Installation problems

[Jorge 0]

I installed Adaware Antivirus free, but it cannot start. A windows pops up saying "This application failed to start because it could not find or load QT platform plugin windows". I tried to reinstall the application but will not let me poping the same banner.

I'm trying to get rid of banners that pop up from time to time that, in the bottom line mentions "Chrome ouo.io" 

I would appreciate if anybody can help. 

Thanks, 

 

Jorge 

[CeciliaB 475]

Hi Jorge,

What other antivirus programs or similar (anti-malware etc.) are installed or have been uninstalled?

But note that adaware antivirus is an antivirus program and not a program specializing in adware in browsers, for that I suggest that you use AdwCleaner : https://toolslib.net/downloads/viewdownload/1-adwcleaner/

 

[Jorge 0]

Thank you Cecilia. I've got advast and Windows Defender. I'll tell you that I was able to remove Adware using the removing tool from Adaware web site. Thank you for the suggestion. These banners are really annoying and I don't know how to get rid of them. 

I'll try your suggestion

jea

 

[Jorge 0]

Hi Cecilia, 

I ran AdwCleaner three times. Each time told me that got rid of several threats. However, the banners still pop up. Probably, less frequently. Is there any soft you can suggest?

Thank you. 

 

Jorge

 

[CeciliaB 475]

You're welcome

Does the banners pop-up only on certain web sites or on all?
In the first case it's possible that the owner of the web site has decided that the pop-ups should be there.

Please, to get help with cleaning your computer follow the instructions in the topic Read This Before You Post! Step 2 and I will move your topic to the forum Help with Stubborn Infections afterwards.

Edited October 10, 2019 by CeciliaB

[Jorge 0]

Thanks so much to help me. I tried to follow the steps you mentioned and here I attached the files generated by Frst. 

Bests,

 

jorge

 

Addition.txt FRST.txt

[CeciliaB 475]

Thank you for the logs.

1. I can't see any adware in the log files. Do you have those banners in all web browsers?

2. Are the browsers synchronized to the cloud or other computers?

3. There are some left-overs of adaware antivirus and a few other programs that can be removed in the following way:

Please, start Notepad.
Copy all text that is in the box:

CreateRestorePoint:
CloseProcesses:
KLM\...\Run:[AdAwareTray] => "C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.6.1005.11662\AdAwareTray.exe"
HKU\S-1-5-21-886601865-4186364114-950270270-1001\...\Policies\Explorer: [] 
GroupPolicy: Restriction ? <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {13CF1099-4B4F-488A-BBAE-D48A7E3E2D8D} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {CCADA874-2B38-4463-A86A-28E41605E01C} - \CCleanerSkipUAC -> No File <==== ATTENTION
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [No File]
2019-10-07 14:05 - 2019-10-09 08:32 - 000000000 ____D C:\ProgramData\adaware
C:\Program Files\adaware
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers3: [AdAwareContextMenu] -> {5B64240D-5B36-4B9F-A75F-4925B6A53D5B} => C:\Program Files\adaware\adaware antivirus\adaContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
are antivirus\12.6.1005.11662\AdAwareShellExtension.dll -> No File
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
Reboot:

and paste in Notepad. Check that no files have been split on two lines.
Save the file as fixlist.txt on the desktop.

Exit all programs.
Start FRST, please.
Click the Fix button.
Wait until the tool has finished.

It creates a log file, called Fixlog.txt, on the desktop.
Please, paste the content of that file in your reply.

[Jorge 0]

Hello,

Here are my answers: 

1) I have the banners even when I'm not using any browser. First i thought it was some chrome problem. I stopped using it and switched to Edge. It didn't matter. Sometimes I don't have any of those turned on, and the banner still comes up. 

2) I don't know if they are synchronized. Probably so. I used Chrome in my cell and in my laptop. I don't use edge much. 

3) Attached is the log file. 

 

I appreciate very much your efforts to solve my problem!

 

jea

 

 

Fixlog.txt

[CeciliaB 475]

Hi,

1. Please take a screen shot of the screen when the banner is visible and upload to the forum.

2. If AdwCleaner removes something from a browser that is synchronized with something else, that "something" might be installed again.

3, Good enough.

4. Please run AdwCleaner and attach its log file.

[Jorge 0]

Well Cecilia, 

For a while I don't have any banner coming up. May be the last clean worked well. 

I'll let you know if the problem persists. 

Thanks again. 

 

Jorge

 

 

[CeciliaB 475]

That's nice Jorge,

You're welcome back if the problem comes back.

To remove all files/folders created by FRST and the tool itself, rename the program file FRST/FRST64.exe to uninstall.exe and run it. Reboot afterwards.

[Jorge 0]

Hi Cecilia, 

Sorry, it took a while but it came back again. 

Here I attach the screenshot in a word doc (failed to paste the image).  

I ran adwcleaner again. Here are today's the log files.

I did not uninstall Frst yet 

Hope I don't bother you too much longer

 

bye

Screenshot virus.docx AdwCleaner[S03].txt AdwCleaner[S04].txt AdwCleaner_Debug.log

[CeciliaB 475]

Hi Jorge,

That message is from a web page in Chrome that you've allowed to notify you. Please see https://support.google.com/chrome/answer/3220216 on how to block that.

Please open Chrome with a new tab, type chrome://settings/syncSetup in the address field and press Enter.
Select "Managed sync data on Google Dashboard".
In the new window, please select "Reset Sync", that will clear synced data from the Google Server.
Clear the cache in Chrome: https://support.google.com/accounts/answer/32050 (but you can leave cookies).
Go through the bookmarks and delete those that are found by AdwCleaner (if any).
When complete sign out of Chrome and close it.

Run AdwCleaner and delete everything found.
Restart the computer.

Run AdwCleaner. Anything found?
Open Chrome.
Run AdwCleaner. Anything found?

[Jorge 0]

Wonderful! Everything seems clean. So far, no pop ups. I'll keep testing today. 

You're very smart. Thanks a lot!

 

jorge 

[CeciliaB 475]

Very good!

You're welcome