olpair.com

Viruses and worms
1

I’m having lots of problems with a ‘virus/malware’ constantly giving me pop up adverts. There seems to be no way of removing this. Each advert displays “olpair.com”, how do I get rid of this and why didn’t Avast Pro pick this up?

2

Have You tried AdwCleaner ? https://www.malwarebytes.com/adwcleaner/

[b]why didn't Avast Pro pick this up?[/b]

  1. Have you turned ON avast PUP detection? (default OFF)
    PUP = Possible Unwanted Program

  2. No security program have 100% detection

3

Do not panick, there is a sure way to eliminate this Kodi Openload.co pest, that is also serving up mining scripts.

For a removal proposal (only general txt not the spyhunter download advice!), read:
-https://www.bugsfighter.com/remove-olpair-com-openload-co/

If you feel uncomfy doing this cleansing all on your own, wait for a qualified remover to show up here and assist you,
then serve the required logs asked for here in this link: https://forum.avast.com/index.php?topic=194892.0

Good luck to you and stay free of adware, crapware and malware,

polonus (volunteer website security analyst and website error-hunter)

4

Thanks for the ideas. I have Malwarebytes running with pup detection. I have tried various downloads of other brands of malware detection programs and of course they don’t work. So it looks like a manual removal of the files. Pain in the proverbial …

Thanks again for your help.

5

If you need help, follow instructions here https://forum.avast.com/index.php?topic=194892.0

Follow instructions in step #2 Farbar Recovery Scan Tool
Attach the two diagnostic logs and a malware expert will assist you

6

As requested, please find attached the 2 log files

Thanks for your help

7

Malware Expert is notified, it may take hours before he is online

8
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
FF user.js: detected! => C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\xykao877.default\user.js [2018-08-28]
CHR HKU\S-1-5-21-384587453-2791625232-813261152-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10062018204937775\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
EmptyTemp:
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

In Chrome open extension manager or go to this addreess:
chrome://extensions

and remove Ace Script.

9

That seems to have worked.

Thank you, it was becoming a real pain. ;D ;D

10

Please rename FRST64.exe to uninstall.exe and run it. It should uninstall FRST.

11

Did that and the program uninstall.exe will not run on my PC.

P.S. Still have the pop ups!!!

12

Download FRST64 again and post new FRST.txt and Addition.txt logs.