Need some help with adware (Royals)

smileyhead

I like cute stuff.
OP
Member
Joined
Aug 31, 2015
Messages
4,670
Trophies
3
Age
22
Location
Budakeszi, Hungary
Website
sites.google.com
XP
9,182
Country
Hungary
Yesterday, I started seeing this abomination whenever I Googled something:
upload_2018-2-8_12-57-5.png
As you can see, it's signed as "Ads by Royals". I immediately thought "that ain't right", because I have AdBlock. I tried blocking it manually, but it kept showing up. Then I realised it's probably adware. I looked it up, and sure enough, Royals isn't something new. Strangely, every suggestion I tried told me to uninstall it or remove the extension. Here's when the problems start.
It's not on the Add or Remove Programs list, nor in Program Files, nor in AppData. I can't see any suspicious or new extensions either. I tried scanning with Malwarebytes Anti-Malware and Malwarebytes AdwCleaner, but after the cleanup finished and I restarted, it was still there.
 

compilequietly

Well-Known Member
Newcomer
Joined
Aug 20, 2017
Messages
49
Trophies
0
XP
79
Country
United States
Try manually removing the files there and turning off any auto updates plus close it in your system tray
also check your startup apps maybe omethings updating it on startup after deletion
 

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
22,058
Trophies
3
Location
Space
XP
11,328
Country
Norway
Yesterday, I started seeing this abomination whenever I Googled something:
View attachment 113324
As you can see, it's signed as "Ads by Royals". I immediately thought "that ain't right", because I have AdBlock. I tried blocking it manually, but it kept showing up. Then I realised it's probably adware. I looked it up, and sure enough, Royals isn't something new. Strangely, every suggestion I tried told me to uninstall it or remove the extension. Here's when the problems start.
It's not on the Add or Remove Programs list, nor in Program Files, nor in AppData. I can't see any suspicious or new extensions either. I tried scanning with Malwarebytes Anti-Malware and Malwarebytes AdwCleaner, but after the cleanup finished and I restarted, it was still there.
Is it in your browser's addons/plugins list? I find that usually adware can just be disabled or uninstalled from there and won't come back.
As for Malwarebytes and AdwCleaner, those are best ran from Safe Mode.
 

smileyhead

I like cute stuff.
OP
Member
Joined
Aug 31, 2015
Messages
4,670
Trophies
3
Age
22
Location
Budakeszi, Hungary
Website
sites.google.com
XP
9,182
Country
Hungary
It could be masquerading as a legit addon, you never know. What browser are you using? If possible try running the browser in safe mode which should run it without loading addons.
Nope. No new addons, and I know what every addon does. I'm using Chrome Beta.
Here's my addon list:
HTML:
╔══════════════════════════════════╦══════════════════════════════════════════════╦═══════════════════════════════════════════════════════════╗
║               Name               ║                     Use                      ║                          Source                           ║
╠══════════════════════════════════╬══════════════════════════════════════════════╬═══════════════════════════════════════════════════════════╣
║ YouTube Video and Mp3 Downloader ║ Self-explanatory.                            ║ Added manually, but had it for a long time with no issues ║
║ AdBlock                          ║ Self-explanatory.                            ║ Chrome Web Store                                          ║
║ Dark Reader                      ║ Forces a dark theme onto all websites.       ║ Chrome Web Store                                          ║
║ Google Docs Offline              ║ Makes Google Docs available offline.         ║ Ships with Chrome                                         ║
║ Google Translate                 ║ Little Translate button when selecting text. ║ Chrome Web Store                                          ║
║ Imagus                           ║ Point on any image to enlarge it.            ║ Chrome Web Store                                          ║
║ Momentum                         ║ Fancy New Tab page.                          ║ Chrome Web Store                                          ║
║ No Coin                          ║ Bitcoin mining script blocker.               ║ Chrome Web Store                                          ║
║ Poper Blocker                    ║ Popup and overlay blocker.                   ║ Chrome Web Store                                          ║
║ FireShot                         ║ Used to make screenshots of entire pages.    ║ Chrome Web Store                                          ║
║ The Great Suspender              ║ Suspends unused tabs to save on resources.   ║ Chrome Web Store                                          ║
║ vGet                             ║ Downloads videos from websites.              ║ Chrome Web Store                                          ║
║ vidIQ Vision                     ║ Useful overlays and stats for YouTube.       ║ Chrome Web Store                                          ║
╚══════════════════════════════════╩══════════════════════════════════════════════╩═══════════════════════════════════════════════════════════╝
 

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
22,058
Trophies
3
Location
Space
XP
11,328
Country
Norway
Nope. No new addons, and I know what every addon does. I'm using Chrome Beta.
Here's my addon list:
HTML:
╔══════════════════════════════════╦══════════════════════════════════════════════╦═══════════════════════════════════════════════════════════╗
║               Name               ║                     Use                      ║                          Source                           ║
╠══════════════════════════════════╬══════════════════════════════════════════════╬═══════════════════════════════════════════════════════════╣
║ YouTube Video and Mp3 Downloader ║ Self-explanatory.                            ║ Added manually, but had it for a long time with no issues ║
║ AdBlock                          ║ Self-explanatory.                            ║ Chrome Web Store                                          ║
║ Dark Reader                      ║ Forces a dark theme onto all websites.       ║ Chrome Web Store                                          ║
║ Google Docs Offline              ║ Makes Google Docs available offline.         ║ Ships with Chrome                                         ║
║ Google Translate                 ║ Little Translate button when selecting text. ║ Chrome Web Store                                          ║
║ Imagus                           ║ Point on any image to enlarge it.            ║ Chrome Web Store                                          ║
║ Momentum                         ║ Fancy New Tab page.                          ║ Chrome Web Store                                          ║
║ No Coin                          ║ Bitcoin mining script blocker.               ║ Chrome Web Store                                          ║
║ Poper Blocker                    ║ Popup and overlay blocker.                   ║ Chrome Web Store                                          ║
║ FireShot                         ║ Used to make screenshots of entire pages.    ║ Chrome Web Store                                          ║
║ The Great Suspender              ║ Suspends unused tabs to save on resources.   ║ Chrome Web Store                                          ║
║ vGet                             ║ Downloads videos from websites.              ║ Chrome Web Store                                          ║
║ vidIQ Vision                     ║ Useful overlays and stats for YouTube.       ║ Chrome Web Store                                          ║
╚══════════════════════════════════╩══════════════════════════════════════════════╩═══════════════════════════════════════════════════════════╝
It could even be a legit addon that has been hijacked.
Did you try safe mode?
 

330

Banned!
Banned
Joined
Nov 20, 2017
Messages
327
Trophies
0
Location
Comfy nest
XP
411
Country
Nauru
Nothing that a nice format won't solve.

By the way, Royal Raid ads are most known by bundling. Chances are you might've clicked "next" one time too much while installing other software.
 

smileyhead

I like cute stuff.
OP
Member
Joined
Aug 31, 2015
Messages
4,670
Trophies
3
Age
22
Location
Budakeszi, Hungary
Website
sites.google.com
XP
9,182
Country
Hungary
It could even be a legit addon that has been hijacked.
Did you try safe mode?
I just tried screwing around with the extension switches, and I think I found it.
When I switch YouTube Video and Mp3 Downloader off and refresh the Google page, the Royal stuff doesn't appear, so I guess that was it... Weird. I haven't had problems with it before, but if this plugin really is the culprit, then I guess I'll delete it.
Thanks for your time!
 

nl255

Well-Known Member
Member
Joined
Apr 9, 2004
Messages
2,980
Trophies
0
XP
2,483
Country
I just tried screwing around with the extension switches, and I think I found it.
When I switch YouTube Video and Mp3 Downloader off and refresh the Google page, the Royal stuff doesn't appear, so I guess that was it... Weird. I haven't had problems with it before, but if this plugin really is the culprit, then I guess I'll delete it.
Thanks for your time!

It is fairly trivial for an installer for crap like Royal to integrate itself into an existing addon. In fact, that is how most viruses used to work, they would automatically patch themselves into other programs that you had installed.
 

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
22,058
Trophies
3
Location
Space
XP
11,328
Country
Norway
I just tried screwing around with the extension switches, and I think I found it.
When I switch YouTube Video and Mp3 Downloader off and refresh the Google page, the Royal stuff doesn't appear, so I guess that was it... Weird. I haven't had problems with it before, but if this plugin really is the culprit, then I guess I'll delete it.
Thanks for your time!
Sometimes this happens, a dev decides he wants to make a quick buck off unsuspecting users and sneakily includes adware in an update without telling anyone. See: ES File Explorer
 
  • Like
Reactions: smileyhead

Futurdreamz

Well-Known Member
Member
Joined
Jun 15, 2014
Messages
2,224
Trophies
0
Age
30
XP
1,894
Country
Canada
I've seen that regularly a developer stops updating a good and trusted plugin and lets someone else take over, who immediately injects adware which gets installed next time you update.
 
General chit-chat
Help Users
  • x65943 @ x65943:
    oh I see you actually get to pick which set you want - so you could buy the 88 lb one
    Gift
  • KenniesNewName @ KenniesNewName:
    Didn't notice in the title it says 44LB/66LB/88LB
    Gift
  • KenniesNewName @ KenniesNewName:
    I really want to start lifting again
    Gift
  • KenniesNewName @ KenniesNewName:
    Gym memberships here are like $40 a month so in like years worth of time I'd have enough just to buy a nice in home set
    Gift
  • x65943 @ x65943:
    that's true, gyms are expensive.
    Gift
  • KenniesNewName @ KenniesNewName:
    I'd rather just have my own equipment instead of not knowing whose sweaty balls were on it
    Gift
  • x65943 @ x65943:
    kenny I'm very concerned now that you may not be working out properly
    Gift
  • KenniesNewName @ KenniesNewName:
    My life isn't proper
    Gift
  • x65943 @ x65943:
    first of all, there should be exactly zero reasons to place your sweaty balls on any of the equipment - generally you are supposed to wear clothing at the gym
    Gift
  • KenniesNewName @ KenniesNewName:
    You aren't going to the right gym if you need to wear clothes
    Gift
  • KenniesNewName @ KenniesNewName:
    Ball sweat drops down like normal sweat if your balls are always dry I'd recommend a doctor
    Gift
  • KenniesNewName @ KenniesNewName:
    We're talking about exercise balls of course
    Gift
  • x65943 @ x65943:
    what to do if I am a doctor
    Gift
  • KenniesNewName @ KenniesNewName:
    Re-read WebMD articles
    Gift
  • KenniesNewName @ KenniesNewName:
    I got myself a cheapo steering wheel cover here's to hoping the sun doesn't burn my finger tips over hot steering wheels
    Gift
  • x65943 @ x65943:
    I have never experienced that
    Gift
  • x65943 @ x65943:
    just where do you live mate
    Gift
  • KenniesNewName @ KenniesNewName:
    Midwest weathers been like 90 all week
    Gift
  • KenniesNewName @ KenniesNewName:
    We don't have garage parking areas at the apartment either so my car bakes in the sun
    Gift
  • KenniesNewName @ KenniesNewName:
    Midwest weather is so bipolar in the summer
    Gift
  • x65943 @ x65943:
    also in midwest, and today at least was really nice - in the 70s with light drizzle and good cloud cover
    Gift
  • x65943 @ x65943:
    have been quite a few scorchers this year tho
    Gift
  • KenniesNewName @ KenniesNewName:
    Depends on the area I'm more up north
    Gift
  • KenniesNewName @ KenniesNewName:
    Supposed to be in the 80s all next week
    Gift
  • Mariposa @ Mariposa:
    hiii! how's everyone doingg
    Gift
    Mariposa @ Mariposa: hiii! how's everyone doingg