the original virus since it was connected to my computer through a USB. And also if my online accounts were compromised considering that it sent spam links on skype.

 

[TwinHeadedEagle]

No, such malware isn't spreading over USB. Yes, they probably have your Skype username and password, so you should change it.