Version 6.0. After scanning, Adwcleaner finds in the Chrome tab: Value: "startup_url" and data "hxxp://search.conduit.com/...". Although I select the Clean button, this value and data remain after the cleaning process and reboot.
I have a couple of false positives to report that keep getting flagged, but shouldn't be.
1. Under Scheduled Tasks, RunAsStdUser Task is C:\Program Files\GPSoftware\Directory Opus\dopus.exe
This is a legit Directory Opus entry.
2. Under Shortcuts, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeraByte Unlimited\TeraByte OSD Tool Suite Pro\Ready To Run Scripts\INISTART - Reset Windows Startup.lnk
This is a legit Terabyte Image for Windows shortcut.
Let me hear!!!!!!!! ....the right way is.......
***** [ Internetbrowser ] *****
[-] [C:\Users\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Gelöscht : hxxp://www.palikan.com/?f=7&a=plk_bimmed_15_53&cd=2XzuyEtN2Y1L1Qzu0CyE0EzyzzyEtDyByByC0F0DtBtD0DyDtN0D0Tzu0StCyEyCtAtN1L2XzutAtFtCyDtFtAtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0FtCtCtA0DtAtBtGyB0AyDyCtG0B0EtDzytGtB0CzytAtG0FtCzztByEyByB0FtDtCzz0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtAyD0CtB0C0DyCtGtAzzyBtCtGyEtD0ByCtGzyyD0B0DtGyBzy0E0A0CtAyByD0F0CtB0E2QtN0A0LzuyE&cr=1289375483&ir=
[-] [C:\Users\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : ljmibnagodajacnnbifpamhggcohblip
*************************
The network has a new infection called - texteditor.
C:\Users\User\AppData\Roaming\TextEditor\Daemon\TextEditor
Located in the startup. Opens the search engine created by fraudsters.
It would be nice if the author can add the cure against this infection in his program.
Sorry for my bad English.I used a Google translator))
Also cannot download as Norton blocks and removes it. Here is copy of Norton details:
Filename: adwcleaner[1].exe
Threat name: Trojan.Gen.SMH
Full Path: c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\0xz70k18\adwcleaner[1].exe
____________________________
Details
Unknown Community Usage, Unknown Age, Risk High
Origin
Downloaded from
http://download.bleepingcomputer.com/dl/ccc7b1be60ac8b673cbab8cd91aea0c9/5405e713/windows/security/security-utilities/a/adwcleaner/AdwCleaner.exe
Activity
Actions performed: Actions performed: 1
____________________________
On computers as of
9/2/2014 at 8:45:45 AM
Last Used
9/2/2014 at 9:49:52 AM
Startup Item
No
Launched
No
____________________________
Unknown
It is unknown how many users in the Norton Community have used this file.
Unknown
This file release is currently not known.
High
This file risk is high.
Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.
___________________________
http://download.bleepingcomputer.com/dl/ccc7b1be60ac8b673cbab8cd91aea0c9/5405e713/windows/security/security-utilities/a/adwcleaner/AdwCleaner.exe
Downloaded File adwcleaner[1].exe Threat name: Trojan.Gen.SMH
from bleepingcomputer.com
Source: External Media
adwcleaner[1].exe
___________________________
File Actions
File: c:\Users\ADMIN\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\0XZ70K18\ adwcleaner[1].exe Removed
____________________________
File Thumbprint - SHA:
f303a32ba4a44ae7d25b73f5b6f3f2c3dcf6d9970ebf88de816b399eedce80b1
File Thumbprint - MD5:
Not available
Help please - I run regularly AdwCleaner (most up to date) and I always find items flagged in Chrome - I click on the clean button and after rebooting I found the following:
# AdwCleaner v3.210 - Report created 19/05/2014 at 13:19:25
# Updated 19/05/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Paulo - PAULO-PC
# Running from : C:\Users\Paulo\Desktop\Clean Up\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Browsers ] *****
-\\ Internet Explorer v0.0.0.0
-\\ Google Chrome v34.0.1847.116
[ File : C:\Users\Paulo\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Deleted [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0103&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEtAtC0D0A0ByCyDtB0DzytN0D0Tzu0CyByByDtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=938586735&ir=
Deleted [Startup_urls] : hxxp://search.conduit.com/?ctid=CT3306061&SearchSource=48&CUI=UN25144629123183723&UM=2
Deleted [Startup_urls] : hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEtAtC0D0A0ByCyDtB0DzytN0D0Tzu0CyByByDtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=938586735&ir=
*************************
AdwCleaner[R47].txt - [1467 octets] - [19/05/2014 13:18:36]
AdwCleaner[S21].txt - [1397 octets] - [19/05/2014 13:19:25]
I assume the Chrome items are delete. I run AdwCleaner again, and they seem to be gone. If I run again AwdCleaner a few hours later, the items are back. Where are they coming from? How can I clean them permanently? I do not have ask.com nor aol.com. Please, help.
Contact at pady5star@gmail.com - thanks
########## EOF - C:\AdwCleaner\AdwCleaner[S21].txt - [1458 octets] ##########
