Unable to uninstall the chrome extension + issues with blank thumbnails

[anies08]

Hey !

So I have an issue. Since I installed Malware Bytes & the extension on Chrome, I had some trouble with thumbnails in the Chrome File explorer not showing. They are showing blank and take A LOT OT TIME to show

So I decided to uninstall everything.

So MwBytes is uninstalled, however the chrome extension is sticking even after Chrome reinstall - it states that a third party program is installing this !!! I used MB Support to clean but no use. And as I suppose that this extension is changing something in the registry or in chrome as even uninstalled in the chrome extension, I still have some issues with chrome thumbnails

And I have still the issues

Please T_T help ! Thanks  !

mbst-grab-results.zip

[anies08]

Deleted the last registry keys of malewarebytes and no more forced install.

Still have the issues with the thumbnails as other users - so I dunno.

[anies08]

Edit 3 : Seems the issue is linked with my chrome profile who had the extension. I will need to recreate a clean profile. (I will wait in case any of you has a solution)

[anies08]

Edit 4 : I deleted the profile and Malware Bytes IS STILL HERE

[anies08]

Edit 5 : Confirming that the whole Chrome profiles created are compromised by the extension even when it says it is not installed. When I run in Private mode, there is no issue

[Porthos]

This is due usually because of the sync data.  Follow the instructions in the following topic.

 

[anies08]

@Porthos : Not only synced.

It is happening with a different profile on the same computer & on the synced session.

I did uninstall chrome and turned off the extension & app sync - but still thumbnails are slow.

 

[Porthos]

1 minute ago, anies08 said:

but still thumbnails are slow.

That is a different issue.

 

[anies08]

Well I have two issues @Porthos. The first being that it seems that it is the extension is slowing down my file explorer and not showing any thumbnails. Found info on Reddit on this issue as well. This is why I decided to uninstall it. Second issue.

[AdvancedSetup]

Hello  and       @anies08

 

My screen name is AdvancedSetup and I will assist you with your system issues.
 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow all steps in the provided order and post back all requested logs
• Please attach all log files to your post, unless otherwise requested
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
• Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
• Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim. Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections. If there are any on the system you should uninstall them before we proceed.
• Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
• If your system is running Discord, please be sure to Exit it while this case is ongoing.

 

Please get me the following updated logs. Please find the following Farbar program and right-click over it and select to "Run as administrator"  then click on the SCAN button and attach new logs

 

FRST.TXT
ADDITION.TXT

 

Thanks

 

 

 

[anies08]

Hi Advancedsetup ! Any website of recommandation to DL Farbar ?

[Porthos]

7 minutes ago, anies08 said:

Any website of recommandation to DL Farbar ?

You should already have it in your downloads folder. It was downloaded with the Malwarebytes support tool.

If you already deleted it you can follow these instructions.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

Edited November 22, 2022 by Porthos

[anies08]

Oh ok @Porthos no I have not deleted it. It is just that from bleeping computer it was detected as a ransomware. I have sent the file via MP to @AdvancedSetup

[AdvancedSetup]

[ 1 ]

Please go to Control Panel, Programs, Programs and Features and uninstall the following

• Bonjour
• CCleaner (computer experts no longer recommend this program)
   

Error: (11/21/2022 01:01:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10578

Error: (11/21/2022 01:01:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10578

 

[ 2 ]

The act of torrenting itself is not illegal. However, downloading and sharing unsanctioned copyrighted material is illegal, and there is always a chance of prosecution if caught by the authorities.
Torrenting non-copyrighted material is perfectly fine and is allowed. However, be aware that we have seen increased malware bundled with software downloads over P2P.

Recent Ransomware infections have been seen to encrypt user data so that no one can decrypt the data without the private key.
When sharing files, please keep in mind that you're increasing your system's attack surface area, which can increase the risk of infection.

Scan all files before running them. https://www.virustotal.com

If you don't need or use the P2P software, you should uninstall it.

Risks of File-Sharing Technology by the Cybersecurity & Infrastructure Security Agency
https://www.cisa.gov/uscert/ncas/tips/ST05-007

 

Date: 2022-11-22 09:30:06
Description:
Antivirus Microsoft Defender has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUABundler:Win32/uTorrent_BundleInstaller&threatid=311958&enterprise=0
Name: PUABundler:Win32/uTorrent_BundleInstaller
Severity: Faible
Category: Logiciel potentiellement non désiré
Path: containerfile:_E:\LiberKey\Apps\uTorrent\App\uTorrent\utorrent.exe; file:_E:\LiberKey\Apps\uTorrent\App\uTorrent\utorrent.exe->(UPX)
Detection Origin: Ordinateur local
Detection Type: Concret
Detection Source: Utilisateur
Process Name: Unknown
Security intelligence Version: AV: 1.379.731.0, AS: 1.379.731.0, NIS: 1.379.731.0
Engine Version: AM: 1.1.19800.4, NIS: 1.1.19800.4

 

[ 3 ]

The computer is actively being used by someone to steal software. As requested, such items should be uninstalled or removed. It is a risk to your computer and your data.

127.0.0.1 na1r.services.adobe.com
127.0.0.1 hlrcv.stage.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 genuine.adobe.com
127.0.0.1 prod.adobegenuine.com

 

[ 4 ]

You appear to be missing a driver for this device. Do you need help installing it?

Name: PCI Encryption/Decryption Controller
Description: PCI Encryption/Decryption Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

[ 5 ]

The computer is experiencing BSOD system faults. This needs to be looked into as well

System errors:
=============
Error: (11/22/2022 08:57:41 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 21:49:18 on ‎21/‎11/‎2022 was unexpected.

 

[ 6 ]

Where did you download this file from? Microsoft tried to upload it to check and verify if it was safe but failed to upload.

C:\Users\Nana\Downloads\openvpn-pfSense-UDP4-1194-Anais-install-2.5.2-I601-amd64.exe

You should upload that to https://virustotal.com and have them scan it.

 

[ 7 ]

Please run the following fix

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

 

Please download the attached fixlist.txt file and save it to C:\Users\Nana\Downloads\
NOTE. It's important that both files, Farbar program  C:\Users\Nana\Downloads\FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run Farbar  C:\Users\Nana\Downloads\FRSTEnglish.exe with Admin rights and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log C:\Users\Nana\Downloads\ Fixlog.txt    Please attach it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks