[Bekah517]

Hello,

 

About a month ago, I noticed that the "incognito window" feature was completely disabled. I tried a common fix for this problem by editing the line for incognito window accessibility in the registry. ex. see (https://productforum...ome/jm1MuXi7-dc)

I looked around online to find the issue, and then found that the most similar issues for others were related to adware extensions in Chrome. Sure enough, when I went into Chrome settings there was an unknown extension. The extension entry looked like this:

 

TypingClub 6.0

Permissions Visit website

ID: obdbgibnhfcjmmpfijkpcihjieedpfah

(This extension is managed and cannot be removed or disabled.)

Allow in incognito

 Options

Enabled Installed by enterprise policy.

 

I found out that enterprise policies were generally administrative, and that I had no power to disable the extension myself. I knew, however, that this was the way adware extensions also appeared. This is so you can't delete it, and it disables incognito because incognito disables extensions (and, thus you could in that way get around the adware).

I continued in my search and found a few sites that provided detailed step by step removal. see (http://www.fixyourbr...rome-extension/) and (http://malwaretips.c...policy-removal/)

 

The only problem was that this extension was not a commonly named adware program (as in, not one of the extensions named in the tutorials). I went through the processes on the two pages mentioned above, but with little results. For example, one step is to uninstall unwanted programs in the control panel, but there were none in my list that were either mentioned in the instructions or that were unknown.

Another was to search for the ID of the extension in the registry; this step allowed that the ID would be different for different people, but the ID of my extension was not found there at all. However, though many steps did not achieve results, one did follow through just as it was supposed to, so my suspicions of this being the problem were solidified. I'll attach as a thumbnail the extension policy found in Chrome Policies, which includes some of the information I used while trying to fix the problem, in case it's helpful. I wanted to paste a screen shot right here, but it wouldn't let me.

 

Lastly, I conducted a complete system scan with Avast! Security, but no "infected file" results were found.

 

I couldn't move forward for a while - I couldn't find any additional help - and nothing seemed to be affected by the adware beside the incognito feature, which was not a big issue to me. So I basically just left it alone and continued with my normal tasks.

 

Then today, a bigger issue occured. I had just cleared my cache, which was slowing down my video playback, and returned to the video page. I clicked to play the video, but instead of playing, the page switched to a completely different website (not just a popup in front of the video). This website was bascially a giant ad for something - the "Only 30 minutes left to get this Special Offer!" type ad. I didn't pay attention to the URL or what the ad was for, because I assumed I had accidentally clicked on an ad. I pushed the back button to get back to where I wanted to be, and a small popup came up saying something along the lines of "Are you sure you want to leave this page? You will lose this offer if you leave! Push continue to recieve this offer!" I knew not to click on anything there, and proceeded to click on the close tab button.

Just as I got there, though, Chrome stopped responding, then crashed. But worse, a blue screen appeared saying the system had to make an emergency shut down. It also said I could investigate the error after with this code: 0xc000021a. When it started back up, I went into Mozilla to research this code. I instantly got several pages about this error code. I looked briefly at a few of the top results that came up. see (http://answers.micro...d5-e8807d3452f6) and (http://msdn.microsof...7(v=vs.85).aspx)

These said that "blue screen errors" occur when the computer's security is compromised and is to protect the computer from data loss. It can be due to third-party applications. At this point, it is definitely time to get professional help directly. I've used Geeks To Go before for much smaller issues, but have noticed the malware help section. It immediately came to mind when this happened. Hopefully I will be able to get timely help, so nothing else will be damaged.

 

(There are only two programs that I have installed in the time vicinity of the extension appearing: "GeoGebra" and "Graphical Analysis". [I do check extensions and settings pretty regularly, so I know the extension wasn't there at certain points.] Both of these I previously had installed on another computer, and never had any problems or malware connected with them. Either a newer version of one of these than I had on the other computer is responsible, or something else altogether is causing this. I have temporarily uninstalled both of these to be safe, although that doesn't mean at all that infected files aren't left and hidden elsewhere if these programs are the issue.)

 

I've tried to include all the details of the problem and any links or information I've used. And hope it hasn't been way too long because of that. If anything is missing, please let me know and I'll get the information if I can. THE "OTL QUICK SCAN LOGS" ARE ATTACHED AS FILES.

 

Thank you so much!

Attached Thumbnails

• 

Attached Files

•  OTL.Txt   113.46KB   213 downloads
•  Extras.Txt   59.62KB   307 downloads