Unable to delete HallucigeniaSparsa Chrome Extension because it is managed by Organization.

[Alexander Sideris]

Hi, I have a browser redirect malware on chrome which I cannot delete because it says its managed by my organization. I have went into regedit and deleted from HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome, which allows it to stop my browser from redirecting but i think it will come back if I shut down or restart my laptop and it is still on my chrome extension tab. Is there anyway i can remove it fully from chrome?

Thank you,

 

[icotonev]

Hello ..! Welcome to MalwareTips..!

Please follow the instruction below..:

Download Farbar Recovery Scan Tool and save it to your desktop. --> IMPORTANT

If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.
If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

---------------------------------------------------

In your next reply, please include:

• FRST.txt
• Addition.txt

 

[Alexander Sideris]

Hi Icotonev, here are the results. It says now it is turned off but would like to remove it fully to be sure let me know the next steps.

Thank you!

 

[icotonev]

Thanks..!
Looking over your logs now..!
Dependent on how much I need to research I may be a while, and as it's getting late where I am, it may be tomorrow morning (my time GMT) before I get back to you.

 

[icotonev]

Hello ..!

• Download the Revo Uninstaller (Free Download) and save it on your Desktop.
• Double click on the exe file created on your Desktop to run the installer, and follow the instructions to install the program.
• Double click the program's icon to open it.
• Write in the search area, on the top left, the following program:

Artificius
WebAdvisor by McAfee

• Choose the Uninstall tab from the menu and let the program to create a Restore point.
• Choose Scan, and then the Advanced mode scan.
• Select all the Online Services items found, Delete and Next.
• Let the procedure be completed and click on Finish.
• Restart the computer.

Next ....:

Farbar Recovery Scan Tool - Fix

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone

Please download the attached file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.

• Copy/paste the following in the Search: box

Searchall: cmnaechcmchbgjbfgbilkdjkidkgfpki , Artificius , WebAdvisor , HallucigeniaSparsa

• Click Search Files button
• When completed click OK and a Search.txt document will open on your desktop
• Аttach the report in your reply. If the file is too large zip and upload it here.

In your next reply, please include:

• Fixlog.txt
• Search report

 

[icotonev]

Do you still need help..?

 

[icotonev]

Due to lack of activity, this topic is now closed.
If you still need help, open a new topic, and wait for a new helper.