1clickdownloader

[ryan1404]

Purrington.

Ryan1404 is not a qualify malware removal here at Avast! Forums.

Nesivos is just given you info on 1clickdownloader and he is a known helper here as Pondus and myself.

Essexboy is our malware specialist so download AdwCleaner from the link he gave you and follow his instructions.

so advice from non qualified malware removal is not needed? odd forum.

[mchain]

World of Trust rating on the recommended site here:  http://www.mywot.com/en/scorecard/malwareexperts.com/comment#comment

Not all sites that purport to aid or help in cleansing or removing unwanted or malicious files are safe to visit.

One way to become qualified in malware removal is to attend and take classes here:  (UNITE)  http://www.uniteagainstmalware.com/schools.php

I would go back to the link posted and modify it to hxxp: to prevent unsuspecting users from having any problems.

[iroc9555]

so advice from non qualified malware removal is not needed? odd forum.

Although not the place to argue, it has always been forum policy that only qualify forum members advise in the use of some of the tools in the removal of malware because of the dangers involve in rendering a machine inoperable.

If you desire to become one, you can take the course in one of the schools mchain pointed to you. Essexboy is instructor in Geek to Go if he sees fit, during your training, that you already know enough and still want to help here you are more than welcome. 

[essexboy]

Let me know if it is clear after this

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1422163307-3788927115-2030255185-1000\..\SearchScopes\{12995981-2FD6-4BEE-9FB0-B1674E8E5E7E}: "URL" = http://websearch.4shared.com/results?q={searchTerms}
IE - HKU\S-1-5-21-1422163307-3788927115-2030255185-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
[2012/09/04 07:13:42 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Lewis\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\OneClickDownload@OneClickDownload.com
O2:64bit: - BHO: (4sharedExt) - {95525BD9-6136-4A26-8263-9CEE295D442D} - C:\Program Files (x86)\4shared Toolbar\4sharedExt64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (4shared Toolbar) - {95080B13-AA71-4EE8-B951-7E98221E1ED5} - C:\Program Files (x86)\4shared Toolbar\4sharedbar64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
[2012/09/04 07:12:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\1ClickDownload
[2012/04/05 08:29:46 | 000,000,000 | ---D | M] -- C:\Users\Lewis\AppData\Roaming\4Sync

:Commands
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

[Purrington]

I ran the program per you instructions.

After rebooting the attached notpad message appeared.

The 1clickdownloader still appears on my program list.

Thank you

Lewis

[essexboy]

What programme list does it appear on ?

[Purrington]

I am sorry but I do not know what you mean by a "Programme List." 

Could you please clarify for me what that expression means?

Thank you

[Pondus]

I am sorry but I do not know what you mean by a "Programme List." 

Could you please clarify for me what that expression means?

Thank you

in the post above, you say  "The 1clickdownloader still appears on my program list."   so what do you mean ?

[Purrington]

When I go to "Uninstall or Remove a Program" on my laptop on the very top of the list I see:  1clickdownloader listed as a program.

I have tried several times to "Uninstall" it but it remains on the list.

Thank you

[essexboy]

Is that the only place it appears ?

If so select it
Windows will give an error and ask if you wish to remove it
Select yes

[Purrington]

Memo to Avast Forum Members:

ESSEXBOY IS A GENIUS!!!

Thank you Essexboy.  It worked. )

[essexboy]

 

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself.  For AdwCleaner run the programme and press uninstall

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Go to control panel
• Select folder options (Appearance > Folder options in category view)
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

 Upgrading Java:

• Go to this site  and click Do I have Java
  
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point
 

• Go to Control Panel and select System
  
• Select System
  
• On the left select System Protection and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
• Select Create
  

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
  
• Right click Disc cleanup and select run as administrator
  
• Select Your main drive and accept the warning if you get one
  
• For a few moments the system will make some calculations
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?

Keep safe  :wave:

[Purrington]

BRAVO....Well Done...Essexboy.