vosteran on google chrome

muppest New Helpee Posts: 4	vosteran on google chrome Jul 5, 2017 12:31:05 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by muppest on Jul 5, 2017 12:31:05 GMT -8 Hello, I found Vosteron on Google Chrome and can't remove it. Computer seems a little slower than when I originally got it in Nov 2016. wikisend.com/download/975190/FRST.txt wikisend.com/download/952096/Addition.txt

dbrisen
Malware Removalists

Posts: 3,688

vosteran on google chrome Jul 6, 2017 0:10:03 GMT -8

Quote

Post by dbrisen on Jul 6, 2017 0:10:03 GMT -8

FIRST >>>>

1- Please double-click on FRST/FRST64
2- Press Ctrl+y (Ctrl and y keys at the same time)
3- A fixlist.txt file opens up in notepad.exe. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad.

Start::
CreateRestorePoint:
CloseProcesses:
C:\Users\Executive\AppData\Local\Host App Service
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggfc_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0A0CzztCtCtB0B0AyEyCzzzyyC0AtDyEtN0D0Tzu0StCtDzyyBtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBzyyB0A0B0FyE0DtGtDzz0FtAtG0AtCyDyDtG0B0AyCyEtGyDyDyDzzzyzy0B0BtD0F0B0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtDzzzztCtC0EyEtG0CzzyDtBtGyE0FyEtDtGzzzy0C0DtGyEyB0EtB0Czzzy0AtDtCzztC2Q&cr=1189660002&ir=
CHR StartupUrls: Default -> "hxxp://mail.google.com/","hxxp://drive.google.com/","hxxps://www.pandora.com/"
CHR Extension: (Google Slides) - C:\Users\Executive\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-28]
CHR Extension: (Google Drive) - C:\Users\Executive\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-28]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Executive\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Executive\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-28]
CHR Extension: (Chrome Media Router) - C:\Users\Executive\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-05]
2017-06-29 13:52 - 2017-06-29 13:52 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignf010e870677d5d78
2017-06-29 13:50 - 2017-06-29 13:50 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign5bd1b43b3f93060b
2017-06-29 12:42 - 2017-06-29 12:42 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign3d420206b255f255
2017-06-29 12:26 - 2017-06-29 12:26 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignb667e8ce064ffe83
2017-06-29 12:18 - 2017-06-29 12:18 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignfff8e349241e1841
2017-06-29 12:18 - 2017-06-29 12:18 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignbb0ced3417136f08
2017-06-29 12:18 - 2017-06-29 12:18 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign23733748e3f9dfaf
2017-06-13 16:41 - 2017-06-13 16:41 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign7cc64815c092c27b
2017-06-13 13:12 - 2017-06-13 13:12 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign865150147acba080
2017-06-13 13:12 - 2017-06-13 13:12 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign779d7a77b4cc3809
2017-06-13 13:12 - 2017-06-13 13:12 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign2867816c12e4400f
2017-06-09 16:09 - 2017-06-09 16:09 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignbc02f81e5777ed2c
2017-06-09 16:08 - 2017-06-09 16:08 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignd0f35d46c49de553
2017-06-09 16:08 - 2017-06-09 16:08 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign4db9eeafa4d8cc78
2017-06-09 16:08 - 2017-06-09 16:08 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign2d56e8edc3b5bef8
2017-06-09 16:08 - 2017-06-09 16:08 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign1e1965c7a65edeb5
2017-06-09 14:24 - 2017-06-09 14:24 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsigna07d7dd132f63cc9
2017-06-09 14:19 - 2017-06-09 14:19 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign500849596712177f
2017-06-09 13:16 - 2017-06-09 13:16 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign84c7af2d1ca0f8ea
2017-06-09 13:16 - 2017-06-09 13:16 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign45af44735a42e238
2017-06-09 13:14 - 2017-06-09 13:14 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsignae7bbbd6b5090078
2017-06-09 13:09 - 2017-06-09 13:09 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign1b82f9186cd6ee83
2017-06-09 13:09 - 2017-06-09 13:09 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign174112b99727c4a2
2017-06-08 16:23 - 2017-06-08 16:23 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsigne2dd7acd8ff59937
2017-06-08 16:23 - 2017-06-08 16:23 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign6e4a63d5d91ff898
2017-06-08 16:22 - 2017-06-08 16:22 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign8a1a8568842d11ca
2017-06-08 16:22 - 2017-06-08 16:22 - 00000000 ____D C:\Users\Executive\AppData\Local\Tempzxpsign7b1083701104410b
2017-05-19 15:00 - 2017-05-19 15:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
CustomCLSID: HKU\S-1-5-21-2742664562-2827413676-3808203374-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-319E13BCA092}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
ContextMenuHandlers05: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {09961097-D339-4B23-A08E-62549E068B47} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {0AD52E2B-E9BB-4BF6-9B7E-28599B4ED11A} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION
Task: {13F08796-1835-4461-AC21-21185AD0D2D0} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {1C51B6F8-F31A-4ECE-ABBA-1C8D5B54356A} - \Adobe Acrobat Update Task -> No File <==== ATTENTION
Task: {1CCB8BEF-A091-4F9D-B20E-5646FC056B85} - \Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate -> No File <==== ATTENTION
Task: {243A1317-42BA-44AE-9697-5A1A74B88349} - \HPCustParticipation HP Officejet Pro X476dw MFP -> No File <==== ATTENTION
Task: {2708129E-7DA4-4646-A257-7F2432A0537F} - \Microsoft\Windows\UpdateOrchestrator\Maintenance Install -> No File <==== ATTENTION
Task: {30C7B8E0-50F4-4C59-B350-BF070D2DCE1D} - \Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance -> No File <==== ATTENTION
Task: {327B61DF-5ECF-4404-BF15-CF63D8AC62C8} - \IntelIOC-Upgrade-f1c8187b-2653-47cd-a9be-b554b98f68a7-Logon -> No File <==== ATTENTION
Task: {36855D79-841D-4953-8DFA-C8A14A3072B8} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot -> No File <==== ATTENTION
Task: {37EBE16E-8241-4F01-91D7-24487B1078A7} - \Microsoft\XblGameSave\XblGameSaveTaskLogon -> No File <==== ATTENTION
Task: {42318A0F-6253-4CB2-8EE1-42B03303DE80} - \IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 -> No File <==== ATTENTION
Task: {4520E8A9-AF06-4122-859B-E4B655B29B36} - \Microsoft\Windows\AppID\SmartScreenSpecific -> No File <==== ATTENTION
Task: {51B7FB15-4DCB-400E-9A98-10E802F21FB3} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceScreenOnOff -> No File <==== ATTENTION
Task: {54A83F92-66FE-4C22-88D5-7644CB844531} - \Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask -> No File <==== ATTENTION
Task: {59BED633-5221-4A79-B17B-CF4561D0CF1E} - \Intel PTT EK Recertification -> No File <==== ATTENTION
Task: {675F740E-BA1F-437A-877C-5AFC4DA0B64E} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {6D52318A-26A5-4AE5-B722-6AB41C804A95} - \AdobeAAMUpdater-1.0-DESKTOP-OV51NMC-Executive -> No File <==== ATTENTION
Task: {7E8D8330-5CA2-4B74-8D09-136C33A81D6F} - \IntelIOC-Upgrade-f1c8187b-2653-47cd-a9be-b554b98f68a7 -> No File <==== ATTENTION
Task: {8A9DBAA1-3290-4466-97C6-428B05344DE0} - \App Explorer -> No File <==== ATTENTION
Task: {8CD912D7-7D0B-40AA-B042-217AC7E2D810} - \AdobeAAMUpdater-1.0-MicrosoftAccount-bowdoingenevamainstreets@gmail.com -> No File <==== ATTENTION
Task: {959C3F70-533D-4204-A53A-73CF10E114F2} - \Microsoft\Windows\UpdateOrchestrator\Policy Install -> No File <==== ATTENTION
Task: {AC9EBE65-29DE-41DE-9322-39A9BCF0D20F} - \Hewlett-Packard\HP Support Assistant\Product Configurator -> No File <==== ATTENTION
Task: {B320E058-C6FA-413F-876B-0C9B4428AE66} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic6 -> No File <==== ATTENTION
Task: {BC3A3C35-3725-4D44-81D9-0BD28EA17587} - \Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources -> No File <==== ATTENTION
Task: {C6B2579B-4962-4D12-883D-BBD420573A6C} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic1 -> No File <==== ATTENTION
Task: {C9ACBFD2-20AA-4A3F-BE1A-A3D5279BB1BB} - \Microsoft\Windows\Plug and Play\Plug and Play Cleanup -> No File <==== ATTENTION
Task: {D19A2726-897E-4F7D-9CE4-0773B449CE9E} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceConnectedToNetwork -> No File <==== ATTENTION
Task: {D5C4E7F2-2A2F-4F31-BB8C-0812A06F3169} - \PDVDServ14 Task -> No File <==== ATTENTION
Task: {E54934E3-D88D-40AB-A06A-B92CC1DFE755} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display -> No File <==== ATTENTION
Task: {EB93672F-ED41-44BA-AFA2-BA44F914E55F} - \Microsoft\Windows\ErrorDetails\ErrorDetailsUpdate -> No File <==== ATTENTION
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
End::

4- Press Ctrl+s to save. Close the fixlist.txt file.
5- Press the Fix button.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

SECOND >>>>

Junkware Removal Tool
Please download JRT from here to your desktop.

Note: Temporarily disable/shut down your protection software now to avoid potential conflicts, how to do so can be read here.

Double click the JRT.exe file to run the application.

The application will open an Command Prompt window and run from there (this is normal for this program, so not to be alarmed).

When it is asked, press any key to allow the program to continue / run.

This will create a log on the desktop; please copy and paste the JRT.txt log text in your next post.

Note: After the log file is created, please enable your protection software / reboot your system and verify your protection software is enabled.

LAST >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

[/b][/color] Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C#].txt
[/ul]

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

muppest New Helpee Posts: 4	vosteran on google chrome Jul 6, 2017 13:03:53 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by muppest on Jul 6, 2017 13:03:53 GMT -8 Thank you! Here is the fixlog wikisend.com/download/424844/Fixlog.txt JRT log wikisend.com/download/282484/JRT.txt AdwCleaner wikisend.com/download/554792/AdwCleaner[C0].txt
	Last Edit: Jul 6, 2017 13:36:57 GMT -8 by muppest

dbrisen Malware Removalists Posts: 3,688	vosteran on google chrome Jul 6, 2017 21:44:46 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Jul 6, 2017 21:44:46 GMT -8 How is your system running now?
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

muppest New Helpee Posts: 4	vosteran on google chrome Jul 10, 2017 7:21:41 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by muppest on Jul 10, 2017 7:21:41 GMT -8 It seems better but it looks like vosteran is still showing up on chrome under "appearance". If i disable the "home button", i won't see vosteran as an option.
	Last Edit: Jul 10, 2017 7:24:13 GMT -8 by muppest

dbrisen
Malware Removalists

Posts: 3,688

vosteran on google chrome Jul 10, 2017 7:35:07 GMT -8

Quote

Post by dbrisen on Jul 10, 2017 7:35:07 GMT -8

First, try resetting the Chrome User Profile >>>>
Enter the keyboard shortcut (Windows key + E) to open Windows Explorer.

In the Windows Explorer window that appears enter the following in the address bar.
Windows Vista/ Windows 7/ Windows 8: %LOCALAPPDATA%\Google\Chrome\User Data\

Locate the folder called "Default" in the directory window that opens and rename it as "Backup default."
Try opening Google Chrome again. A new "Default" folder is automatically created as you start using the browser.

If that fails to fix the problem, please run the Chrome Cleanup Tool >>>>

Chrome Cleanup tool ==>> www.google.com/chrome/cleanup-tool/

Let us know how the system is after these fixes please.

Last Edit: Jul 10, 2017 7:36:09 GMT -8 by dbrisen

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

muppest New Helpee Posts: 4	vosteran on google chrome Jul 10, 2017 9:15:49 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by muppest on Jul 10, 2017 9:15:49 GMT -8 thanks. that seemed to work. would norton antivirus be sufficient enough to block malware?

dbrisen
Malware Removalists

Posts: 3,688

vosteran on google chrome Jul 10, 2017 12:12:27 GMT -8

Quote

Post by dbrisen on Jul 10, 2017 12:12:27 GMT -8

Yes, Norton will protect you against malware but be aware that malware is always updated and changing so no protection is 100% all the time.

If money is a concern, then you could consider some free protection products like Avast or AVG. They offer free to use products (you do have to register them however) that have the same scanner / protection engines that the paid for products use. If money is not a concern, then a paid full suite may be better as some include password managers, data backup, etc.

A good site to see and compare products is www.av-test.org .

Read Slowly and all of it.

If you still have a Addition.txt log file on your desktop, please delete it now.

Start FRST64 that is on your Desktop by double clicking and allowing the software to run when the User Access Control asks (if it does).

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Select Additional.txt in the Optional Scans section of FRST64 (if it is not already selected).

Press the Scan button.

It will make two logs (FRST.txt and addition.txt) on your Desktop. Please attach the logs in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply. (Ask if you don't know how to do either of these).

Notes:

If your Security software blocks the running or download of FRST / FRST64, please disable the security software or make an exception for this file. FRST is updated very frequently and is safe to run but because of the frequent changes (to keep up with newest malware techniques) most Security Software does not approve of the unknown file.

Right now the forum will not allow one to attach the Addition.txt file so please use wikisend.com or pastebin.com to upload the file and then post the download link here in your reply post.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

Post by muppest on Jul 5, 2017 12:31:05 GMT -8

Post by dbrisen on Jul 6, 2017 0:10:03 GMT -8

Post by muppest on Jul 6, 2017 13:03:53 GMT -8

Post by dbrisen on Jul 6, 2017 21:44:46 GMT -8

Post by muppest on Jul 10, 2017 7:21:41 GMT -8

Post by dbrisen on Jul 10, 2017 7:35:07 GMT -8

Post by muppest on Jul 10, 2017 9:15:49 GMT -8

Post by dbrisen on Jul 10, 2017 12:12:27 GMT -8