Solved How can I permanently remove GoSaVeu browser extension?

[ZingFreelancer]

How can I remove GoSaVeu web browser extension, for ever?

I use Windows 7 Ultimate 64-bit and my main browser is Google Chrome (I still have Firefox and IExplorer installed). Every time I start Chrome Avast would report that it has blocked a threat and it will continue periodically reporting the same threat until I remove GoSaVeu from my extension list in Chrome.

Funny thing, after a reboot it returns back to Chrome! GoSaVeu has been haunting me for days now! Nothing what I have tried helps! I tried running avast virus scan in DoS mode, GoSaVeu still remained. Going into Safe Mode and deleting the extension there. Deleting Program files related to GoSaVeu in safe mode. Deleting everything that has anything to do with GoSaVeu from registery in safe mode. Running CCleaner in save mode. Resetting Chrome settings in safe mode.

I tried everything recommended on http://www.fixyourbrowser.com/removal-instructions/remove-gosave-ads-adware-virus-removal-guide/ save for countless anti-malware/virus softwares.


Basically, how do I remove GoSaVeu and keep it removed?


Thank you for your assistance,
ZF

 

[ZingFreelancer]

Okay I basically figured it out, there were some additional files located in AppData that kept on reviving it.

If you turn on Developer Mode in Chrome you will see from where the extension is loading from, I followed the path and deleted this whole ocdnj...kmf folder. In addition the same folder is present in Chrome SxS\User Data\Default\Extensions. You have to do it for every user account including Administrator and Guest accounts.

In addition to cleaning it from Google Chrome folder, you must look for a folder in AppData/Local called Torch. As there will be present a folder with the exact same extension folder name and files, delete that folder for every user.

 

[cyrilhubert]

I think your Chrome registry has been changed. I am not good at this as I am always getting hit by malware thanks to free extensions that are booby trapped by the wicked ppl. Usually downloading something from bleepingcomputers.com to flush the DNS and etc will do the trick. But I have reservations that those things will add malware behind my back esp csrss.exe and conhost.exe.

 

[cyrilhubert]

What is GoSaveu function?

 

[cyrilhubert]

Do you have AV installed not Windows Defender or MSE but something else?
Not an AV extension but a real free or commercial standalone or packaged AV.
If not do download immediately.
Now I know why some ppl like to re-installed their Win7 all the time due to damages.

 

[ZingFreelancer]

Of course I have AV, did I not mentioned Avast in post?
In addition I am not sure what GoSaveu does, the information on the interneet is rather limited, but I am 99% sure that it's harmful.

I have resolved the issue and posted the solution in my second post.

 

[EvaGreenLove]

Seems that your browser has suffered browser hijack redirect infection. it will keep affecting your add-ons, extension and other items on your Chrome.
You can see this link and try if you can fix the problem, I get a similar threat and finally remove it. Good luck
Appstein.info Redirect Removal Guide | PC Sgo

 

[aritra2116]

Look like you have an adware infection. Let's give AdwCleaner and JRT a shot.

Download AdwCLeaner from here : AdwCleaner Download

Shut down any security software you may have and run the tool as an administrator.

Accept the terms and conditions on the screen and click on the Scan button. It may take a little time to scan depending on your computer. After the scan finishes, save any important files before proceeding and then click on the Clean button.

The computer will restart automatically. After the computer restarts, the log will be displayed on the desktop. The log usually lies in the AdwCleaner folder of your C: drive. Attach those logs with your next post.

Download JRT from here : http://www.bleepingcomputer.com/download/junkware-removal-tool/

Shut down any security software you may have and run the tool as an administrator. The tool will start and ask you if you want to continue with it. Press Enter to continue. The scan will take some time depending on your computer. Windows Explorer may restart many times. This is completely normal, don't panic. After the scan finishes, restart the computer. The JRT log will be on the desktop. Attach the log with your next post.