Jump to content

[HELP] CHAMELEON EXPLORER PRO infected my computer


Recommended Posts

Accidentally added Chameleon Explorer Pro to my pc.

It replaced Windows Explorer, and has installed several other malware/adware type programs on my machine that I HAVE been able to get rid of.

I ran malwarebytes in Safe Mode, scanned for everything I possibly could, and after the 3 hour scan, I had 700 threats after the download that the Explorer virus was compiled into without my knowledge.

After restarting my computer, it was gone for roughly 15 seconds. I uninstalled it from the control panel, and I thought I was good to go. To make sure that the processes weren't running to ensure it was off of my computer, I checked the Task Manager... unhappy to see that the process was still yet running. It still is on my pc, AND the icon isn't in the uninstall/change a program list in the Control Panel. I've also tried opening the file location of the running viruses process, FOUND the folder it was located in, and tried to delete the folder. The process was running, so I had to end the process of the virus before deleting the folder. However after ending the process and then trying to actually delete it, it still said that it was running.

I am completely out of ideas, it has FULLY disabled chrome (I'm using internet explorer) AND won't let me download it again after uninstalling chrome (I uninstalled because it was disabled and I thought I could just redownload it but that didn't work). I also have to constantly refresh my page and open links in separate tabs in internet explorer because if I stay on it more than 30 seconds, I get redirected to ads and disgusting pages. I've gotten into the habit of selecting this whole message and copying it every 10 seconds and then refreshing the page and re-pasting it so I can stay on this page and not have my progress be lost. It's an incredibly severe issue.

I could always just reinstall windows, knowing that the virus would be gone, but hours of redownloading drivers and games would follow that and I really don't want to go through that route.

Here are some screenshots of the program.

607172082_Capture1.PNG.2efbab5f5f03319c715a042bc3a6e6c8.PNG

^This pops up when I try to open windows explorer.

680938784_Capture2.thumb.PNG.217ea3455b39ebb52001c34260629e5b.PNG

^The viruses process names

1270928031_Capture3.thumb.PNG.b9045ed56fb25b4c007f2dc3d58eb102.PNG

^Opening the file location

1270330844_Capture4.thumb.PNG.68cf763470fd3b55e93e241f9f84df2a.PNG

^Can't delete. If I end the process, the whole thing collapses.

1400086238_Capture5.thumb.PNG.7c601bec9b054264bc3dea99505eb2bd.PNG

^Not in the list of installed programs so I can't uninstall from there either.

Running malwarebytes doesn't seem to work.

Any help appreciated, I want this damned thing off of my machine.

Link to post
Share on other sites

Hello benkarn and welcome to Malwarebytes,

Run the following:

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Thank you,

Kevin...
Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.