Chrome issue only or something worse?? Unable to uninstall Chrome extension

[MissTaken09]

I was on my actual computer today after some time and noticed some wonky behaviour while using my profile on Chrome. I immediately checked the extensions and there was a weird one (PakicetusAttocki) that wouldn't let me delete it which introduced me to the lovely world of the Group Policy stuff. I have gone through multiple online self-help tutorials to fix it but have had no luck. I thought it was connected to a program I found downloaded on here called Chromera, but there were 2 apps with the same name. After I uninstalled the first, the 2nd will not let me uninstall it but it remains in my app list, even after using Revo.

Order of what I've done: used Rkill, used CMD as admin (RD /S /Q “%WinDir%\System32\GroupPolicyUsers”, RD /S /Q “%WinDir%\System32\GroupPolicy”, gpupdate /force), tried deleting any scheduled tasks that looked weird, looked in %AppData% and %localappdata% (found Chromera and deleted everything associated with it, still in app list) but didn't see anything blatantly suspicious, while in AppData followed the Google folder to extensions and deleted all the extensions it showed (all extensions files were oddly named and were created yesterday when I suspect the issue started), reset Chrome settings (opted to avoid deleting Chrome sync data yet). Next, I used MalwareBytes which found 1 thing so I quarantined it, used HitManPro which found 14 tracers and deleted them, used ADWCleaner (including the switch to "Reset Chrome Policies") with nothing showing up, and restarted the computer. After noting that did not work I also used ESET which found and fixed 3 things.

I then restarted the computer, again noting that it did not solve the "Managed by your organization" problem, nor the weird extension, search results keep defaulting to Bing but after selecting them and hitting enter I get Google results, and MalwareBytes is blocking a malicious website from popping up (gggtrenks). Adding that everyone else's Chrome profiles do not have the weird extension nor the issue with the pop-up or search engine but all still say "Managed by your organization". I've tried almost everything but uninstalling Chrome at this point and wondering if that's all it will take or if it's something more insidious that someone can help with. Including the 3 files (FRST, Addition, and MalwareBytesLog). Thanks in advance!

FRST.txt Addition.txt MalwareBytesLog.txt

[1PW]

Hello @MissTaken09 and :

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.  WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted.

Thank you.

[Maurice Naggar]

Hello  @MissTaken09 My name is Maurice. I will guide you. Let's keep these principles as we go along.

• Please provide the ZIP report cited above by 1PW
• Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

  Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
  Show-Hidden-Folders-Files-Extensions
  https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

  Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

• Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

Edited September 10, 2023 by Maurice Naggar
amended

[MissTaken09]

Okay! I followed all of the instructions, however, I don't know how to tell if I have any "cracked, hacked, or pirated games" as my son downloads a lot of mods and things for the games he does use. Nothing seems outside of the norm to my untrained eye though. Outside of that, I followed the directions to a T. Including the zip file requested.

Thank you for your time!

mbst-grab-results.zip

[Maurice Naggar]

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers.  It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

FRST64.exe is on Desktop folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Desktop

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRST64, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRST64 and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

Do NOT make fixes, changes, additions to this system while this case is on-going here. Ask me first if there is an issue.

the "Managed by your organization" on Chrome or other web browser was due to having installed AVG. Anyhow, that issue will be gone.

Note the Malwarebytes program is protecting pc from potential harm. Such as on the Block notices about outgoing attempts to reach gggtrenks(.)com

[MissTaken09]

Here you go! Thank you so much. I thought AVG was okay. Never even thought it was the bad one. Gah!

Fixlog.txt

[Maurice Naggar]

The custom run timed out and ended after hitting the 60 minute time limit. I need to be sure what all antivirus or security applications you have that are installed and active. We will need to do ( later ) another custom run.

Temporarily disable Microsoft SmartScreen to download the next software below 

Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[MissTaken09]

Here you go. Thank you!

SecurityCheck.txt

[Maurice Naggar]

1. Press & hold  the Windows key on keyboard & then tap the R key   to open the Run box-window.
2. Type

appwiz.cpl

and tap Enter.
The Programs and Features window will appear.   Locate on the list "HitmanPro 3.8".

Do a right-click on it.  Then choose Uninstall.   Let it proceed.

ALSO Uninstall Adobe Flash Player ActiveX v.9.0.124.0

+ Uninstall AVG Secure Browser 

Exit Programs and Features, when done.
Now do a Windows Restart
Let me know after all that has been done. It sure seems that the Hitmanpro was severly slowing down the custom-fix-run. We will be doing a new run later, with the hope, expectation to finish what was left to do.
 

Edited September 11, 2023 by Maurice Naggar
amended

[Maurice Naggar]

AFTER taking care of the 3 programs listed above, this is Run 2 to see about finishing the custom run.

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

Please Close all open work before you actually do begin this run. Delete the older file Fixlist.txt that is on Desktop.

FRST64.exe is on Desktop folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Desktop

Fixlist.txt<- < - - - -

NOTE. It's important that both files, FRST64, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRST64 and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

Do NOT make fixes, changes, additions to this system while this case is on-going here. Ask me first if there is an issue.

the "Managed by your organization" on Chrome or other web browser was due to having installed AVG. Anyhow, that issue will be gone.

Note the Malwarebytes program is protecting pc from potential harm. Such as on the Block notices about outgoing attempts to reach gggtrenks(.)com

[MissTaken09]

15 hours ago, Maurice Naggar said:

Let me know after all that has been done. It sure seems that the Hitmanpro was severly slowing down the custom-fix-run.
 

I've done most of what you've asked here, however, AVG still shows on the computer but it won't let me uninstall it. It also doesn't show in the list that appwiz.cpl brings up. I won't proceed with your last step until I get confirmation that I can. Thank you again.

[Maurice Naggar]

Go ahead and go forward, to run the custom-script I had listed before. Afterwards, we can deal with what is left.

[MissTaken09]

Here you go:)

Fixlog.txt

[Maurice Naggar]

Hi. This log indicates that there is a need to do a Windows RESTART. Please do so.
Then we need to do a new run to recheck the integrity of the system.
 When you have some quiet time, we need to run a new custom-run to recheck integrity, and to also have this new run to do a CHKDSK run to check the integrity of the disc storage. After this run has finished, at the next time system Reboots, be sure you do not interfere with the run of CHKDSK.
Please Close all open work before you actually do begin this run.

FRST64  is on Desktop folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Desktop

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRST64, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRST64 and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop folder (Fixlog.txt) . Please attach or post it to your next reply.

[MissTaken09]

I rebooted the computer before running this one and allowed it to reboot after this one finished. I'm sorry about last night's one. I am positive that I rebooted before and after that one too, but that one was really weird as it spent a lot of time showing "Not Responding". I left it alone and when I came back it was going again, but really slowly. This one was a normal run. Please let me know if there is anything wrong with it. Thank you so much again for your time. I know how frustrating and time-consuming this is.

Fixlog.txt

[Maurice Naggar]

Quote

Windows Resource Protection found corrupt files and successfully repaired them.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted items from a system. This tool does not install. It is run on-demand.

This link is for the 64-bit version of MSERT.exe . Be sure you save the file first

Upon completion of the save, Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well

Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.

This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

It is normal for the Microsoft Safety Scanner to show 'detections' during the scan process on the screen itself.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

[MissTaken09]

It just finished now. I had an issue with the computer going into sleep mode frequently. I couldn't commit the time to stay with it and keep it awake until this morning. Here is the log (I hope!). Thank you again.

msert.log

[Maurice Naggar]

Results Summary:
----------------
No infection found.

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

[MissTaken09]

Here it is:)

AdwCleaner[S02].txt

[Maurice Naggar]

That's fine. Thanks. As far as Chrome browser, is it doing normally today ?

[MissTaken09]

Yes! Chrome is back to normal. Nothing about being managed by an organization and no weird extensions. AVG Secure Browser finally let me uninstall it too!

[Maurice Naggar]

Hi. That is good news.
There are the apps that were highlighted by SecurityCheck as needing your attention & action.
Notepad++ (64-bit x64) v.8.4.6  Warning! Download Update

NVIDIA GeForce Experience 3.26.0.154 v.3.26.0.154  Warning! Download Update

OpenOffice 4.1.12 v.4.112.9809  Warning! Download Update

7-Zip 22.01 (x64) v.22.01  Warning! Download Update
Uninstall old version and install new one.

PeaZip 8.8.0 v.8.8.0  Warning! Download Update

Discord v.1.0.9004  Warning! Download Update

Zoom v.5.13.5 (12053)  Warning! Download Update

Java 8 Update 361 (64-bit) v.8.0.3610.9  Warning! Download Update
Uninstall old version and install new one (jre-8u381-windows-x64.exe).

Adobe Flash Player ActiveX v.9.0.124.0  Warning! This software is no longer supported. Please uninstall it.

Adobe Acrobat XI Standard v.11.0.00  Warning! Download Update
^Please run Acrobat Reader DC and go Help - Check for updates...^

Opera GX Stable 100.0.4815.82 v.100.0.4815.82  Warning! Download Update

Wondershare Helper Compact 2.6.0 v.2.6.0 Do you really need it? It is not recommended.

Torrenting & filesharing. Try to not do that, as a general security matter. All it takes is one malicious file to lead to tragedy & loss.
https://informationsecuritybuzz.com/articles/torrenting-know-risks-take/
 

👌💢 Temporarily disable Microsoft SmartScreen to download the next software below

Let's go ahead and do some clean-up work and remove the tools and logs we've run.
Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_2-14.exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• You may attach that file to your next reply. (not compulsory)

I am very pleased to read the great news.
Sincerely.

[AdvancedSetup]

Hello @MissTaken09

How are things going now?

Please post a status update when you have a moment

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks