Adware reinstalling: Adware.eLex.shrClin

[pgmigg]

Hello chriskg22,

Well...
Honestly, I was a little surprised to read your previous post, but this just says that I underestimated the danger of infection and its survivability - I apologize!

It seems to me now that it is the Google SYNC activity prevented complete cleanup.
So, you need to set it to Off so the cleanups can proceed. Then much later when all done, you can turn it back on...

Step 1.
Turn off sync and reset it
If you turn off sync, you can still see your bookmarks, history, passwords, and other settings on your computer. If you make any changes, they won't be saved to your Google Account and synced to your other devices.
When you turn off sync, you’ll also be signed out of other Google services, like Gmail.

1. Please close all opened browsers.
2. Then open Google Chrome browser.
3. At the top right, click on Profile Picture and pop-up screen will appear - you will see the Sync is on link - click on it.
4. Click on Turn off.
5. Using Chrome browser go to https://www.google.com/settings/chrome/sync and sign into your account.
6. Scroll down until you see the RESET SYNC button and click on it. At the prompt click on Ok.
7. Please close Chrome.

Step 2.
Scan and Clean with AdwCleaner.

1. Please close all open programs and windows.
2. You should still have the AdwCleaner.exe on your Desktop. If it not, please download AdwCleaner and save it to your Desktop.
3. Double click AdwCleaner.exe to run it. If it will ask for update please decline it.
4. Click Yes on UAC question and I Agree on Welcome window.
5. Click Scan now button and wait for a while until the scan finish... if something will be found you will see Scan results, then click on Quarantine button.
6. At the finish of Quarantine process, AdwCleaner will ask you to restart - please allow it.
7. On reboot a log will open AdwCleaner[Cxx].txt. Copy and paste the contents of that log file in your reply.
8. You can also find the most recent log file at C:\AdwCleaner\AdwCleaner[Cxx].txt.

Step 3.

• After computer restrt,please update Malwarebytes and run a quick scan one more time to be sure that in this case all bad founds were gone forever. Place scan report content in your next reply.
• Please don't switch Google Sync to On until I ask you to do it! <----- Important!

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of the most recent AdwCleaner[Cxx].txt log file
3. Contents of the Malwarebytes log file
4. Do you see any changes in computer behavior?

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

[chriskg22]

I reset google sync and have not reactivated it.

I cleaned with the adwCleaner and have posted logs below and then ran Malwarebytes and posted log below.

I have not noticed any changes in computer behaviour.

# -------------------------------
# Malwarebytes AdwCleaner 8.0.6.0
# -------------------------------
# Build: 06-24-2020
# Database: 2020-06-15.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 07-03-2020
# Duration: 00:00:03
# OS: Windows 10 Home
# Cleaned: 12
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted Conduit Search
Deleted SNPedia (en)
Deleted howmanymilestoba
Deleted http://www.mystartsearch.com/?type=hp&t ... K7CHHSK7CX
Deleted http://www.mystartsearch.com/?type=hp&t ... K7CHHSK7CX
Deleted http://www.mystartsearch.com/?type=hp&t ... K7CHHSK7CX
Deleted http://www.mystartsearch.com/?type=hp&t ... K7CHHSK7CX
Deleted http://www.trovigo.com/?gd=&ctid=CT3324 ... 1CG2_sp_ch
Deleted mystartsearch
Deleted mystartsearch
Deleted mystartsearch
Deleted mystartsearch

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1703 octets] - [27/06/2020 16:39:56]
AdwCleaner[C00].txt - [1765 octets] - [27/06/2020 16:41:01]
AdwCleaner[S01].txt - [2698 octets] - [29/06/2020 20:43:21]
AdwCleaner[S02].txt - [2759 octets] - [30/06/2020 17:18:07]
AdwCleaner[C02].txt - [2693 octets] - [30/06/2020 17:18:17]
AdwCleaner[S03].txt - [2770 octets] - [02/07/2020 22:59:32]
AdwCleaner[S04].txt - [2831 octets] - [03/07/2020 17:30:18]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C04].txt ##########

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 03/07/2020
Scan Time: 17:35
Log File: 2b516704-bd4b-11ea-8390-e0d55e2ddd38.json

-Software Information-
Version: 3.8.3.2965
Components Version: 1.0.629
Update Package Version: 1.0.16910
Licence: Free

-System Information-
OS: Windows 10 (Build 18362.900)
CPU: x64
File System: NTFS
User: DESKTOP-263AI8E\cgrog

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 296485
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 7 min, 53 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Generic.Malware/Suspicious, C:\USERS\CGROG\DESKTOP\CODECHECK.EXE, No Action By User, [0], [392686],1.0.16910

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

[pgmigg]

Hi chriskg22,

Right now your logs look like much better than before!

It is a time to go to Google Chrome and turn back the Sync on.

Step 1.
The C:\USERS\CGROG\DESKTOP\CODECHECK.EXE is one of the scanners I asked you to download and use - you can simply delete it from the Desktop.

Step 2.
Sign in and turn on sync
To turn on sync, you'll need a Google Account.

1. Please close all opened browsers.
2. Then open Google Chrome browser.
3. At the top right, click on Profile Picture and pop-up screen will appear.
4. Sign in to your Google Account.
5. If you want to sync your info across all your devices, click Turn on sync and then Turn on.

Please let me know if you have any questions or concerns.

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

[chriskg22]

Hello thanks again for all your help since, restarting google sync and rebooting computer the files appear to be permanently gone. I have run malwarebytes and the logs have come up totally clean.

[pgmigg]

Hi chriskg22,

I am happy that I could help you finally and you are very welcome, chriskg22!

Since you don't have any questions I will go ahead and close this post. Take care and stay safe!

As your problems appear to have been resolved, this topic is now closed.
We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received,
please see Feedback for Our Helpers - Say "Thanks" Here

Ever thought of helping people yourself ?

If you found the process of removing Malware from your own machine interesting, and it has made you want to learn more, and maybe to help others with their Malware problems, then this forum runs a training course to help you do just that.

Apply to the Malware Removal University and see if you have what it takes to become a helper on the forums.