Safesaver, can't get rid of it!

Zascar

Normally I'm very careful and never get malware but I picked up a few recently, the main one being safesaver. It I've searched and the remove instructions are to uninstall the program from add/remove programs, then delete the extension from chrome. The thing is, there are no entries for either! I;ve tried malware bytes (pro trial) and it finds nothing!

What can I do? Any recommendations for a good(unintrustive) protection tool?
Thanks

Pov06

Have a look here if you didn't already:
http://malwaretips.com/blogs/safe-saver-virus-removal/

jsa112

run adwcleaner

http://www.bleepingcomputer.com/download/adwcleaner/

Zascar

Thanks guys, so I have done everything on those pages - and still the dam thing is here!

What the virus/malware does it highlight random words on all web pages, making them look like links, and then a popup add appears upon hover showing an add

I may end up reinstalling windows, I hate all this crap on my system and messing around trying to get rid of it.

Anything else I can try?

jsa112

yep

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Quick Scan button. Do not change any settings. The scan wont take long.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files here

Zascar

Thanks, both files attached

jsa112

not seeing much, no need to attach the logs in the future

open OTL click the None button at the very top, copy and paste this into the box


C:\Program Files (x86)\*.*
C:\Program Files (x86)\*.
C:\Users\Colin\AppData\Roaming\*.
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
SaveMBR:0
createrestorepoint
%systemroot%\*. /mp /s
C:\*.*
showhidden


click run scan post the log

Zascar

Thanks for the help jsa - much apreciated

New scan results attached

jsa112

your logs aren't showing anything at all for it. best advice I can give is to disable your chrome extensions one at a time until you find which one is causing your problems

Zascar

Ahh thanks I never thought of that!

Ok disabled a load and so far is seems to be gone! Phew! Ok now just to find the corporate.

Cheers for the help that was driving me nuts
z

brianon

Guys. My Chrome has been taken over by SafeSaver. I've tried everything to remove it but it keeps coming back.

I can see the extension in Chrome but it's actually listed as "NewSaover 1.1" ?

Google is showing up nothing for this though.

jsa112

uninstall that extension