How to remove Vosteran from Chrome [Closed]

Hi sophiecscott,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

[external image: bullseye_zpse9eaf36e.gif] Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

Your aswMBR log is incomplete, please run this scan and post the logs it generates in your next reply.

[external image: bullseye_zpse9eaf36e.gif] Malwarebytes Anti-Rootkit

• Download Malwarebytes Anti-Rootkit
• Once the file has been downloaded, right click on the downloaded file and select the Extract all menu option.
• Follow the instructions to extract the ZIP file to a folder called mbar-versionnumber on your desktop.
• Once the ZIP file has been extracted, open the folder and when that folder opens, double-click on the mbar folder.
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Double-click on the mbar.exe file to launch Malwarebytes Anti-Rootkit.
• After you double-click on the mbar.exe file, you may receive a User Account Control (UAC) message if you are sure you wish to allow the program to run. Please allow to start Malwarebytes Anti-Rootkit correctly.
• Malwarebytes Anti-Rootkit will now install necessary drivers that are required for the program to operate correctly.
• If you receive a DDA driver message like could not load DDA driver, click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer and will start automatically.

[external image: MBAMAnti-Rootkit1_zps4613be8c.png]

• Please click by the introduction screen on the Next button to continue.

[external image: MBAMAnti-Rootkit2update_zpsf85fca28.png]

• Next you will see the Update Database screen.
• Click on the Update button so Malwarebytes Anti-Rootkit can download the latest definition updates.

[external image: MBAMAnti-Rootkitupdatecomplete_zpscf9f4c]

• When the update has finished, click on the Next button.

[external image: MBAMAnti-Rootkitscan_zps9b346fe7.png]

• Next you can select some basic scanning options. Make sure the Drivers, Sectors, and System scan targets are selected before you click on the Scan button.
• Malwarebytes Anti-Rootkit will now start scanning your computer for rootkits. This scan can take some time, so please be patient.

[external image: MBAMAnti-Rootkitscan-results_zps9f0fdf8e]

• When the scan with Malwarebytes Anti-Rootkit is finished, the program will display a screen with the results from the scan.
• Make sure everything is selected and that the option to create a restore point is checked.
• Next click on the Cleanup button. Malwarebytes Anti-Rootkit will then prompt you to reboot your computer.
• Click on Yes button to restart your computer.

• There will now be two log files created in the mbar folder called system-log.txt and one that starts with mbar-log.
• The mbar-log file will always start with mbar-log, but the rest will be named using a timestamp indicating the time it was run.
  • For example, mbar-log-2012-11-12 (19-13-32).txt corresponds to mbar-log-year-month-day (hour-minute-second).txt.
• The system-log.txt contains information about each time you have run MBAR and contains diagnostic information from the program.

=========================

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

Start
CloseProcesses:
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2684831913-877172418-50006807-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://vosteran.com/…=1439315344&ir=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…=1439315344&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…=1439315344&ir=
SearchScopes: HKU\S-1-5-21-2684831913-877172418-50006807-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…=1439315344&ir=
SearchScopes: HKU\S-1-5-21-2684831913-877172418-50006807-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…=1439315344&ir=
BHO: freedeliveryy -> {39657b28-e411-4144-be96-43e83f3c4563} -> C:\Program Files (x86)\freedeliveryy\WxX3SPenSTJGQ9.x64.dll ()
BHO: chEap4aLl -> {84ce69d4-a84b-432c-b22b-dd0994055993} -> C:\Program Files (x86)\chEap4aLl\LphyUNwWWibaC2.x64.dll ()
BHO-x32: freedeliveryy -> {39657b28-e411-4144-be96-43e83f3c4563} -> C:\Program Files (x86)\freedeliveryy\WxX3SPenSTJGQ9.dll ()
BHO-x32: chEap4aLl -> {84ce69d4-a84b-432c-b22b-dd0994055993} -> C:\Program Files (x86)\chEap4aLl\LphyUNwWWibaC2.dll ()
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKU\S-1-5-21-2684831913-877172418-50006807-1000\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKLM-x32\…\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path
CHR HKLM-x32\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
S2 Update Dynamo Combo; "C:\Program Files (x86)\Dynamo Combo\updateDynamoCombo.exe" [X]
R2 fcdf7cac; c:\Program Files (x86)\PathFunc\PathFunc.dll [1591296 2015-02-05] () [File not signed]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U3 aswMBR; \??\C:\Users\IPV\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\IPV\AppData\Local\Temp\aswVmm.sys [X]
2015-02-06 21:17 - 2015-02-06 21:25 - 00000000 ____D () C:\Program Files (x86)\dailyypriZoe
2015-02-06 21:16 - 2015-02-06 21:16 - 00000000 ____D () C:\ProgramData\ilggjmfgjphlpglbihphcfldbalmchnl
2015-02-06 21:15 - 2015-02-06 21:25 - 00000000 ____D () C:\Program Files (x86)\oFferapP
2015-02-06 21:15 - 2015-02-06 21:25 - 00000000 ____D () C:\Program Files (x86)\freedeliveryy
2015-02-06 21:15 - 2015-02-06 21:25 - 00000000 ____D () C:\Program Files (x86)\dailuyprizae
2015-02-06 21:15 - 2015-02-06 21:25 - 00000000 ____D () C:\Program Files (x86)\chEap4aLl
2015-02-06 21:15 - 2015-02-06 21:18 - 00000000 ____D () C:\ProgramData\1031184149245000504
2015-02-06 05:20 - 2015-02-06 05:20 - 00000000 ____D () C:\ProgramData\couponcheapchea
2015-02-05 05:00 - 2015-02-05 05:00 - 00000000 ____D () C:\Program Files (x86)\PathFunc
2015-01-16 11:58 - 2015-01-16 11:58 - 00000000 ____D () C:\Users\IPV\AppData\Roaming\1H1Q1V1N1N1O1R
C:\Users\IPV\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf5y3va.dll
C:\Users\IPV\AppData\Local\Temp\ose00000.exe
C:\Users\IPV\AppData\Local\Temp\VC2005 June 2011 vcredist_x86.exe
couponcheapchea (HKLM-x32\…\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) (Version:  - couponcheapchea) <==== ATTENTION
Extended Update (HKU\S-1-5-21-2684831913-877172418-50006807-1000\…\Digital Sites) (Version:  - Extended Update) <==== ATTENTION
File Opener Packages (HKU\S-1-5-21-2684831913-877172418-50006807-1000\…\File Opener Packages) (Version:  - ) <==== ATTENTION
PathFunc (HKLM-x32\…\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{fcdf7cac}) (Version:  - Software Publisher) <==== ATTENTION
Task: {945DFB18-DD65-4B3E-9151-EC92BCCEE918} - System32\Tasks\Digital Sites => C:\Users\IPV\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe [2015-01-16] () <==== ATTENTION
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\IPV\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
EmptyTemp:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

If any of these still are present, please remove them.

[external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• couponcheapchea
• Extended Update
• File Opener Packages
• PathFunc

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• =========================
  
  In your next post please provide the following:
  • checkup.txt
  • system-log.txt
  • mbar-log
  • Fixlog.txt
  • new FRST.txt
  • How is the computer running at the moment?

Hello OCD - thanks so much for getting back to me - right, I will do the things you have suggested above and get back to you…..

Sophie

How do I run FRST?

Have pasted the text into a doc and saved on desktop but not sure how to do the next bit.

Sorry

ps. I have to go for a bit shortly but am still doing this… will have to get back to it after…

Theres still something on there although the Malwarebytes said it cleaned up 4 things.

When I open chrome it still has some pop ups and is acting strangely.

Hi sophiecscott,
 

Have pasted the text into a doc and saved on desktop but not sure how to do the next bit.

 
OK, FRST needs to be located on your Desktop. Move FRST to your Desktop before you proceed.

• Next, after you have copied the FRST script I provided into a .txt document in Notepad and saved it to your Desktop.
• Open the FRST program, locate the Fix button and click it.
• FRST will process the script and generate a new log - Fixlog.txt
• Post that in your next reply.

Theres still something on there although the Malwarebytes said it cleaned up 4 things.

Please post the logs Malwarebyes generated.

Then complete the remaining steps (a new FRST scan) previously requested and post that log as well.

In your next post please provide the following:

• Fixlog.txt
• system-log.txt
• mbar-log
• new FRST.txt

Hi sophiecscott ,

Which browser/s are you getting the pop-ups in?

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When the tool opens click Yes to disclaimer.
• Select the Addition box
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• It will also make (Addition.txt). Please attach it to your reply

=========================

In your next post please provide the following:

• FRST.txt
• Addition.txt

Hi sophiecscott,

Just checking in to see if you still need help?

Hi OCD,

Sorry I have been away for a couple of days - I will try and run the final log tomorrow but it has been behaving much better - as if its fixed which is great!

Thanks for all your help so far!

S

Hi sophiecscott,

I see you have McAfee Security Scan Plus, do you use this program?

=========================

Follow these instructions on how to Backup Chrome Bookmarks

[external image: bullseye_zpse9eaf36e.gif] Uninstall Google Chrome

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following program, right-click and click Uninstall.
  • Google Chrome
• Follow the prompts.
• Reboot if necessary.
• Download and reinstall Google Chrome.
• =========================
  
  [external image: bullseye_zpse9eaf36e.gif] FRST Fix Script
  
  Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt
  
  

  Start
  CloseProcesses:
  SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  C:\Users\IPV\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmupuxt.dll
  C:\Users\IPV\AppData\Local\Temp\Quarantine.exe
  C:\Users\IPV\AppData\Local\Temp\sqlite3.dll
  EmptyTemp:
  End
  

  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• =========================
  
  In your next post please provide the following:
  • Answers to any questions I may have asked.
  • Fixlog.txt
  • new FRST.txt
• 
  
•