Jump to content

I was installing some software and when I opened chrome i have ads everywhere, so I checked my extentions and I removed "BUyNosave" but when I relaunch chrome the extension is back along with the ads, so I run some antivirus things and malwarebytes and they detect the thing and remove it, then i relaunch chrome and there is no ads but the extension is still there but its greyed out and when I try to remove it it just keeps coming back, I have ran lots of different scans for this but none of them remove it, could someone tell me how to fix this?

 

Thanks

CPU:i7 4770k, Motherboard:ASUS Z79-AR, RAM:8GB HyperX Beast, GPU:EVGA GTX 970 4GB, Case:Corsair 600T, Storage:1TB Seagate Barracuda, 120GB Sandisk SSD, 256GB Sandisk SSD, PSU:Corsair TX650M, Display(s):Asus VE247H, Asus VE247N, Cooling:Corsair H60 with NF-F12, Keyboard:Razer BlackWidow, Mouse:Razer DeathAdder, Sound:Astro A40

Link to comment
https://linustechtips.com/topic/273405-buynosave-adware/
Share on other sites

Link to post
Share on other sites

There are some folders in ProgramData that you need to delete too.  Probably 2-3 of them, named complete gibberish.

could you expand?

CPU:i7 4770k, Motherboard:ASUS Z79-AR, RAM:8GB HyperX Beast, GPU:EVGA GTX 970 4GB, Case:Corsair 600T, Storage:1TB Seagate Barracuda, 120GB Sandisk SSD, 256GB Sandisk SSD, PSU:Corsair TX650M, Display(s):Asus VE247H, Asus VE247N, Cooling:Corsair H60 with NF-F12, Keyboard:Razer BlackWidow, Mouse:Razer DeathAdder, Sound:Astro A40

Link to comment
https://linustechtips.com/topic/273405-buynosave-adware/#findComment-3713044
Share on other sites

Link to post
Share on other sites

2014-12-08 05:48 . 2014-12-08 05:48 -------- d-----w- c:\programdata\hopmepaoopomkiiphecbaoapkbldgmfc

2014-12-08 05:48 . 2014-12-08 05:48 -------- d-----w- c:\programdata\epopjghpamhafijaipommcbbdeajiefn

2014-12-08 05:39 . 2014-12-08 05:39 -------- d-----w- c:\programdata\pegnhgljmflfghebhmpipckflacdonfo

 

Those contain the browser extensions, and for some reason malwarebytes, adwcleaner, combofix etc. don't delete them.  The naming might be random, but probably something similar.

Link to comment
https://linustechtips.com/topic/273405-buynosave-adware/#findComment-3713118
Share on other sites

Link to post
Share on other sites

i would recommend running roguekiller in safemode. it is the fix all for any type of virus/adware. it even gets rid of the annoying whitescreen ransomware. start safemode with command prompt. in the prompt type explorer.exe then run rogue killer. fixed all the issues ever.

Link to comment
https://linustechtips.com/topic/273405-buynosave-adware/#findComment-3714711
Share on other sites

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×