Author Topic: Why adware cleaner shows this on repeated scan and clean (Read 20644 times)

jraju · « **on:** July 23, 2015, 07:09:30 am »

Hi,
Please see the attached file. I have tried normal and safe mode and opted cleaning of the found items . But it is repeating itself after the scan after reboot so many times.
How to get rid of it

Gamezertruth · « **Reply #1 on:** July 23, 2015, 03:52:09 pm »

look like your internet setting got hijacking by some adware ? have you run RogueKiller ?

Boggin · « **Reply #2 on:** July 23, 2015, 03:58:49 pm »

I'd see what JRT makes of it - reboot, open IE then run AdwCleaner again to see if it still reports.

The JRT download link is lower down the ADW page but you can use this one http://www.bleepingcomputer.com/download/junkware-removal-tool/

jraju · « **Reply #3 on:** July 24, 2015, 05:43:07 am »

Hi, boggins ,
I already ran the JRT tools. It does not catch anything. Shows everything fine. Rogue killer, i will try . I tried mbam but the scan was somewhat slow than expected while scanning and registry. Powercut auto abort the scan. I will try Boggins thro IE. But when scan, it does not show in browsers tab in the adware cleaner.
Update: what does that mean by open IE then run adware cleaner

jraju · « **Reply #4 on:** July 24, 2015, 06:10:59 am »

Hi,
I tried opening IE and then running the Adware cleaner. It shows the same results after each scan. Why after choosing safe mode. Is there any program indirectly running behind the screen

Update: Even i tried MSE by selecting the IE and scan. No threat found. But i do not know, whether MSE scans registry also

Boggin · « **Reply #5 on:** July 24, 2015, 07:43:07 am »

Do you still have MiniToolBox on your computer - if so check the boxes for Flush DNS, Report IE Proxy Settings, FF Proxy Settings if you have Firefox installed, Hosts Content and Winsock entries and post that.

jraju · « **Reply #6 on:** July 24, 2015, 08:07:57 am »

Hi, I tried rogue killer. It shows some entries in the registry in IE. When i deleted, strange, i lost internet connectivity. Dns policy diagnostics shown as disabled, but when i verified the services, it was started and set to automatic.
Another strange things noted that a web address, i could not remember was in the named service. I could not activate the internet.
I tried shanes repair tool and selected safe mode networking as per the program and selected few run, like dns server , ie, host file etc. This did not find anything, but ofcourse, i saw some error in the cmd processes of repair tool.
I think that somebody is connected to my computer and i solved the internet problem with resorting SR some 10 days back . I now got internet , so atleast i could express something to this forum. How to find the log of the services, i downloaded and ran , but i surely think that SR would have erased those things. How to view those logs. I also got a strange, ie could not find any problem in connection, but the connection actually could not be established.
I will again try the adware cleaner and report back to you all

jraju · « **Reply #7 on:** July 24, 2015, 08:22:14 am »

Hi, The problem persists , but internet restored due to SR.
I am enclosing the log .Pl tell what to get rid of this proxy server and proxy override

jraju · « **Reply #8 on:** July 24, 2015, 09:15:53 am »

Hi, I am enclosing the log of the repeated log by program

Samson · « **Reply #9 on:** July 24, 2015, 09:23:16 am »

Not a fix J, but your Firefox is out of date.

jraju · « **Reply #10 on:** July 24, 2015, 10:50:02 am »

Hi, Samson,
My firefox is updated one

Samson · « **Reply #11 on:** July 24, 2015, 10:52:30 am »

Quote from: jraju on July 24, 2015, 10:50:02 am

Hi, Samson,
My firefox is updated one

Yours shows v38.0.5. current is v39.0 or ESR v38.1

jraju · « **Reply #12 on:** July 24, 2015, 11:04:54 am »

hi, Pl see this when i tried update

Samson · « **Reply #13 on:** July 24, 2015, 11:16:00 am »

Odd

Firefox 38.0.6 was released 6 weeks ago, and the current version 39.0 was released 3 weeks ago

So I don't understand why you are getting the message that yours is up to date.

May be connected to your "Proxy" issues".....Get that sorted first, then try updating Firefox afterwards.

Check in Firefox Options>Advanced>Network>Settings that you have "No Proxy" checked as below.

jraju · « **Reply #14 on:** July 24, 2015, 11:32:41 am »

hi, should i check no proxy instead of default system settings?

Samson · « **Reply #15 on:** July 24, 2015, 11:35:04 am »

Try it, and then try updating Firefox. You can always switch back again if you need to.

jraju · « **Reply #16 on:** July 24, 2015, 11:39:11 am »

Hi, Samson,
What is your take out of my problem. I have already enclosed program log as well as my explanation. What does this setting. It will not enable other party to connect. Pl

Samson · « **Reply #17 on:** July 24, 2015, 11:50:15 am »

Quote from: jraju on July 24, 2015, 11:39:11 am

Hi, Samson,
What is your take out of my problem. I have already enclosed program log as well as my explanation. What does this setting. It will not enable other party to connect. Pl

Sorry J, I can't help you there, I don't know what is going on. Best for Shane or Boggin or Julian to help you, they all have far, far more knowledge, skills and experience than me

I was just pointing out that your version of Firefox was out of date, the fact that you cannot update it may well be a symptom of your problem. Sit tight and the cavalry will soon ride over the horizon to help

jraju · « **Reply #18 on:** July 24, 2015, 11:57:30 am »

Hi, i updated the firefox to latest version. Is it not strange that one has to go to the site to install the latest and the previous version is shown as fully updated, but not.

Julian · « **Reply #19 on:** July 24, 2015, 01:56:27 pm »

its a loopback address 127.0.0.1 meaning it goes back to your network card. alright and with proxy settings try running windows repair number 07 repair internet explorer and repair number 13 repair network. I've seen this before using hitman pro. if you still see this i'm going to give you step by step commands to clean network setting lol...but to be honest I ignore when it has a loopback address sometimes it is needed for web browsing because it may reappear if you open your browser.

jraju · « **Reply #20 on:** July 24, 2015, 09:12:26 pm »

Hi, Boggins,
Please see the enclosed file and advise further

jraju · « **Reply #21 on:** July 24, 2015, 09:40:07 pm »

Hi, I also enclose the latest adwtext. It seems that the problem is fixed by the log after reboot. But i want confirmation from you that nobody is proxy overriding me.
Really helpful tool boggins. Farbar minitool just takes seconds to accomplish selected items. What does this program does, pl also say, why winsock and host content information have been advised to check.

Gamezertruth · « **Reply #22 on:** August 10, 2015, 11:19:17 pm »

so your problem is fixed now ?

jraju · « **Reply #23 on:** August 11, 2015, 04:40:32 am »

Hi, the Problem solved. But i was expecting reply from Boggins

Gamezertruth · « **Reply #24 on:** August 11, 2015, 05:19:12 am »

aha i see