Need some help with adware (Royals)

[smileyhead]

Yesterday, I started seeing this abomination whenever I Googled something:

As you can see, it's signed as "Ads by Royals". I immediately thought "that ain't right", because I have AdBlock. I tried blocking it manually, but it kept showing up. Then I realised it's probably adware. I looked it up, and sure enough, Royals isn't something new. Strangely, every suggestion I tried told me to uninstall it or remove the extension. Here's when the problems start.
It's not on the Add or Remove Programs list, nor in Program Files, nor in AppData. I can't see any suspicious or new extensions either. I tried scanning with Malwarebytes Anti-Malware and Malwarebytes AdwCleaner, but after the cleanup finished and I restarted, it was still there.

 

[smileyhead]

Anyone?

 

[compilequietly]

Have you installed any other programs recently? maybe updated something from a new source?

 

[smileyhead]

Have you installed any other programs recently? maybe updated something from a new source?

Only Speccy. I thought that might be it, so I tried uninstalling it and rebooting, but it didn't help.

 

[compilequietly]

Try manually removing the files there and turning off any auto updates plus close it in your system tray
also check your startup apps maybe omethings updating it on startup after deletion

 

[smileyhead]

I don't have Speccy on my PC anymore. No files or folders left either. And there are no suspicious startup applications.

 

[The Real Jdbye]

Yesterday, I started seeing this abomination whenever I Googled something:
View attachment 113324
As you can see, it's signed as "Ads by Royals". I immediately thought "that ain't right", because I have AdBlock. I tried blocking it manually, but it kept showing up. Then I realised it's probably adware. I looked it up, and sure enough, Royals isn't something new. Strangely, every suggestion I tried told me to uninstall it or remove the extension. Here's when the problems start.
It's not on the Add or Remove Programs list, nor in Program Files, nor in AppData. I can't see any suspicious or new extensions either. I tried scanning with Malwarebytes Anti-Malware and Malwarebytes AdwCleaner, but after the cleanup finished and I restarted, it was still there.

Is it in your browser's addons/plugins list? I find that usually adware can just be disabled or uninstalled from there and won't come back.
As for Malwarebytes and AdwCleaner, those are best ran from Safe Mode.

 

[smileyhead]

Is it in your browser's addons/plugins list? I find that usually adware can just be disabled or uninstalled from there and won't come back.

I literally said in the post you've quoted that it's not in there.

 

[The Real Jdbye]

I literally said in the post you've quoted that it's not in there.

It could be masquerading as a legit addon, you never know. What browser are you using? If possible try running the browser in safe mode which should run it without loading addons.

 

[smileyhead]

It could be masquerading as a legit addon, you never know. What browser are you using? If possible try running the browser in safe mode which should run it without loading addons.

Nope. No new addons, and I know what every addon does. I'm using Chrome Beta.
Here's my addon list:
This user does not have permission to use the HTML BB code.

 

[The Real Jdbye]

Nope. No new addons, and I know what every addon does. I'm using Chrome Beta.
Here's my addon list:
This user does not have permission to use the HTML BB code.

It could even be a legit addon that has been hijacked.
Did you try safe mode?

 

[330]

Nothing that a nice format won't solve.

By the way, Royal Raid ads are most known by bundling. Chances are you might've clicked "next" one time too much while installing other software.

 

[smileyhead]

It could even be a legit addon that has been hijacked.
Did you try safe mode?

I just tried screwing around with the extension switches, and I think I found it.
When I switch YouTube Video and Mp3 Downloader off and refresh the Google page, the Royal stuff doesn't appear, so I guess that was it... Weird. I haven't had problems with it before, but if this plugin really is the culprit, then I guess I'll delete it.
Thanks for your time!

 

[Deleted-355425]

Install malwarebytes, and add to chrome, scriptsafe, ublock origin.

 

[smileyhead]

Install malwarebytes

Do people not read the OP nowadays? My issue has been resolved by now anyway.

 

[nl255]

I just tried screwing around with the extension switches, and I think I found it.
When I switch YouTube Video and Mp3 Downloader off and refresh the Google page, the Royal stuff doesn't appear, so I guess that was it... Weird. I haven't had problems with it before, but if this plugin really is the culprit, then I guess I'll delete it.
Thanks for your time!

It is fairly trivial for an installer for crap like Royal to integrate itself into an existing addon. In fact, that is how most viruses used to work, they would automatically patch themselves into other programs that you had installed.

 

[smileyhead]

It is fairly trivial for an installer for crap like Royal to integrate itself into an existing addon. In fact, that is how most viruses used to work, they would automatically patch themselves into other programs that you had installed.

...Oh.

 

[Deleted-355425]

Do people not read the OP nowadays? My issue has been resolved by now anyway.

No i dont, take my help or leave it.

 

[The Real Jdbye]

I just tried screwing around with the extension switches, and I think I found it.
When I switch YouTube Video and Mp3 Downloader off and refresh the Google page, the Royal stuff doesn't appear, so I guess that was it... Weird. I haven't had problems with it before, but if this plugin really is the culprit, then I guess I'll delete it.
Thanks for your time!

Sometimes this happens, a dev decides he wants to make a quick buck off unsuspecting users and sneakily includes adware in an update without telling anyone. See: ES File Explorer

 

[Futurdreamz]

I've seen that regularly a developer stops updating a good and trusted plugin and lets someone else take over, who immediately injects adware which gets installed next time you update.