Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unwanted Chrome Extension : Coupon Companion


  • Please log in to reply
5 replies to this topic

#1 hockeymidget8

hockeymidget8

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Local time:06:23 AM

Posted 13 April 2013 - 07:41 PM

Hello. I've been dealing with this annoying add-on in chrome calling itself Coupon Companion that I certainly never intentionally installed. It hyperlinks random words in text when I am browsing online and causes a popup to come up whenever I hover over the word. When I try to remove this extension in chrome, by going to settings --> extensions, the checkbox is greyed out and there is a message saying "This extension is managed and cannot be removed or disabled". I've run a Malwarebytes scan but it didn't get rid of it.

 

I'd appreciate any help you could offer.



BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:23 AM

Posted 13 April 2013 - 08:54 PM

p22002970.gif Please download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

 

p22002970.gif Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.


My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#3 hockeymidget8

hockeymidget8
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Local time:06:23 AM

Posted 13 April 2013 - 11:26 PM

# AdwCleaner v2.200 - Logfile created 04/13/2013 at 23:44:24
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Owner - OWNER-PC
# Boot Mode : Normal
# Running from : C:\Users\Owner\Downloads\adwcleaner.exe
# Option [Delete]
 
 
***** [Services] *****
 
 
***** [Files / Folders] *****
 
File Deleted : C:\END
Folder Deleted : C:\ProgramData\Speedbit
Folder Deleted : C:\Users\Owner\AppData\Local\PackageAware
Folder Deleted : C:\Users\Owner\AppData\LocalLow\Speedbit
Folder Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\fbjof0gd.default\jetpack
 
***** [Registry] *****
 
Key Deleted : HKCU\Software\SpeedBit
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKLM\Software\SpeedBit
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
 
***** [Internet Browsers] *****
 
-\\ Internet Explorer v9.0.8112.16476
 
[OK] Registry is clean.
 
-\\ Mozilla Firefox v15.0 (en-US)
 
File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\fbjof0gd.default\prefs.js
 
Deleted : user_pref("extensions.alotab.instance.13.store_data", "%7B%221saleaday.com%22%3A%7B%22i%22%3A%223786[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.InstallationTime", 1362632427);
Deleted : user_pref("extensions.crossriderapp21804.21804.active", true);
Deleted : user_pref("extensions.crossriderapp21804.21804.addressbar", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.addressbarenhanced", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie.InstallationTime.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie.InstallationTime.value", "1362632427");
Deleted : user_pref("extensions.crossriderapp21804.21804.description", "Coupon Companion");
Deleted : user_pref("extensions.crossriderapp21804.21804.domain", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.group", 0);
Deleted : user_pref("extensions.crossriderapp21804.21804.homepage", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.iframe", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.name", "Coupon Companion Plugin");
Deleted : user_pref("extensions.crossriderapp21804.21804.newtab", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.opensearch", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.pluginsurl", "hxxp://app-static.crossrider.com/plugin[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp21804.21804.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp21804.21804.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.thankyou", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp21804.21804.ver", 0);
Deleted : user_pref("extensions.crossriderapp21804.bic", "13cf6365300ff128316872deb3c7ca16");
Deleted : user_pref("extensions.crossriderapp21804.firstrun", false);
Deleted : user_pref("extensions.crossriderapp21804.installationdate", 1362632427);
Deleted : user_pref("extensions.crossriderapp21804.lastcheck", 22723344);
Deleted : user_pref("extensions.crossriderapp21804.lastcheckitem", 22723344);
Deleted : user_pref("extensions.crossriderapp21804.modetype", "production");
Deleted : user_pref("extensions.crossriderapp21804.reportInstall", true);
 
-\\ Google Chrome v26.0.1410.64
 
File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Preferences
 
[OK] File is clean.
 
*************************
 
AdwCleaner[R1].txt - [31057 octets] - [27/02/2013 00:46:32]
AdwCleaner[R2].txt - [1272 octets] - [05/03/2013 23:10:57]
AdwCleaner[R3].txt - [4816 octets] - [13/04/2013 23:43:37]
AdwCleaner[S1].txt - [31492 octets] - [27/02/2013 00:47:23]
AdwCleaner[S2].txt - [324 octets] - [05/03/2013 23:12:44]
AdwCleaner[S3].txt - [4847 octets] - [13/04/2013 23:44:24]
 
########## EOF - C:\AdwCleaner[S3].txt - [4907 octets] ##########
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.8.3 (04.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Owner on Sun 04/14/2013 at  0:08:09.21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] hkey_current_user\software\sweetim
Successfully deleted: [Registry Key] hkey_local_machine\software\sweetim
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\Users\Owner\appdata\local\directdownloader"
Successfully deleted: [Folder] "C:\Users\Owner\appdata\local\updater21804"
Successfully deleted: [Folder] "C:\Users\Owner\appdata\locallow\datamngr"
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{0295CF5D-37F9-4B6E-8DCA-9FAABB917843}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{1AB16CE2-1C08-45AD-B030-5963137A7A86}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{2E4193AA-BB5B-4CAA-B650-34C321C65A03}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{3744B133-7E8C-4BBB-AF9B-69E7691E3A15}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{5B6410CF-32E8-41A8-83B4-8A3E1980A934}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{6BC08B7D-EDDE-4EF1-A97C-0E469C322364}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{707C03F4-7D5D-412E-8560-B60FBD8E2106}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{78840270-CF94-4B28-B347-61190853B731}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{9F50FAB2-3807-4595-B598-4E2F7D0F4442}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{A89F1EEC-F5EA-4BD2-B977-1902C5A3E209}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{B5E9596D-ABAB-4315-927D-C738AF2B6AD3}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{B928C1CE-A193-45BE-9F96-2EFE82698884}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{C72F30A0-32F6-4395-ADC2-952EEB461F52}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{CDEEA7FA-A4E3-4115-ACD7-34FEF48BEC79}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{D3EF1825-E8D1-4F68-B9BE-71A9A3BBB98E}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{D4D90EF9-B716-40E8-A966-F91181B6BAF8}
Successfully deleted: [Empty Folder] C:\Users\Owner\appdata\local\{DC2E57C2-0ECC-46DF-9EAA-E1E8BE1E15E3}
 
 
 
~~~ FireFox
 
Successfully deleted: [Folder] C:\Users\Owner\AppData\Roaming\mozilla\firefox\profiles\fbjof0gd.default\extensions\appbar@alot.com
Successfully deleted: [Folder] C:\Users\Owner\AppData\Roaming\mozilla\firefox\profiles\fbjof0gd.default\extensions\extension21804@extension21804.com
Successfully deleted the following from C:\Users\Owner\AppData\Roaming\mozilla\firefox\profiles\fbjof0gd.default\prefs.js
 
user_pref("extensions.alotab.errorUrl", "hxxp://search.alot.com/error?src_id=30046&client_id=0859681c2c547ec84cfcb30a&camp_id=2988&install_time=2011-10-03T18:40:14Z&pr=errs&tb
user_pref("extensions.crossrider.bic", "13cf6365300ff128316872deb3c7ca16");
Emptied folder: C:\Users\Owner\AppData\Roaming\mozilla\firefox\profiles\fbjof0gd.default\minidumps [32 files]
 
 
 
~~~ Chrome
 
Successfully deleted: [Registry Key] hkey_local_machine\software\policies\google\chrome\extensioninstallforcelist
Successfully deleted: [Folder] C:\Users\Owner\appdata\local\Google\Chrome\User Data\Default\Extensions\aoiidodopnnhiflaflbfeblnojefhigh
Successfully deleted: [Folder] C:\Users\Owner\appdata\local\Google\Chrome\User Data\Default\Extensions\jneaojaoiajhnemidnjhoempalnidbhj
Successfully deleted: [Registry Key] hkey_local_machine\software\google\chrome\extensions\lkpmjnommfoljgjbckjmjhkmnhfmcmon
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 04/14/2013 at  0:24:09.34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 


extension appears to be gone now :)



#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:23 AM

Posted 13 April 2013 - 11:46 PM

Cool beans :)


My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#5 D2iH8c

D2iH8c

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:23 AM

Posted 25 April 2013 - 03:06 AM

Cool beans :)

I registered & plan on staying around because I have been racking my brain trying to get CC off my laptop.  Normally I am extremely careful & was even thinking about a month ago how I never have any problems & keep my systems running in top shape then come to find out this crap is was on there.  I tried various tools (HJT, Spybot, etc etc) all to no avail.  However, the two tools you linked to did the job!  Thanks so much :D

 

D2iH8c



#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:23 AM

Posted 25 April 2013 - 10:27 AM

You're very welcome p22002759.gif


My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users