olpair.com

[REDACTED]

I'm having lots of problems with a 'virus/malware' constantly giving me pop up adverts. There seems to be no way of removing this. Each advert displays "olpair.com", how do I get rid of this and why didn't Avast Pro pick this up?

[Pondus]

Have You tried AdwCleaner ?   https://www.malwarebytes.com/adwcleaner/

why didn't Avast Pro pick this up?

1. Have you turned ON avast PUP detection? (default OFF)
PUP = Possible Unwanted Program

2. No security program have 100% detection

[polonus]

Do not panick, there is a sure way to eliminate this Kodi Openload.co pest, that is also serving up mining scripts.

For a removal proposal (only general txt not the spyhunter download advice!), read:
-https://www.bugsfighter.com/remove-olpair-com-openload-co/

If you feel uncomfy doing this cleansing all on your own, wait for a qualified remover to show up here and assist you,
then serve the required logs asked for here in this link: https://forum.avast.com/index.php?topic=194892.0

Good luck to you and stay free of adware, crapware and malware,

polonus (volunteer website security analyst and website error-hunter)

[REDACTED]

Thanks for the ideas. I have Malwarebytes running with pup detection. I have tried various downloads of other brands of malware detection programs and of course they don't work. So it looks like a manual removal of the files. Pain in the proverbial ..............

Thanks again for your help.

[Pondus]

If you need help, follow instructions here    https://forum.avast.com/index.php?topic=194892.0

Follow instructions in step #2  Farbar Recovery Scan Tool
Attach the two diagnostic logs and a malware expert will assist you

[REDACTED]

As requested, please find attached the 2 log files

Thanks for your help

[Pondus]

Malware Expert is notified, it may take hours before he is online

[Sass Drake]

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

FF user.js: detected! => C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\xykao877.default\user.js [2018-08-28]
CHR HKU\S-1-5-21-384587453-2791625232-813261152-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10062018204937775\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
EmptyTemp:

• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

In Chrome open extension manager or go to this addreess:
chrome://extensions

and remove Ace Script.

[REDACTED]

That seems to have worked.

Thank you, it was becoming a real pain. 

[Sass Drake]

Please rename FRST64.exe to uninstall.exe and run it. It should uninstall FRST.

[REDACTED]

Did that and the program uninstall.exe will not run on my PC.

P.S. Still have the pop ups!!!!

[Sass Drake]

Download FRST64 again and post new FRST.txt and Addition.txt logs.