Same Malware Keeps Getting Removed-What's going on?

[Favor723]

After giving it a day and scanning multiple times, I can now inform you that no malware at all has been found since I've disabled my extensions. The only extensions I used though were Adblock Plus, Kaspersky Protection, and some Google ones such as Google Docs and Google Quick Scroll (which I don't know where those came Google extensions came from to be honest). 

I would like to use the Adblock Plus and Kaspersky Protection extensions. What do you recommend I do? Should I enable those two extensions and delete all the other extensions and then try running some scans?

[TwinHeadedEagle]

Okay, I have one idea:

 

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

 

You should find Upload.zip archive at that place you run FRST from. Please upload this too to your next message. 

If forum doesn't accept it, please use this link: https://www.sendspace.com/

fixlist.txt

[TwinHeadedEagle]

@Akipapa

Please start your own topic.

 

[Favor723]

Fixlog.txt

I do not see an unload.zip

 

Edited May 16, 2016 by Favor723

[Favor723]

Won't let me edit my previous post. I mean upload.zip.

[Favor723]

https://www.sendspace.com/file/bno1e3 Sorry, I found the Upload.zip and uploaded it to the sendspace link you sent me. Also, the fix log is attached.

Fixlog.txt

[TwinHeadedEagle]

Hmm, this folder doesn't exist anymore. Did you remove some extension or they are all disabled now?

[Favor723]

They are still all disabled. Was I supposed to enable them again first?

[TwinHeadedEagle]

 Please enable them all.

• Press the + R on your keyboard at the same time. Type %localappdata%\Google\Chrome\User Data\Default\Extensions and click OK.
• Right click on okanipcmceoeemlbjnmnbdibhgpbllgc, Send to >> Zipped (compressed) folder.
• Attach that folder here.

[Favor723]

Okay, when I only enable the extensions I wanted (Adblock Plus and Kaspersky Protection) I could not find the  okanipcmceoeemlbjnmnbdibhgpbllgc folder but when I enabled the other extensions that I don't really care about and don't know where they came from (Google Docs, Google Docs Offline, Google Quick Scroll, Google Sheets, and Google Slides) the  okanipcmceoeemlbjnmnbdibhgpbllgc folder appeared. It is now attached as you have requested. 

okanipcmceoeemlbjnmnbdibhgpbllgc.zip

[TwinHeadedEagle]

Yes, this extensions is the culprit:  Google Quick Scroll

It has some encoded parameters. You can delete it. Then run MalwareBytes scan again and let me know if it is clean.

[Favor723]

It appears as though your solutions and advice has worked as Malwarebytes is not finding any malware. Thank you very much for your time and expertise. I appreciate it.

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!