Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Purrington on September 04, 2012, 04:09:56 PM
-
At the suggestion of a friend I have run spybot search and destroy on my laptop and it found a few instances of malware. I am somewhat concerned as a paid subscriber that Avast did not catch these instances.
I also notice that I have 1clickdownloader in my files. I have repeatedly tried to remove it using Avast's "Open in Sandbox" but although a message comes up saying it has been removed it continues to appears listed among my programs even after rebooting my laptop.
What do I need to do to get rid of this program?
Thank you
-
with todays malware spybot search and destroy is a toy .......replace it with Malwarebytes www.malwarebytes.org there is a free version ;)
run a quick scan and post the log here
-
Pondus:
I appreciate your prompt response.
I am also a paid subscriber to Malwarebytes. I had run it earlier and it did not detect any problems.
I just ran it again and here it the Log:
Malwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org
Database version: v2012.09.04.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lewis :: LEWIS-PC [administrator]
Protection: Enabled
9/4/2012 10:21:29 AM
mbam-log-2012-09-04 (10-21-29).txt
Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 312303
Time elapsed: 40 minute(s), 2 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Thank you for your assistance
-
OK ....go here http://forum.avast.com/index.php?topic=53253.0 and run the first program in the guide AdwCleaner
post that log..
did that fix it ? .....if not Essexboy will have a look ...he is notified ;)
-
When I click on this link: http://forum.avast.com/index.php?topic=53253.0 it takes me here: http://general-changelog-team.fr/en/tools/15-adwcleaner.
From there I am told to:"Click here to download AdwCleaner" which takes me here: http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner [A Site in French.]
On that site when I click on the green downwards arrow underneath where it says:
Size 499.28 KB
Downloads 1059321
Author Xplode
Created 2012-03-03 17:22:02
Created by Xplode
Changed at 2012-08-30 18:30:17
Modified by Xplode
I got an Avast warning that Advast had blocked an incoming Trojan Virus
After that if I click on that green arrow I get this message:
This webpage is not available
The connection to general-changelog-team.fr was interrupted.
Here are some suggestions:
Reload this webpage later.
Check your Internet connection. Restart any router, modem, or other network devices you may be using.
Add Google Chrome as a permitted program in your firewall's or antivirus software's settings. If it is already a permitted program, try deleting it from the list of permitted programs and adding it again.
If you use a proxy server, check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don't believe you should be using a proxy server, adjust your proxy settings: Go to the wrench menu > Settings > Show advanced settings... > Change proxy settings... > LAN Settings and deselect the "Use a proxy server for your LAN" checkbox.
The "Use a proxy server for your LAN" checkbox was already deselected.
-
super antispyware,ccleaner and malewarebytes run in safe mode should remove it
-
super antispyware,ccleaner and malewarebytes run in safe mode should remove it
malwarebytes should only be run in safe mode if it dont work in normal mode
Essexboy is notified and will have a look when he is back soon ...
-
or you can try this http://www.malwareexperts.com/1click-downloader-removal-guide/
-
Uploaded to Avast as a false positive.. The previous version is available here http://www.softpedia.com/progDownload/AdwCleaner-Download-212632.html
-
According to at least one website while 1clickdownloader is not malware per se it "may be used to compromise computer security by the hacker."
http://greatis.com/blog/not-a-virus/tools/1clickdownloader-exe.htm
Here is another not to favorable opinion about 1clickdownloader
Delete 1ClickDownloader Rogue Anti-spyware from PC completely & safely
1ClickDownloader, the rogue anti-spyware works as a tracking cookie and is shared among websites to keep track of users internet browsing habits. With its regular tracking, 1ClickDownloader is accepted by the system everytime with which it is made easier for the program to recognize the user that exists and have it data tracked. It silently monitors & records user browsing & would target user system by generating fake scan & reports. It is a new technique hackers & advertisers are opting for to know the products you are basically interested in so that they can advertise like products for your system. In this very way 1ClickDownloader can potentially damage your system & causes it to perform abruptly. It intrudes malware & trojans without user permission to harm the integrity of the very system. This is a big threat to the security of the system and it is thus important to remove 1ClickDownloader right after it is detected.
http://www.spywarescansoftware.com/delete-1clickdownloader-rogue-anti-spyware-from-pc-completely-safely (http://www.spywarescansoftware.com/delete-1clickdownloader-rogue-anti-spyware-from-pc-completely-safely)
-
I am sorry but there are four different posters giving advice and I am not certain whose advice I am to be taking.
Pondus you were the first to respond. Could you please clarify for me what I should be doing now?
Thank you
Lewis
-
Purrington.
Ryan1404 is not a qualify malware removal here at Avast! Forums.
Nesivos is just given you info on 1clickdownloader and he is a known helper here as Pondus and myself.
Essexboy is our malware specialist so download AdwCleaner from the link he gave you and follow his instructions.
-
I ran Adware Cleaner and got this message at the end:
# AdwCleaner v1.801 - Logfile created 09/04/2012 at 17:09:38
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Lewis - LEWIS-PC
# Boot Mode : Normal
# Running from : C:\Users\Lewis\Downloads\adwcleaner (2).exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
***** [Registry] *****
[x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
***** [Registre - GUID] *****
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Google Chrome v21.0.1180.89
File : C:\Users\Lewis\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [4333 octets] - [04/09/2012 16:23:37]
AdwCleaner[S1].txt - [292 octets] - [04/09/2012 16:25:02]
AdwCleaner[S2].txt - [3670 octets] - [04/09/2012 16:25:22]
AdwCleaner[R2].txt - [981 octets] - [04/09/2012 17:09:38]
########## EOF - C:\AdwCleaner[R2].txt - [1108 octets] ##########
1clickdownloader still appears on my program list.
What do I do now?
Thank you
-
Now we do a search and destroy
Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your Desktop
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
(https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif)
- Select All Users
- Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
/md5stop
%systemdrive%\$Recycle.Bin|@;true;true;true
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS /s
CREATERESTOREPOINT
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Attach both logs
-
I have run the OTL per your instructions.
Attached is the log that appeared when the program stopped running. It is the only log that appeared.
Thank you
Lewis
-
Purrington.
Ryan1404 is not a qualify malware removal here at Avast! Forums.
Nesivos is just given you info on 1clickdownloader and he is a known helper here as Pondus and myself.
Essexboy is our malware specialist so download AdwCleaner from the link he gave you and follow his instructions.
so advice from non qualified malware removal is not needed? odd forum.
-
World of Trust rating on the recommended site here: http://www.mywot.com/en/scorecard/malwareexperts.com/comment#comment (http://www.mywot.com/en/scorecard/malwareexperts.com/comment#comment)
Not all sites that purport to aid or help in cleansing or removing unwanted or malicious files are safe to visit.
One way to become qualified in malware removal is to attend and take classes here: (UNITE) http://www.uniteagainstmalware.com/schools.php (http://www.uniteagainstmalware.com/schools.php)
I would go back to the link posted and modify it to hxxp: to prevent unsuspecting users from having any problems.
-
so advice from non qualified malware removal is not needed? odd forum.
Although not the place to argue, it has always been forum policy that only qualify forum members advise in the use of some of the tools in the removal of malware because of the dangers involve in rendering a machine inoperable.
If you desire to become one, you can take the course in one of the schools mchain pointed to you. Essexboy is instructor in Geek to Go if he sees fit, during your training, that you already know enough and still want to help here you are more than welcome.
-
Let me know if it is clear after this
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
:OTL
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1422163307-3788927115-2030255185-1000\..\SearchScopes\{12995981-2FD6-4BEE-9FB0-B1674E8E5E7E}: "URL" = http://websearch.4shared.com/results?q={searchTerms}
IE - HKU\S-1-5-21-1422163307-3788927115-2030255185-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
[2012/09/04 07:13:42 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Lewis\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\OneClickDownload@OneClickDownload.com
O2:64bit: - BHO: (4sharedExt) - {95525BD9-6136-4A26-8263-9CEE295D442D} - C:\Program Files (x86)\4shared Toolbar\4sharedExt64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (4shared Toolbar) - {95080B13-AA71-4EE8-B951-7E98221E1ED5} - C:\Program Files (x86)\4shared Toolbar\4sharedbar64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
[2012/09/04 07:12:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\1ClickDownload
[2012/04/05 08:29:46 | 000,000,000 | ---D | M] -- C:\Users\Lewis\AppData\Roaming\4Sync
:Commands
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
-
I ran the program per you instructions.
After rebooting the attached notpad message appeared.
The 1clickdownloader still appears on my program list.
Thank you
Lewis
-
What programme list does it appear on ?
-
I am sorry but I do not know what you mean by a "Programme List."
Could you please clarify for me what that expression means?
Thank you
-
I am sorry but I do not know what you mean by a "Programme List."
Could you please clarify for me what that expression means?
Thank you
in the post above, you say "The 1clickdownloader still appears on my program list." so what do you mean ?
-
When I go to "Uninstall or Remove a Program" on my laptop on the very top of the list I see: 1clickdownloader listed as a program.
I have tried several times to "Uninstall" it but it remains on the list.
Thank you
-
Is that the only place it appears ?
If so select it
Windows will give an error and ask if you wish to remove it
Select yes
-
Memo to Avast Forum Members:
ESSEXBOY IS A GENIUS!!!
Thank you Essexboy. It worked. :)))
-
;D
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL- Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands
[resethosts]
[emptytemp]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself. For AdwCleaner run the programme and press uninstall
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
- Go to control panel
- Select folder options (Appearance > Folder options in category view)
- Select the View Tab.
- Under the Hidden files and folders heading select Do not show hidden files and folders.
- Click Yes to confirm.
- Click OK.
(http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif)
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
Upgrading Java:
- Go to this site (http://java.com/en/) and click Do I have Java
- It will check your current version and then offer to update to the latest version
SPRING CLEAN
To manually create a new Restore Point
- Go to Control Panel and select System
- Select System
- On the left select System Protection and accept the warning if you get one
- Select System Protection Tab
- Select Create at the bottom
- Type in a name i.e. Clean
- Select Create
Now we can purge the infected ones
- GoStart > All programs > Accessories > system tools
- Right click Disc cleanup and select run as administrator
- Select Your main drive and accept the warning if you get one
- For a few moments the system will make some calculations
- Select the More Options tab
- In the System Restore and Shadow Backups select Clean up
- Select Delete on the pop up
- Select OK
- Select Delete
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif)
Malwarebytes (http://www.malwarebytes.org/mbam-download.php). Update and run weekly to keep your system clean
Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
- Microsoft Windows Update (http://windowsupdate.microsoft.com)
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)
Keep safe :wave:
-
BRAVO....Well Done...Essexboy.