agafurretor removal?

[Tiemo]

Hello,

The adware agafurretor has installed itself on my computer. Agafurreor wants to download any malware in the background. Kaspersky prevents these downloads and reports this with 4 messages each.

Unfortunately, Kaspersky does not find the actual agafurretor program that causes these download requests, so I can not find and remove the culprit and so these download blocking messages pop up every few minutes. I couldn't find an installed extension in the Chrome browser either, nor could I find a Windows Autostart entry.

There are masses of "anti-spyware tools" on the internet that supposedly remove agafurretor, however they are most likely malware or subscription traps themselves (All offers look almost identical).

Does anyone have a tip where I can search?

Thanks

[Berny]

@Tiemo  Welcome.

Please check this important Topic from @richbuff  :

Link

 

[Tiemo]

Hi Berny,

thank you for jumping in.

I did a full scan with “detect other software” without any result.

In your guideline it says: “ After that, uninstall any recently installed junk > reboot.
After that, uninstall any and all junk toolbars > reboot.”

If I would know the name of the junk, I would love to uninstall it manually, but I don’t know, under what name it hides. the name “agafurretor” I only see in the URL of the Kaspersky message, which blocks the download. But there is no software, file, folder, plugin called agafurretor :(

I didn’t installed it manually, it was installed automatically as a side load of another downloaded software.

Thanks

 

 

[Berny]

@Tiemo Can you please post a screenshot from the Kaspersky message. 

[Tiemo]

@Berny sorry for the delay, my wife had the notebook…

attached you’ll find the screenshot of the Kaspersky warning. So it looks like Chrome tries to download the suspicious files every few minutes, which is prevented by Kaspersky. I tried to deinstall Chrome and install it from a new download, but the download gets still triggered.

The question is, where does Chrome gets the command from to download theses files? I didn’t found any Chrome plugin/extension.

A full scan from Kaspersky doesn’t find any suspicious files.

Thanks

Tiemo

[Berny]

@Tiemo 

Please run AdwCleaner as Admin and attach the TXT-Log in your next Post.
⚠ Please don’t clean eventual detections ⚠

[Tiemo]

@Berny 

I had adwCleaner run on sunday. It found 3 reg keys, which I have put into quarantine. But nothing else specific. See attached protokoll

After a restart, everything keeps the same, the four messages still pop up at irregular intervals after having Chrome started

Thank you

[Berny]

@Tiemo Please reset Google Chrome to default settings ?
Also, please  clear Browser cache & history + reboot.

[Tiemo]

I will try tonight and get back to you, thank you.

[Tiemo]

@Berny That did it! Up to now, the download requests are gone!

Thank you!

[Berny]

@Tiemo  The link displayed in your screenshot will be easier for further suggestions ...