Solved "UNISALEIS" chrome plugin, returns after deleted

[Gairth]

Have you encountered "unisaleis" chrome plugin?

Addendum:

Looking at the report generated by FRST, I notice the very ugly word 'Torr****nt!
I and my wife are the only users of this computer and we NEVER use torrents as they are filthy, ugly, infected, illegal, and just plain sh*t.
So why does the word appear under chrome in the report?
I dont understand this.

Thanks again,

Gary

 

[TwinHeadedEagle]

Hello,


http://malwaretips.com/threads/preparation-guide-before-requesting-malware-removal-help.20334/

 

[Gairth]

Thank you for your assistance,
G

 

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyalltemp;
  ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[Gairth]

thanks again THE !
But unfortunately...
got an error message as follows:

 

[Gairth]

Status UPDATE:

clicked yes on above error message dialog box
eventually got message saying reboot necessary
and it was done (by the program not by me)
Computer Restarted (auto)
No notepad log
searched for zoek log and even *.log ... but nothing
However: the plugin/ extension is no longer in my chrome /settings/ extensions

Next?

(And thank you once again)

PS will now restart all firewall and other temporarily turned off protection unti8l I hear from you again.

 

[TwinHeadedEagle]

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your Desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait until the database is updated.
• Accept the Terms of use and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[Gairth]

Here we go with those reports (attached)
although FRST did not generate a new 'additions' report today:
And:
Adware cleaner generated 3 reports, I am only sending you the final one.
Adware cleaner alson generated a Quarentine file, which is not empty...but I dont think it particulatly wise for me to send it, I have this thing about not sending other people malware %-)

 

[TwinHeadedEagle]

Chrome is altered by malware, you need to reinstall it.

How is your PC behaving now?

 

[Gairth]

HI THE,

Interesting, When I try to uninstall chrome, I get a message asking that I 'close all google chrome windows' and try again. BUT, there are no chrome windows open on either of my user or admin accounts. ??

I will try to shut down completely and try again

Gary

 

[Gairth]

OK please disregard the above,
Chrome uninstalled.
Had to close it in processes/ services first...Doooooh!

 

[TwinHeadedEagle]

Good. How is your PC now?

 

[Gairth]

It appears to be OK, but from my experience I will not know for sure for a few days when suspicious things may or may not start reappearing.

HOW I GOT HERE:
I downloaded the service manual for a laser printer from a siteI do not know
Because:
I live in a small rural community where I voluntarily (without pay) fix computer problems for people who otherwise could not afford to pay for technical assistance, which is rare and very costly around here (and all too often inadequate). I also collect and refurbish used computers and such to give away to people in 'need' who can not afford to pay/ would not know what to purchase if and when they could- one of the people I recently helped had spent over $800 to buy a laptop and have the store manager set it up and then do some software repairs on it- simply put, a vulture- but that is well known by people in the know around here, so we avoid him. But others fall prey.

So in this capacity I was given a color laser printer, and the rest is history as I tried to refurbish it to give it to a local photographer/ artist.

Generally when I have had to rid people's systems of malware, I have found that unless I do a complete format and reinstall the malware returns within a week. It is TIME consuming work and usually involves getting all of their data off first, reinstall everything, make an image, create an admin account, read them the riot act re torrents etc., and a lot of begging and pleading to log on as user and not administrator-occasionally even the threat to not 'fix it' again. I do like your idea of not working on those who use torrents, and will definitely add that to my repertoire.
The group of programs you use is far more detailed and sophisticated than what I use, and I expect your results will be better in the days or weeks ahead. I am not an expert: people around here just think I am because I persevere and get the problem fixed. In the land of the blind, the one eyed man is king. (BTW as it happens I am 'legally' blind, but that is irrelevant.)

So I am hopping that I might be able to use the same suite you use to fix people's problems with far less time and effort than the way I described above. I will have to study the FRST logs and learn how to read them and then I should be able to do the rest by using your methods and referring to your page periodically, to stay up to date. I understand that your replies are for the most part automated, and why that is, but I hope you have a moment to read this. Thank you again for your help and if nothing recurs in a few days I will write again and send a donation.

Gary

 

[TwinHeadedEagle]

Good speech


Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself

Recommended reading:
​

MUST READ - security tips:

• Computer Security - a short guide to staying safer online.
• Simple and easy ways to keep your computer safe and secure on the Internet

MUST READ - general maintenance:

• What to do if your Computer is running slowly?

The Importance of Software Updating:
​

In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.​

Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

• How to configure and use Automatic Updates in Windows
• How to update Java
• How to update Adobe Reader

Recommended additional software:
​

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

Adblock - to surf the web without annoying ads!

Post-cleanup procedures:​

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

My help is free for everybody.
If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation:
Thank you!​

Stay safe,
TwinHeadedEagle

 

[Gairth]

All good.
TYVM