Friday, January 02, 2015

Removing the PrIceLesos 5.2 adware.

Removing the PrIceLesos 5.2 adware.

I got a new iPhone and thought of downloading an emulator.. and after a while, downloaded content from xpadian.com - specifically this one: http://www.xpadian.com/file/ipadian.exe for my Vista laptop.

And during the installation, I accepted the defaults and didn't look at what it installs. And got an unwelcome adware called PrIceLesos. I got intrusive ads during my normal browsing, highlighting my lack of focus about installing software on home PC. Sigh!

So I decided to remove the adware. Easy - simply go to Chrome > Settings > extensions and disable the PrIceLesos 5.2 adware. Then delete it by clicking on the trashcan button on the same screen. Rebooted.. and thought - 'That should do the trick'. Oh, how wrong I was.

After some googling where people were offering to remove it with their own tools.. which I was weary to install after this misstep. So I decided to dig around. Removed it from control panel - was named PriceLess and Supporter programs on control panel - I removed both.

Still after a reboot I noticed the ads popup - which was annoying. So I decided to enable the developer mode in the chrome extensions - and noticed this for the extension:

PrIceLesos 5.2
ID: kglpgmodaiklggoaaehdphmmmmldaaba
Loaded from: ~\AppData\Local\Google\Chrome\User Data\Default\Extensions\pocibaidmhhbcpkeneeknfbojdnoiibb\5.2

So there it was! I navigated to the path C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions and deleted the folder called kglpgmodaiklggoaaehdphmmmmldaaba AND pocibaidmhhbcpkeneeknfbojdnoiibb

Still no luck.

So then I noticed something - the adware had made backup copies under
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions - and deleted the folder there too. A reboot finally sealed the fate.