Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't Remove WhiteSmoke Google Chrome Extension


  • Please log in to reply
12 replies to this topic

#1 DavidWu007

DavidWu007

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:26 AM

Posted 13 December 2013 - 06:27 PM

Greetings people!

 

I recently un-installed a program by the name 'Wise Registry Cleaner' because I figured it was useless.

I used the method of control panel to remove it.

Directly after un-installing it, I get multiple popups.

It opened Google Chrome as well, leading me to the Wise Registry Cleaner's website.

There was a popup that said a 'WhiteSmoke' extension was installed.

My Chrome was completely re-themed and all my settings have been modified.

 

I tried to fix it by deleting the 'WhiteSmoke' extension but it did not appear under chrome://extensions/.

In fact, none of my previously installed extensions were showing up.

At that point I knew I had a problem so I ran multiple full scans with Hitman Pro, Microsoft Windows Malicious Removal Tool, Microsoft Security Essentials, Malwarebytes Anti-Malware, and IObit Malware Fighter. 

None of them found any threats.

I tried using TDSSKiller, Adwcleaner, JRT, and RKill to no success.

All I could manage was to remove the Conduit search engine option and clear my cache and browsing history.

 

I have a Dell Studio 1735 running Vista Ultimate 32-bit.

Google chrome is my default browser.

I'm not sure if this is the only infection/issue on my laptop so any help is greatly appreciated.

Please and thank you!

 

P.S. I noticed my Chrome is very buggy.

 

fkCONDUIT.jpg


Edited by DavidWu007, 14 December 2013 - 01:59 AM.


BC AdBot (Login to Remove)

 


#2 Roodo

Roodo

  • Members
  • 760 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:26 AM

Posted 13 December 2013 - 06:34 PM

Try this:
http://malwaretips.com/blogs/remove-whitesmoke-toolbar/

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,141 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:26 AM

Posted 13 December 2013 - 06:54 PM

Please download and use the following tools (in the order listed) which will search for and remove many potentially unwanted programs (PUPs), adware, toolbars, browser hijackers, extensions, add-ons and other junkware as well as related registry entries (values, keys) and remnants.

RKill created by Grinler (aka Lawrence Abrams), the site owner of BleepingComputer.
AdwCleaner created by Xplode.
Junkware Removal Tool created by thisisu.

1. Double-click on RKill to launch the tool. A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

Important: Do not reboot your computer until you complete the next step.

2. Double-click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
-- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on each one and uncheck any items you want to keep (except you cannot uncheck Chrome and Firefox preferences lines).


Close all open programs and shut down any protection/security software to avoid potential conflicts.

3. Double-click on JRT.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log file named JRT.txt will automatically open and be saved to your Desktop.
  • Copy and paste the contents of JRT.txt in your next reply.
4. As a final step, download and scan with Malwarebytes Anti-Malware.

To restore the default settings in Google Chrome, please refer to:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 DavidWu007

DavidWu007
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:26 AM

Posted 13 December 2013 - 11:29 PM

I did as instructed.

 

AdwCleaner log:

 

# AdwCleaner v3.015 - Report created 13/12/2013 at 20:06:37
# Updated 10/12/2013 by Xplode
# Operating System : Windows Vista ™ Ultimate Service Pack 2 (32 bits)
# Username : David - DAVID-PC
# Running from : C:\Users\David\Desktop\AdwCleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
File Deleted : C:\Uninstall.exe
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v9.0.8112.16520
 
 
-\\ Mozilla Firefox v
 
[ File : C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js ]
 
 
-\\ Google Chrome v
 
[ File : C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 
*************************
 
AdwCleaner[R5].txt - [891 octets] - [13/12/2013 20:05:54]
AdwCleaner[S4].txt - [815 octets] - [13/12/2013 20:06:37]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [874 octets] ##########
 
And my JRT log:
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows Vista ™ Ultimate x86
Ran by David on 13/12/2013 at 20:13:16.32
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13/12/2013 at 20:25:50.70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Edited by DavidWu007, 13 December 2013 - 11:30 PM.


#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,141 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:26 AM

Posted 14 December 2013 - 06:45 AM

Did you restore the default settings in Chrome?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 DavidWu007

DavidWu007
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:26 AM

Posted 14 December 2013 - 04:05 PM

I reset the Chrome browser settings.

Still not fixed.


Edited by DavidWu007, 14 December 2013 - 04:35 PM.


#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,141 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:26 AM

Posted 14 December 2013 - 06:04 PM


Please download and scan with Emsisoft 1 minute Cloud MalAware Scanner.

This is a fast cloud based scanner used to provide an indication of whether your computer is infected with malware. If Emsisoft MalAware detects that your system is infected, you can download and install the full Emsisoft Anti-Malware 30 day trial version, run a thorough scan and remove what was detected.

If you do not want to download the trial version, you can perform a scan with Emsisoft Web Malware Scanner which contains the same dual-engine scanner features of Emsisoft Anti-Malware to include cleaning and quarantine.
-- Vista/Windows 7/8 users need to run Internet Explorer as Administrator. To do this, right-click on the Internet Explorer icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.

Note: This scanner is based on ActiveX technology and only supports Internet Explorer with ActiveX enabled to run correctly.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 DavidWu007

DavidWu007
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:26 AM

Posted 14 December 2013 - 06:28 PM

XXXX_24432.jpg

 

Apparently it can't find anything.

 

I don't think I want to be installing any new programs for now and the fact that it is only a trial.

I have a lot of current anti-malware software and I don't want to risk getting more infections.


Edited by DavidWu007, 14 December 2013 - 06:29 PM.


#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,141 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:26 AM

Posted 14 December 2013 - 06:59 PM

I understand.

In all probability, the files related to WhiteSmoke have been removed. What you're most likely dealing with is some setting within Chrome itself or the user profile which is allowing it to still show.

I don't use Chrome so I can't poke around but I have heard complaints that some of their settings are hard to find.

What you may want to try next is Create a new browser user profile in Google Chrome.

If that does not resolve the problem, then I would perform a complete removal of Chrome to include all folders, files, and user profiles...then do a clean install.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 DavidWu007

DavidWu007
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:26 AM

Posted 14 December 2013 - 08:08 PM

Well I guess I'm going to straight-up remove everything just to be safe.

I use this computer to do banking and buying stuff so I need to be 100% sure it is safe.

 

I'm going to be using Revo Uninstaller.

 

I'll post back if I have any issues that come up.


Edited by DavidWu007, 14 December 2013 - 08:09 PM.


#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,141 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:26 AM

Posted 14 December 2013 - 08:38 PM

Revo provides a listing of all installed software by installation date and when removing a program, Revo does a more comprehensive job of searching for and removing related registry entries, files and folders.

How to use Revo Uninstaller
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 DavidWu007

DavidWu007
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:26 AM

Posted 14 December 2013 - 10:56 PM

I finished uninstalling and installing Chrome all over. 

After logging back onto my Google account, it started syncing my information in.

 

I noticed conduit as a search engine option so I removed it. 

Besides that, I can't actually notice any other symptoms of WhiteSmoke.

 

WTFCONDUIT.jpg

 

Are there any major privacy threats WhiteSmoke can cause?


Edited by DavidWu007, 15 December 2013 - 01:54 AM.


#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,141 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:26 AM

Posted 15 December 2013 - 09:32 AM

WhiteSmoke Toolbar is categorized as a Potentially Unwanted Program (PUP) and browser hijacker which changes your browser home page, changes your default search engine and installs an unwanted toolbar.

For more information about PUPs and how they are installed, please read About those Toolbars and Add-ons which change your browser settings
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users