ADWCleaner is "NOT Respoding" when Clean option is selected.

Greetings,

Please do as follow:

1. Relaunch AdwCleaner,
2. Click on Tools > Options,
3. Here, tick "Debug" in the "Mode" section,
4. Then, do a scan/clean.

Wait until it crashes. Then, just close AdwCleaner through the Task manager. A debug logfile should be available here: C:\AdwCleaner\AdwCleaner_Debug.log.

Please share it using Up2Sha.re. Just copy/paste the generated link in your next answer.

Regards.

Thanks for the quick respose. Here's the link:

https://up2sha.re/file?f=8DtomuBemgz5

The file wasn't a .log file like you said, rather a Text Document, it had the same name though. Hope it's what you need.

.

Hello,

Can you please try to uncheck the following element (in the folders tab) and then press the clean button.

• C:\Users\Vaishnavi\AppData\Roaming\Firefox

Please, tell me what happens.

Regards.

IT WORKED!!!

Thanks a lot. It completed the cleaning and rebooted.

Here's the log file: https://up2sha.re/file?f=Yq8OSrWpA6Kg

What about the folder I unchecked? Is it gonna cause any problems? (It was " C:\Users\Vaishnavi\AppData\Local\Firefox " when I scanned it)

Thanks again, had been trying to get rid of the malware for ages, helped me out a lot!

I'm still having problems with Firefox, I think there's some URL malware that keeps infecting the shortcuts.

I uninstalled Firefox, deleted those folders causing problems ( C:\Users\Vaishnavi\AppData\Local\Firefox ) but still my shorcuts get infected with "www.qtipr.com". This doesn't just happen on startup. I have manually fixed the Target of the shortcuts but still after like an hour it gets infected again on its own and both AVAST and MALWAREBYTES detect this infection and I get a notification from both. None of them seem to be able to find the malware causing this :'( .

I've tried cleaning with ADWCleaner but it only finds the infected URLs, did a scan on MalwareBytes and Avast too, didn't fix it.

Also on Microsoft Edge the homepage keeps changing to "www.startpageing123.com".

Hope you can help!

Vaishnavi,

Download Autologger, unzip it to the Desktop, run and follow the instructions. Please host archive the CollectionLog on Up2Share and share the generated link.

Here's the link: https://up2sha.re/file?f=vdi7ucAS2Vuw

The URL infection actually stopped a few days ago, but would still like to know what caused it.

P.S. I had Malwarebytes Trial installed, maybe that worked.

Also I can't seem to be able to make firefox my default browser, it keeps asking me to make it Default, but when it takes me to the settings Firefox doesn't show up in the options. I have reinstalled firefox several times... same result.

1) It this file known to you?

C:\IORRT\IORRT.bat

There is nothing any suspicious, please clean some trace.

2) Using  ClearLNK tool repair following links and attach tool's report to your message.

C:\Users\Vaishnavi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\9690809c1adfae92\user0 - Chrome.lnk
C:\Users\Vaishnavi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
C:\Users\Vaishnavi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefox.lnk
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

3) "Fix" in HijackThis from the folder .. \ AutoLogger \ HiJackThis

O4 - HKLM\..\StartupApproved\Run: [331BigDog]  (2016/12/31)C:\Program Files\USB Camera\VM331STI.EXE  (file missing)
O4 - HKLM\..\StartupApproved\Run: [Adobe ARM]  (2017/02/18)C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe  (file missing)
O4 - HKLM\..\StartupApproved\Run: [Adobe Creative Cloud]  (2017/03/29)C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --showwindow=false --onOSstartup=true (file missing)
O4 - HKLM\..\StartupApproved\Run: [AdobeAAMUpdater-1.0]  (2017/03/29)C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe  (file missing)
O22 - Task (Ready): AdobeAAMUpdater-1.0-MicrosoftAccount-vaishnavi.naik05@gmail.com - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled (file missing)
O22 - Task (Ready): \Lenovo\Lenovo Customer Feedback Program 35 - C:\Program Files\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe (file missing)

ClearLNK tool repair link:

https://up2sha.re/file?f=zweH25orBsQ2

Also i fixed those things using HijackThis, didn't find any log file here.

IORRT.bat <- This I got from a torrent, it puts Office (I used it for PowerPoint) into a permanent trial so that I can get genuine updates from Microsoft even if I don't buy a licence!

The script had an uninstall option which i used and it said it was uninstalled but there still is the hidden file: C:\IORRT\IORRT.bat Should I just delete it? Is it needed for my powerpoint to have permmanent trial? These were the instructions:

IORRT 3.5:

1. IORRT must be run as administrator

2. IORRT keeps office VL 2010 in perpetual trial

3. IORRT uninstalls cleanly and returns office back to its prior status

4. IORRT puts backup and IORRT.bat in hidden C:\IORRT folder

5. IORRT gives A.I. voice confirmation

6. IORRT and Hybrid tasks restores/rearms silently every day or at boot

7. Developed by timesurfer

Found this, the code of IORRT : https://www.scribd.com/doc/255521707/IORRT-3-5-Microsoft-Office-Activation

Thanks a lot for helping out!