Hola tengo infectado el ordenador con un nuevo virus, y no tengo forma de eliminarlo con ningun antivirus, a ver si podeis ayudarme por favor, se ha instalado en los navegadores, cuando abro el browser me sale esta pagina http://search.noticiastime.org/ , buscando por google esta misma pagina, ni si quiera la encuentra, espero que puedan ayudar, saludos y gracias por el programa.
Hi I have infected your computer with a new virus, and I have no way to remove it with any antivirus, see if you can help me please, is installed in browsers, when I open the browser I get this ad http: //search.noticiastime .org /, searching by google this same page, not even find it, hope you can help, greetings and thanks for the program.
@anonsubmitter, yes you are right. But, most free software downloaded on the Web come bundled up with useless crapware anyway. The YTD downloader box, if you don't want the app, can easily be unchecked while installing your main program. Unckeck all boxes for programs unrelated to the main program. If you need YTD or Hotspot Shield, they have a website where you can get them. No need to be bundled up to anything. They are already very popular. They both can be uninstalled very easily from Programs & Features, so they should not be removed by AdwCleaner. Removing Hotspot Shield this way messes up the Internet connection.
For those who don't usually pay attention while installing software, a program like Unchecky could be very useful. That way, you won't be flooding the malware removal forums all over the Web.
http://unchecky.com/
@Yotony: The second and third link error'd somehow. Here are the ones I were trying to post:
https://www.consumeraffairs.com/computers/norton.html
https://www.avast.com/
Just downloaded to update my version, but can't run it because Norton antivirus detects a thread and deletes it immediately. The threat is identified as 'Suspicious.Cloud.7.EP'.
Not sure if this is a false positive, but don't want to take a chance on it. Please verify the software, clean it if necessary and update the download link (or post a note). Txs.
OK! Issue solved! I had knowingly installed the iSafe Key-logger on that computer. This is supposedly invisible to cleaners and registry. AdwCleaner removed the invisible iSafe folder but not its registry entries. That caused instability in the system, probably related to the specificity of the key-loggers. Restoring the iSafe folder from within the AdwCleaner Quarantine Manager solved the issue. No need to do anything in the registry. I hope this helps!
@Me1: I have read that YTD YouTube Downloader's installer is nowadays bundled with adware, so that might be the reason. If that's the case that detection would be weird since JDownloader has the same features + a lot of other features, its installer is bundled with adware as well (at least three different kinds) and it isn't falsely detected.
If I remember correctly Hotspot Shield was bundled with adware as well back when I used it years ago.
I find many legitimate items flagged by AdwCleaner. Blindly clicking on Clean (now Cleaning???) is asking for trouble.
Hola, Hotspot Shield, YTD YouTube Downloader, AVG LinkScanner, etc. are not adware. They should not be deleted by AdwCleaner.
False positives (it's a legitimate VPN extension):
C:\Users\User\AppData\Local\Hola
HKLM\SOFTWARE\Google\Chrome\Extensions\ncffjdbbodifgldkcbhmiiljfcbgjag
If I remember correctly there's also a false positive for the Hola Unblocker Firefox add-on. However, the Firefox add-on stopped working for me - possibly due to AdwCleaner cleaning away files needed for it to work - and re-installing it doesn't help, so I can't submit a report for that add-on. The add-on can be installed from here if anyone wants to have a look at it: http://hola.org/
The following entries are false positives:
C:\Documents and Settings\User\Application Data\ProgSense (included with some software to look for updates - nothing malicious or deceiving)
C:\Documents and Settings\User\Application Data\Simple Adblock (adblocker now known as Adblock Plus knowingly installed by user for Internet Explorer)
C:\Documents and Settings\User\Local Settings\Application Data\Hola (knowingly installed by user)
HKCU\Software\ProgSense (included with some software to look for updates - nothing malicious or deceiving)
HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762} (belongs to ZoomBrowser EX, a Canon camera utility)
The following are proxy settings knowingly added by user:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - socks=localhost:1234
Thanks in advance for correcting the issue.
