Getting redirected when visiting mediafire download pages

[andrew129260]

For best security, I would have both ticked. This also enabled 64bit Internet explorer, and integrates with UAC better.

 

[UsernameIssues]

Sorry for the late reply. I had to go out today. I just took a quick look at the tutorial, and I'm a little confused. On my PC, the "enable protected mode" box in the security tab is ticked, and the "enable enhanced protected mode" box in the advanced tab is unticked. Should I tick them both or only one?

As andrew129260 said, check both.

The option named Enable Protected Mode should be checked by default.

Enable Protected Mode = ON
and
Enhanced Protected Mode.= ON
equals "64bit tabs"

Enable Protected Mode = OFF
and
Enhanced Protected Mode.= ON
equals "32bit tabs"


Since you do not use IE, you can reset it using these steps...
http://www.sevenforums.com/tutorials/1222-internet-explorer-reset.html
...including step 5 for total reset.

Then turn on Enhanced Protected Mode per that other tutorial.

A reset plus EPM should put IE in a safe enough state for this test.

For best security, I would have both ticked. This also enabled 64bit Internet explorer, and integrates with UAC better.

Doh! Thanks for mentioning UAC. We might want that slider all the way up

 

[ThisIsMadness91]

Thanks. I followed your instructions and tried two mediafire download links in IE11. I wasn't redirected either time, although one or two of the ad spaces appeared blank sometimes when I refreshed the page.

 

[andrew129260]

Ok good. Keep in mind I do not trust mediafire, but it is up to you.

Glad you have it resolved.

 

[ThisIsMadness91]

I just visited a few mediafire pages in Firefox and didn't get redirected, but I'm going to keep checking throughout the week to see if it stays that way.

 

[ThisIsMadness91]

Bad news. I visited mediafire in Firefox and it redirected me again. I don't know why it didn't happen in Internet Explorer or why I was able to visit mediafire in Firefox yesterday without incident, but it seems the problem hasn't been solved yet.

Update: AdwCleaner found the same key in the registry that I mentioned in the first post. I don't expect MBAM to detect anything new, but I'll run a scan to be safe.

Update 2: MBAM didn't find anything.

 

[UsernameIssues]

The default (hopefully clean) install of W7 has subkeys under
HKCU\Software\AppDataLow\Software
There should be
HKCU\Software\AppDataLow\Software\Microsoft
And a few other good/valid keys if other software is installed.

Hopefully, AdwCleaner is not removing...
HKCU\Software\AppDataLow\Software
...as you first post seems to indicate.

 

[ThisIsMadness91]

Oh, dear. That's rather worrying. What do you suppose I should do?

 

[UsernameIssues]

I'll let andrew129260 and/or cottonball advise you on what to do about that registry key. I don't use AdwCleaner - so I'm not all that familiar with it. I'm not saying that AdwCleaner is bad, just that I don't use it.

Some apps will rebuild parts of that key when they start...
...so maybe this is not that big of a deal.

 

[andrew129260]

Repost the logs again so I can see it.......THIS IS IMPORTANT: Delete both jrt and adwcleaner.

Download them again and run them like before with these instructions:

1.) Download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool

• Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Upload the contents of that logfile in your next reply using the paper clip on the reply box.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

2.) Using AdwCleaner v3: Scan & Clean:

Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Upload the contents of that logfile in your next reply using the paper clip on the reply box.

Junkware Removal tool:


3.) Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Upload the contents of that logfile in your next reply using the paper clip on the reply box.
• When completed make sure to re-enable your antivirus

 

[ThisIsMadness91]

Is there anything I need to do when deleting JRT other than delete JRT.exe?

 

[andrew129260]

Just delete it, yes then download the news ones. They are updated constantly.

Can you also:

Download DDS:

DDS.com

Save the file to your pc. Then open the dds icon to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop.
Include the contents of both logs in your next post by using the paperclip

 

[ThisIsMadness91]

Here you go. Next time I run AdwCleaner, if it detects anything in the registry, I won't clean it right away and will post the report for you to check.

 

[aritra2116]

Both AdwCleaner and JRT have fixed the start pages of both Firefox and IE (must have been caused by some adware installation). DDS seems to have reset the hosts file so it is worth checking if you still have the same redirection problem.

This looks a bit suspiscious

C:\Program Files\Bonjour\mDNSResponder.exe

Do you know what it is?

And by the way, I'll let Andrew continue from here. I guess you can also try RogueKiller as a last resort (though my word is not the final word for your problem).

DO NOT use RogueKiller unless specified by other professionals in this thread.

 

[ThisIsMadness91]

The redirect is still happening, unfortunately. The last few times have all been to updowntuv.com, with Java being the alleged program in need of updating despite the fact that I uninstalled Java nearly two years ago.

As for "C:\Program Files\Bonjour\mDNSResponder.exe", I had a look on Google and it seems to be part of a program by Apple called Bonjour which is sometimes installed at the same time as iTunes. I installed iTunes a few years ago when I got my first iPhone, although I don't know if Bonjour is needed for iTunes to run properly, nor do I know if I need iTunes installed to be able to transfer photos from my phone to my PC.

 

[Jacee]

Please download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forum and save it to your desktop


Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.

Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.


Disable the proxy settings in Internet Explorer:
1) Under “Tools” in the browser tool bar select “Internet Options”.
2) In the “Internet Options” window that pops up, click the “Connections” tab at the top.
3) Click “LAN Settings” near the bottom of the “Connections” section.
4) If the “Proxy server” checkbox is marked with a check, click it to deselect/uncheck it.
5) Click “Ok” to close the “Local Area Network (LAN) Settings” window.
6) Click “Ok” to close the “Internet Options” window.
Reboot
Make sure "Proxy server" is still disabled under your LAN Settings.



Tell me if you're still being redirected.

 

[ThisIsMadness91]

I just followed your instructions, and I didn't get redirected. However, I suspect that the redirect may only occur once every 24 hours. I'll check again tomorrow evening to see what happens.

 

[ThrashZone]

That would be one weird redirect to only happen every 24 hours

For the record No you don't need iTunes to manually access your iphone's personal pictures/ videos and drag and drop or copy and paste them on to your computer,,
You do however need iTunes to add custom ring tones...
You also need iTunes to add files from your computer to your iphone though,

Bonjour is optional if memory serves it's a separate listing in uninstall a program,
When iTunes updates it might re-add Bonjour I'm not sure though ?
Cheers.

 

[ThisIsMadness91]

I'm probably completely wrong about the redirect. I've only been checking once a day so far, so it could be something that happens more than once a day and I don't know it. It could be a certain ad that's loading and causing the redirect, for all I know. But there's so much I don't know about computers, all of this is just speculation.

Thanks about iTunes and Bonjour. I may uninstall them both since I only connect my phone to my PC once in a while to transfer photos over.

 

[ThrashZone]

Hi,
No problem about iTunes it's pretty much bloatware anyway,
If I didn't play around with ring tones with an app I'd uninstall it too
Windows Media Player plays all of my music
Cheers.