Tech Support Guy banner
  • IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice
Status
Not open for further replies.

Help Needed about Add-Ons (Moved from Windows 8 forum)

Solved 
4K views 34 replies 3 participants last post by  iMacg3 
#1 ·
Hi. I keep getting these mini adverts popping up from a site called www19.tuneloud.xyz and I can't seem to get rid of them even though I went into browser add-ons and put the website addressed in as blocked. Any help appreciated, thanks
 
#6 ·
Welcome to the Tech Support Guy malware removal forum.
I'm iMacg3 and will be helping you.

Please keep the following information in mind before we begin:
  • Do not run any fixes or tools on your system unless I request that you do so.
  • Please read all instructions carefully, and complete them in the order listed.
  • If your computer seems to start working normally, please don't abandon the topic. Just because your computer doesn't seem to have a problem doesn't mean that it isn't infected.
  • If you have pirated or illegal software on your computer, uninstall it now before proceeding.
  • If you have questions about anything during the cleanup, please ask.

--------------------

Please take a screenshot of the pop-ups, and attach it to your reply.

--------------------

Download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right-click FRST/FRST64 and select Run as administrator. (Windows XP users double-click on the file).
  • If you receive a SmartScreen alert, click More Info, then Run Anyway.
  • When the tool opens, click Yes to the disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Attach it to your reply.
  • The tool will also produce another log (Addition.txt ). Please attach this, along with FRST.txt, to your reply.
 
#9 ·
Welcome to the Tech Support Guy malware removal forum.
I'm iMacg3 and will be helping you.

Please keep the following information in mind before we begin:
  • Do not run any fixes or tools on your system unless I request that you do so.
  • Please read all instructions carefully, and complete them in the order listed.
  • If your computer seems to start working normally, please don't abandon the topic. Just because your computer doesn't seem to have a problem doesn't mean that it isn't infected.
  • If you have pirated or illegal software on your computer, uninstall it now before proceeding.
  • If you have questions about anything during the cleanup, please ask.

--------------------

Please take a screenshot of the pop-ups, and attach it to your reply.

--------------------

Download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right-click FRST/FRST64 and select Run as administrator. (Windows XP users double-click on the file).
  • If you receive a SmartScreen alert, click More Info, then Run Anyway.
  • When the tool opens, click Yes to the disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Attach it to your reply.
  • The tool will also produce another log (Addition.txt ). Please attach this, along with FRST.txt, to your reply.
I've not been able to take a screenshot as the pop up appears at side of screen and the screenshot just takes the main screen without it
 
#12 ·
Hi,

Uninstall a Chrome Extension

Launch Google Chrome. Type chrome://extensions in the address bar and press Enter.
Click the trash can icon next to the following extension(s):

AVG Secure Search
Strong Signal
VideoDownloadConverter


A confirmation dialog will appear. Click Remove.

---------------------

Press the Windows Key + R. This will open the Run box.
Type Appwiz.cpl and click OK.

A list of installed programs will appear. Uninstall the below programs by selecting them and clicking Uninstall:

Host App Service (HKU\S-1-5-21-2725166893-3272834960-198961585-1001\...\SweetLabs_AP) (Version: 0.269.8.718 - Pokki) <==== ATTENTION
MyPC Backup (HKLM\...\MyPC Backup) (Version: - JDi Backup Ltd) <==== ATTENTION
Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.2.2 - Reimage) <==== ATTENTION
sale-o (HKLM-x32\...\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) (Version: - sale-o) <==== ATTENTION

Follow the steps in the uninstaller to remove the program.

If you do not use these programs, I suggest you remove them as well:

AVG PC TuneUp (HKLM-x32\...\AVG PC TuneUp) (Version: 16.80.3.38236 - AVG Technologies)
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.3.9.626 - AVG Technologies)

---------------------

We need to run a fix with FRST:

  • Please download the attached fixlist.txt file and save it to the same location as FRST
    Note: It's important that both files, FRST.exe/FRST64.exe and fixlist.txt are in the same location or the fix will not work
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
  • Run FRST.exe/FRST64.exe and press the Fix button just once and wait
  • If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run
  • When finished, FRST will generate a log (Fixlog.txt) in the same location the tool was run, please post it to your reply
 

Attachments

#19 ·
Hi,

Can you post a screenshot of the message regarding the Extension?

------------------------------------------

Please run the following FRST fix:

  • Please download the attached fixlist.txt file and save it to the same location as FRST
    Note: It's important that both files, FRST.exe/FRST64.exe and fixlist.txt are in the same location or the fix will not work
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
  • Run FRST.exe/FRST64.exe and press the Fix button just once and wait
  • If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run
  • When finished, FRST will generate a log (Fixlog.txt) in the same location the tool was run, please post it to your reply
 

Attachments

#20 · (Edited)
I can't do a screenshot so here's the text

It says "'Adobe Acrobat Added'

Another program on your computer added an extension that may change the way chrome works

it can: read and change all your data on the websites you visit
:manage your downloads
:communicate with cooperating native applications"

then there's the option to either - enable extension - or - remove from chrome


I haven't done either as of yet

edit: the message has now disappeared (I took no action)
 
#26 ·
Hi,

Right-click on FRST/FRST64 and click Run as Administrator
Click on Scan. Once the scan is complete, Notepad will open with the scan logs. (FRST.txt and Addition.txt)

Attach FRST.txt and Addition.txt in your next reply.

How is the computer doing?
 
#28 ·
Hi,

Open Google Chrome. Click the Menu icon in the upper right corner of the window (three vertical dots).

Click Settings from the drop-down menu. Scroll down all the way and click Advanced.

Under "Privacy and Security" click "Content Settings."

Click Notifications. If you see any notifications allowed from unfamiliar sites, click Block or Remove next to the site URL.

Restart Chrome and let me know if the problem persists.

----------------------------------------------------

Navigate to https://www.virustotal.com/

Click on Choose File. Navigate to the below file, and select Open.

C:\Program Files (x86)\prefs.js

VirusTotal will scan the file. Please post the URL to the scan results in your next reply.
 
#29 ·
Hello

After performing the first part of your last message the pop-ups haven't come back.

As for the other part. I couldn't find the file you referred you. It wasn't in downloads and I searched the whole PC with that address and nothing came up in the search engine
 
Status
Not open for further replies.
You have insufficient privileges to reply here.
Top