Posted on 2015-02-11
This is a laptop running Windows 8.1 and IE11. Following some downloads of free games by grandchildren I was left with some unwanted adware and BHOs on the machine. In particular it was impossible to search or visit websites without unwanted pages, ads, videos and sponsored links appearing. I ran a scan with Malwarebytes Anti-Malware which cleared most of it but there were two enabled entries left in the Manage Addons section of IE which looked very suspicious as they were obviously misspelt words. When I tried to disable these I found that the Enable and Disable buttons were grayed out. I subsequently did some Googling and found that I could right click the entries, choose "More Information" and then copy the information there. By pasting the info into Notepad I could copy the Class ID and use this in the registry to delete any entries referring to the addons.
I did this for both entries and they did indeed disappear from IE. For a couple of days everything was fine until suddenly today the ads and unwanted web pages started popping up again. I knew I had not downloaded anything in the meantime but when I looked in the Manage Addons window again there were two new entries, both misspelt but different words to the ones before and once again it is not possible to disable them as the buttons for this are grayed out.
The names of the current suspect Addons are 'loWrrate' and 'offErapP' but I suspect the names mean nothing as the previous ones which I removed had different but similarly unintelligible names. The names appear to refer to marketing terms, Low Rate and Offer App, and the previous ones were of a similar nature. I imagine the misspelling is to confuse adware removal programmes.
Again I have done a full scan with Malwarebytes and also Spybot S&D but nothing is detected. I am currently running a full scan with Windows Defender but nothing to see at this point. Quite obviously there must be something left on the computer that is reinstating these BHOs even when they have been removed and generating new names each time. The only indication I have of what it might be are a few entries in the quarantine section of Windows Defender referring to "adware:win32/saverextension". It appears to have quarantined this particular infection several times over the last few days including today. But if that is the case then why are the BHOs appearing and why can they not be disabled or removed.
I would be very grateful for any expert help so that I can put a stop to this.