Is developer going to do something about false positives ?
Right now,this tool is dangerous and could leave users with broken apps and addons.
Hola tengo infectado el ordenador con un nuevo virus, y no tengo forma de eliminarlo con ningun antivirus, a ver si podeis ayudarme por favor, se ha instalado en los navegadores, cuando abro el browser me sale esta pagina http://search.noticiastime.org/ , buscando por google esta misma pagina, ni si quiera la encuentra, espero que puedan ayudar, saludos y gracias por el programa.
Hi I have infected your computer with a new virus, and I have no way to remove it with any antivirus, see if you can help me please, is installed in browsers, when I open the browser I get this ad http: //search.noticiastime .org /, searching by google this same page, not even find it, hope you can help, greetings and thanks for the program.
@Yotony: The second and third link error'd somehow. Here are the ones I were trying to post:
https://www.consumeraffairs.com/computers/norton.html
https://www.avast.com/
Just downloaded to update my version, but can't run it because Norton antivirus detects a thread and deletes it immediately. The threat is identified as 'Suspicious.Cloud.7.EP'.
Not sure if this is a false positive, but don't want to take a chance on it. Please verify the software, clean it if necessary and update the download link (or post a note). Txs.
OK! Issue solved! I had knowingly installed the iSafe Key-logger on that computer. This is supposedly invisible to cleaners and registry. AdwCleaner removed the invisible iSafe folder but not its registry entries. That caused instability in the system, probably related to the specificity of the key-loggers. Restoring the iSafe folder from within the AdwCleaner Quarantine Manager solved the issue. No need to do anything in the registry. I hope this helps!
Merci beaucoup, ce truc est sur et efficace, je l'utilise quand je m'apercoit que j'ai des pubs qui ne devraient pas exister (j'utilise adblock) et il les suprime a tout les coups! certains logiciels sur lesquels j'avait quelque doutes ont été suprimés aussi^^ c'est un bon outil
@Me1: I have read that YTD YouTube Downloader's installer is nowadays bundled with adware, so that might be the reason. If that's the case that detection would be weird since JDownloader has the same features + a lot of other features, its installer is bundled with adware as well (at least three different kinds) and it isn't falsely detected.
If I remember correctly Hotspot Shield was bundled with adware as well back when I used it years ago.
False positives (it's a legitimate VPN extension):
C:\Users\User\AppData\Local\Hola
HKLM\SOFTWARE\Google\Chrome\Extensions\ncffjdbbodifgldkcbhmiiljfcbgjag
If I remember correctly there's also a false positive for the Hola Unblocker Firefox add-on. However, the Firefox add-on stopped working for me - possibly due to AdwCleaner cleaning away files needed for it to work - and re-installing it doesn't help, so I can't submit a report for that add-on. The add-on can be installed from here if anyone wants to have a look at it: http://hola.org/
The following entries are false positives:
C:\Documents and Settings\User\Application Data\ProgSense (included with some software to look for updates - nothing malicious or deceiving)
C:\Documents and Settings\User\Application Data\Simple Adblock (adblocker now known as Adblock Plus knowingly installed by user for Internet Explorer)
C:\Documents and Settings\User\Local Settings\Application Data\Hola (knowingly installed by user)
HKCU\Software\ProgSense (included with some software to look for updates - nothing malicious or deceiving)
HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762} (belongs to ZoomBrowser EX, a Canon camera utility)
The following are proxy settings knowingly added by user:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - socks=localhost:1234
Thanks in advance for correcting the issue.
