Author Topic: 1clickdownloader  (Read 12628 times)

0 Members and 1 Guest are viewing this topic.

Purrington

  • Guest
1clickdownloader
« on: September 04, 2012, 04:09:56 PM »
At the suggestion of a friend I have run spybot search and destroy on my laptop and it found a few instances of malware.  I am somewhat concerned as a paid subscriber that Avast did not catch these instances.

I also notice that I have 1clickdownloader in my files. I have repeatedly tried to remove it using Avast's "Open in Sandbox" but although a message comes up saying it has been removed it continues to appears listed among my programs even after rebooting my laptop.

What do I need to do to get rid of this program?

Thank you

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: 1clickdownloader
« Reply #1 on: September 04, 2012, 04:12:25 PM »
with todays malware spybot search and destroy  is a toy .......replace it with Malwarebytes    www.malwarebytes.org    there is a free version  ;)

run a quick scan and post the log here
« Last Edit: September 04, 2012, 04:19:25 PM by Pondus »

Purrington

  • Guest
Re: 1clickdownloader
« Reply #2 on: September 04, 2012, 05:07:20 PM »
Pondus:

I appreciate your prompt response.

I am also a paid subscriber to Malwarebytes.  I had run it earlier and it did not detect any problems.

I just ran it again and here it the Log:


Malwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.09.04.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lewis :: LEWIS-PC [administrator]

Protection: Enabled

9/4/2012 10:21:29 AM
mbam-log-2012-09-04 (10-21-29).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 312303
Time elapsed: 40 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Thank you for your assistance

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: 1clickdownloader
« Reply #3 on: September 04, 2012, 05:11:18 PM »
OK ....go here  http://forum.avast.com/index.php?topic=53253.0    and run the first program in the guide AdwCleaner

post that log..

did that fix it ? .....if not Essexboy will have a look ...he is notified   ;)
« Last Edit: September 04, 2012, 05:18:43 PM by Pondus »

Purrington

  • Guest
Re: 1clickdownloader
« Reply #4 on: September 04, 2012, 05:55:04 PM »
When I click on this link: http://forum.avast.com/index.php?topic=53253.0 it takes me here: http://general-changelog-team.fr/en/tools/15-adwcleaner.

From there I am told to:"Click here to download AdwCleaner" which takes me here: http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner [A Site in French.]

On that site when I click on the green downwards arrow underneath where it says:

Size   499.28 KB
Downloads   1059321
Author   Xplode
Created   2012-03-03 17:22:02
Created by   Xplode
Changed at   2012-08-30 18:30:17
Modified by Xplode

I got an Avast warning that Advast had blocked an incoming Trojan Virus

After that if I click on that green arrow I get this message:

   This webpage is not available
The connection to general-changelog-team.fr was interrupted.
Here are some suggestions:
Reload this webpage later.
Check your Internet connection. Restart any router, modem, or other network devices you may be using.
Add Google Chrome as a permitted program in your firewall's or antivirus software's settings. If it is already a permitted program, try deleting it from the list of permitted programs and adding it again.
If you use a proxy server, check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don't believe you should be using a proxy server, adjust your proxy settings: Go to the wrench menu > Settings > Show advanced settings... > Change proxy settings... > LAN Settings and deselect the "Use a proxy server for your LAN" checkbox.

The "Use a proxy server for your LAN" checkbox was already deselected.

ryan1404

  • Guest
Re: 1clickdownloader
« Reply #5 on: September 04, 2012, 06:05:51 PM »
super antispyware,ccleaner and malewarebytes run in safe mode should remove it

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: 1clickdownloader
« Reply #6 on: September 04, 2012, 06:10:05 PM »
super antispyware,ccleaner and malewarebytes run in safe mode should remove it
malwarebytes should only be run in safe mode if it dont work  in normal mode   


Essexboy is notified and will have a look when he is back soon ...
« Last Edit: September 04, 2012, 06:13:07 PM by Pondus »

ryan1404

  • Guest
Re: 1clickdownloader
« Reply #7 on: September 04, 2012, 06:15:55 PM »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: 1clickdownloader
« Reply #8 on: September 04, 2012, 06:59:57 PM »
Uploaded to Avast as a false positive.. The previous version is available here http://www.softpedia.com/progDownload/AdwCleaner-Download-212632.html

Nesivos

  • Guest
Re: 1clickdownloader
« Reply #9 on: September 04, 2012, 07:27:13 PM »
According to at least one website while 1clickdownloader is not malware per se it  "may be used to compromise computer security by the hacker."

http://greatis.com/blog/not-a-virus/tools/1clickdownloader-exe.htm

Here is another not to favorable opinion about 1clickdownloader
Quote
Delete 1ClickDownloader Rogue Anti-spyware from PC completely & safely

1ClickDownloader, the rogue anti-spyware works as a tracking cookie and is shared among websites to keep track of users internet browsing habits. With its regular tracking, 1ClickDownloader is accepted by the system everytime with which it is made easier for the program to recognize the user that exists and have it data tracked. It silently monitors & records user browsing & would target user system by generating fake scan & reports. It is a new technique hackers & advertisers are opting for to know the products you are basically interested in so that they can advertise like products for your system. In this very way 1ClickDownloader can potentially damage your system & causes it to perform abruptly. It intrudes malware & trojans without user permission to harm the integrity of the very system. This is a big threat to the security of the system and it is thus important to remove 1ClickDownloader right after it is detected.

http://www.spywarescansoftware.com/delete-1clickdownloader-rogue-anti-spyware-from-pc-completely-safely



Purrington

  • Guest
Re: 1clickdownloader
« Reply #10 on: September 04, 2012, 10:36:56 PM »
I am sorry but there are four different posters giving advice and I am not certain whose advice I am to be taking.

Pondus you were the first to respond. Could you please clarify for me what I should be doing now?

Thank you

Lewis

iroc9555

  • Guest
Re: 1clickdownloader
« Reply #11 on: September 04, 2012, 10:52:37 PM »
Purrington.

Ryan1404 is not a qualify malware removal here at Avast! Forums.

Nesivos is just given you info on 1clickdownloader and he is a known helper here as Pondus and myself.

Essexboy is our malware specialist so download AdwCleaner from the link he gave you and follow his instructions.

« Last Edit: September 04, 2012, 10:54:08 PM by iroc9555 »

Purrington

  • Guest
Re: 1clickdownloader
« Reply #12 on: September 04, 2012, 11:11:40 PM »
I ran Adware Cleaner and got this message at the end:

# AdwCleaner v1.801 - Logfile created 09/04/2012 at 17:09:38
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Lewis - LEWIS-PC
# Boot Mode : Normal
# Running from : C:\Users\Lewis\Downloads\adwcleaner (2).exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

[x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Google Chrome v21.0.1180.89

File : C:\Users\Lewis\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4333 octets] - [04/09/2012 16:23:37]
AdwCleaner[S1].txt - [292 octets] - [04/09/2012 16:25:02]
AdwCleaner[S2].txt - [3670 octets] - [04/09/2012 16:25:22]
AdwCleaner[R2].txt - [981 octets] - [04/09/2012 17:09:38]

########## EOF - C:\AdwCleaner[R2].txt - [1108 octets] ##########

1clickdownloader still appears on my program list.

What do I do now?

Thank you

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: 1clickdownloader
« Reply #13 on: September 04, 2012, 11:19:43 PM »
Now we do a search and destroy

Download OTL  to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
/md5stop
%systemdrive%\$Recycle.Bin|@;true;true;true
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS /s
CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Attach both logs

Purrington

  • Guest
Re: 1clickdownloader
« Reply #14 on: September 04, 2012, 11:56:56 PM »
I have run the OTL per your instructions.

Attached is the log that appeared when the program stopped running. It is the only log that appeared.

Thank you

Lewis