Getting redirected when visiting mediafire download pages

andrew129260 · 31 May 2014

For best security, I would have both ticked. This also enabled 64bit Internet explorer, and integrates with UAC better.

UsernameIssues · 31 May 2014

ThisIsMadness91 said:

Sorry for the late reply. I had to go out today. I just took a quick look at the tutorial, and I'm a little confused. On my PC, the "enable protected mode" box in the security tab is ticked, and the "enable enhanced protected mode" box in the advanced tab is unticked. Should I tick them both or only one?

As andrew129260 said, check both.

The option named Enable Protected Mode should be checked by default.

Enable Protected Mode = ON
and
Enhanced Protected Mode.= ON
equals "64bit tabs"

Enable Protected Mode = OFF
and
Enhanced Protected Mode.= ON
equals "32bit tabs"

Since you do not use IE, you can reset it using these steps...
Internet Explorer - Reset
...including step 5 for total reset.

Then turn on Enhanced Protected Mode per that other tutorial.

A reset plus EPM should put IE in a safe enough state for this test.

andrew129260 said:

For best security, I would have both ticked. This also enabled 64bit Internet explorer, and integrates with UAC better.

Doh! Thanks for mentioning UAC. We might want that slider all the way up

ThisIsMadness91 · 01 Jun 2014

Thanks. I followed your instructions and tried two mediafire download links in IE11. I wasn't redirected either time, although one or two of the ad spaces appeared blank sometimes when I refreshed the page.

andrew129260 · 01 Jun 2014

Ok good. Keep in mind I do not trust mediafire, but it is up to you.

Glad you have it resolved. :)

ThisIsMadness91 · 01 Jun 2014

I just visited a few mediafire pages in Firefox and didn't get redirected, but I'm going to keep checking throughout the week to see if it stays that way.

ThisIsMadness91 · 02 Jun 2014

Bad news. I visited mediafire in Firefox and it redirected me again. I don't know why it didn't happen in Internet Explorer or why I was able to visit mediafire in Firefox yesterday without incident, but it seems the problem hasn't been solved yet.

Update: AdwCleaner found the same key in the registry that I mentioned in the first post. I don't expect MBAM to detect anything new, but I'll run a scan to be safe.

Update 2: MBAM didn't find anything.

UsernameIssues · 02 Jun 2014

The default (hopefully clean) install of W7 has subkeys under
HKCU\Software\AppDataLow\Software
There should be
HKCU\Software\AppDataLow\Software\Microsoft
And a few other good/valid keys if other software is installed.

Hopefully, AdwCleaner is not removing...
HKCU\Software\AppDataLow\Software
...as you first post seems to indicate.

Getting redirected when visiting mediafire download pages-software-key.png

ThisIsMadness91 · 02 Jun 2014

Oh, dear. That's rather worrying. What do you suppose I should do?

UsernameIssues · 02 Jun 2014

I'll let andrew129260 and/or cottonball advise you on what to do about that registry key. I don't use AdwCleaner - so I'm not all that familiar with it. I'm not saying that AdwCleaner is bad, just that I don't use it.

Some apps will rebuild parts of that key when they start...
...so maybe this is not that big of a deal.

andrew129260 · 02 Jun 2014

Repost the logs again so I can see it.......THIS IS IMPORTANT: Delete both jrt and adwcleaner.

Download them again and run them like before with these instructions:

1.) Download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool

Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
Upload the contents of that logfile in your next reply using the paper clip on the reply box.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

2.) Using AdwCleaner v3: Scan & Clean:

Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Upload the contents of that logfile in your next reply using the paper clip on the reply box.

Junkware Removal tool:

3.) Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Upload the contents of that logfile in your next reply using the paper clip on the reply box.
When completed make sure to re-enable your antivirus