1clickdownloader

At the suggestion of a friend I have run spybot search and destroy on my laptop and it found a few instances of malware. I am somewhat concerned as a paid subscriber that Avast did not catch these instances.

I also notice that I have 1clickdownloader in my files. I have repeatedly tried to remove it using Avast’s “Open in Sandbox” but although a message comes up saying it has been removed it continues to appears listed among my programs even after rebooting my laptop.

What do I need to do to get rid of this program?

Thank you

with todays malware spybot search and destroy is a toy …replace it with Malwarebytes www.malwarebytes.org there is a free version :wink:

run a quick scan and post the log here

Pondus:

I appreciate your prompt response.

I am also a paid subscriber to Malwarebytes. I had run it earlier and it did not detect any problems.

I just ran it again and here it the Log:

Malwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.09.04.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lewis :: LEWIS-PC [administrator]

Protection: Enabled

9/4/2012 10:21:29 AM
mbam-log-2012-09-04 (10-21-29).txt

Scan type: Full scan (C:|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 312303
Time elapsed: 40 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Thank you for your assistance

OK …go here http://forum.avast.com/index.php?topic=53253.0 and run the first program in the guide AdwCleaner

post that log…

did that fix it ? …if not Essexboy will have a look …he is notified :wink:

When I click on this link: http://forum.avast.com/index.php?topic=53253.0 it takes me here: http://general-changelog-team.fr/en/tools/15-adwcleaner.

From there I am told to:“Click here to download AdwCleaner” which takes me here: http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner [A Site in French.]

On that site when I click on the green downwards arrow underneath where it says:

Size 499.28 KB
Downloads 1059321
Author Xplode
Created 2012-03-03 17:22:02
Created by Xplode
Changed at 2012-08-30 18:30:17
Modified by Xplode

I got an Avast warning that Advast had blocked an incoming Trojan Virus

After that if I click on that green arrow I get this message:

This webpage is not available

The connection to general-changelog-team.fr was interrupted.
Here are some suggestions:
Reload this webpage later.
Check your Internet connection. Restart any router, modem, or other network devices you may be using.
Add Google Chrome as a permitted program in your firewall’s or antivirus software’s settings. If it is already a permitted program, try deleting it from the list of permitted programs and adding it again.
If you use a proxy server, check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don’t believe you should be using a proxy server, adjust your proxy settings: Go to the wrench menu > Settings > Show advanced settings… > Change proxy settings… > LAN Settings and deselect the “Use a proxy server for your LAN” checkbox.

The “Use a proxy server for your LAN” checkbox was already deselected.

super antispyware,ccleaner and malewarebytes run in safe mode should remove it

malwarebytes should only be run in safe mode if it dont work in normal mode

Essexboy is notified and will have a look when he is back soon …

or you can try this http://www.malwareexperts.com/1click-downloader-removal-guide/

Uploaded to Avast as a false positive… The previous version is available here http://www.softpedia.com/progDownload/AdwCleaner-Download-212632.html

According to at least one website while 1clickdownloader is not malware per se it “may be used to compromise computer security by the hacker.”

http://greatis.com/blog/not-a-virus/tools/1clickdownloader-exe.htm

Here is another not to favorable opinion about 1clickdownloader

Delete 1ClickDownloader Rogue Anti-spyware from PC completely & safely

1ClickDownloader, the rogue anti-spyware works as a tracking cookie and is shared among websites to keep track of users internet browsing habits. With its regular tracking, 1ClickDownloader is accepted by the system everytime with which it is made easier for the program to recognize the user that exists and have it data tracked. It silently monitors & records user browsing & would target user system by generating fake scan & reports. It is a new technique hackers & advertisers are opting for to know the products you are basically interested in so that they can advertise like products for your system. In this very way 1ClickDownloader can potentially damage your system & causes it to perform abruptly. It intrudes malware & trojans without user permission to harm the integrity of the very system. This is a big threat to the security of the system and it is thus important to remove 1ClickDownloader right after it is detected.



http://www.spywarescansoftware.com/delete-1clickdownloader-rogue-anti-spyware-from-pc-completely-safely

I am sorry but there are four different posters giving advice and I am not certain whose advice I am to be taking.

Pondus you were the first to respond. Could you please clarify for me what I should be doing now?

Thank you

Lewis

Purrington.

Ryan1404 is not a qualify malware removal here at Avast! Forums.

Nesivos is just given you info on 1clickdownloader and he is a known helper here as Pondus and myself.

Essexboy is our malware specialist so download AdwCleaner from the link he gave you and follow his instructions.

I ran Adware Cleaner and got this message at the end:

AdwCleaner v1.801 - Logfile created 09/04/2012 at 17:09:38

Updated 14/08/2012 by Xplode

Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

User : Lewis - LEWIS-PC

Boot Mode : Normal

Running from : C:\Users\Lewis\Downloads\adwcleaner (2).exe

Option [Search]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

[x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Registre - GUID] *****

***** [Internet Browsers] *****

-\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\ Google Chrome v21.0.1180.89

File : C:\Users\Lewis\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.


AdwCleaner[R1].txt - [4333 octets] - [04/09/2012 16:23:37]
AdwCleaner[S1].txt - [292 octets] - [04/09/2012 16:25:02]
AdwCleaner[S2].txt - [3670 octets] - [04/09/2012 16:25:22]
AdwCleaner[R2].txt - [981 octets] - [04/09/2012 17:09:38]

########## EOF - C:\AdwCleaner[R2].txt - [1108 octets] ##########

1clickdownloader still appears on my program list.

What do I do now?

Thank you

Now we do a search and destroy

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
/md5stop
%systemdrive%$Recycle.Bin|@;true;true;true
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS /s
CREATERESTOREPOINT

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

I have run the OTL per your instructions.

Attached is the log that appeared when the program stopped running. It is the only log that appeared.

Thank you

Lewis

so advice from non qualified malware removal is not needed? odd forum.

World of Trust rating on the recommended site here: http://www.mywot.com/en/scorecard/malwareexperts.com/comment#comment

Not all sites that purport to aid or help in cleansing or removing unwanted or malicious files are safe to visit.

One way to become qualified in malware removal is to attend and take classes here: (UNITE) http://www.uniteagainstmalware.com/schools.php

I would go back to the link posted and modify it to hxxp: to prevent unsuspecting users from having any problems.

Although not the place to argue, it has always been forum policy that only qualify forum members advise in the use of some of the tools in the removal of malware because of the dangers involve in rendering a machine inoperable.

If you desire to become one, you can take the course in one of the schools mchain pointed to you. Essexboy is instructor in Geek to Go if he sees fit, during your training, that you already know enough and still want to help here you are more than welcome.

Let me know if it is clear after this

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1422163307-3788927115-2030255185-1000\..\SearchScopes\{12995981-2FD6-4BEE-9FB0-B1674E8E5E7E}: "URL" = http://websearch.4shared.com/results?q={searchTerms}
IE - HKU\S-1-5-21-1422163307-3788927115-2030255185-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=100&systemid=102&sr=0&q={searchTerms}
[2012/09/04 07:13:42 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Lewis\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\OneClickDownload@OneClickDownload.com
O2:64bit: - BHO: (4sharedExt) - {95525BD9-6136-4A26-8263-9CEE295D442D} - C:\Program Files (x86)\4shared Toolbar\4sharedExt64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (4shared Toolbar) - {95080B13-AA71-4EE8-B951-7E98221E1ED5} - C:\Program Files (x86)\4shared Toolbar\4sharedbar64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
[2012/09/04 07:12:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\1ClickDownload
[2012/04/05 08:29:46 | 000,000,000 | ---D | M] -- C:\Users\Lewis\AppData\Roaming\4Sync

:Commands
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done

I ran the program per you instructions.

After rebooting the attached notpad message appeared.

The 1clickdownloader still appears on my program list.

Thank you

Lewis