ARRGGHH - computer issues

[JPSmit]

This seems to go back to the end of the year when I was trying to get some online support for a photobook that I was creating. Tech support said try in IE - opened IE and it promptly download about 7 pieces of malware. Then he had me try Firefox - which didn't help. I have removed the malware so far as I know, but, now in Chrome, I have an extension that won't go away - and I can't figure out what it even is. I have attached a screen shot - when I cut and paste the name (ExStraCCoUpeon) I get no responses. If I delete it in the extensions window, the next time I re-start chrome, it reappears. Though it does not reappear if I simply open a new tab. I have tried to re-do the opening page in settings - and am stumped. Help!

 

[NutmegCT]

Yep - you got infected. I'd suggest you immediately download Malwarebytes. Then unplug your internet cable, start up in Safe Mode, and run Malwarebytes. It usually catches what other apps miss.

Let me know if you have questions.
Tom

 

[JPSmit]

thanks Tom - will do

 

[BustedKnuckles]

You know things aren't going to go well when even Google has no record of "ExStraCCoUpeon"!

 

[JPSmit]

well, we are sort of back where we started. I downloaded Malwarebytes and ran it (admittedly in regular not safe mode) It found a bunch of malware (like 64) I delted them all, but then the computer wouldn't restart. It got past the welcome screen and then turned black with the cursor and nothing more. So, i restarted it in safe mode, restored it to a few days ago and it works again. However, the extension is still there. So, it might be in for a tuneup tomorrow. I hate computers.

 

[NutmegCT]

JP - keep in mind that if you did a System Restore, the restore image may also have the "bad stuff". You'd have to restore to a date *before* you had the unfortunate Photobook adventure. Also, be sure to run Malwarebytes in safe mode, after you do the restore.

Tom

 

[BustedKnuckles]

Using safe mode is important to expose malware that might be hidden in a running process. I might also suggest enabling "show hidden files, folders and drives" before the scan.

I have more success using "ComboFixRemover" to expose these kinds of hidden bugs.

 

[DrEntropy]

There have been instances where the "bug" will recognize the Malwarebytes executable and disallow it from installing completely. Access to a machine sans infection is beneficial, download the Malwarebytes exe file and burn it to a CD/DVD as a renamed .exe file. Then in safe mode on the infected machine, install/run it.

 

[JPSmit]

Well, the good news is that I got rid of the hard drive nasties. Downloaded Malwarebytes, res-started in safe mode - did the scan - deleted them - uninstalled malwarebytes and Bob's your Uncle. Sadly, it had not done a thing for the extension, so, onward through the fog!

 

[JPSmit]

Gone - finally. I found the folder in my program files along with a few others. That plus cleaning history/cache/cookies plus another program called Hitman (though don't install from CNET as it installs even more malware) plus repeated use of CCleaner plus a little side visit to the registry to delete another program (browse to save) and I am good to go. Thanks for all your help - and especially for the Safe Mode reminders and software recommendations - I love this place!

 

[BustedKnuckles]

Sounds like a major search-and-destroy... good job!

 

[NutmegCT]

" ... Hitman (though don't install from CNET as it installs even more malware"

Good grief - Can you give us more detal on that?

Anyway, glad you got it fixed.

Tom

 

[JPSmit]

" ... Hitman (though don't install from CNET as it installs even more malware"

Good grief - Can you give us more detal on that?

Anyway, glad you got it fixed.

Tom

may have been my inadvertant fault. I had to click through a number of screens to get the download. They might have been me "approving" the other downloads.