Getting redirected when visiting mediafire download pages

ThisIsMadness91 · May 28, 2014

The last two times I have visited a mediafire download page, I have been redirected to a dodgy page asking me update programs such as Firefox and Java (even though I uninstalled Java over a year ago). The two domains I've seen for the page are lpmxp2.com and updowntot.com. I didn't stick around long enough to get a screenshot, but the two pages appeared to be identical with the exception of the alleged program update displayed. The first time this happened was three days ago, and the redirect only happened once that day. I visited mediafire again today, and the same thing happened.

I can't find any recent discussion on this anywhere so it doesn't appear to be a recent known problem. Any help would be appreciated.

Update: I ran a scan with AdwCleaner, and it found and removed this key from my registry: HKCU\Software\AppDataLow\Software. I'm going to run a Malwarebytes scan now.

cottonball · May 28, 2014

ThisIsMadness91,

Is there anything else added to this:

HKCU\Software\AppDataLow\Software

ThisIsMadness91 · May 29, 2014

I couldn't find anything. The only other detections were my homepages for Internet Explorer and Firefox (GMail for both, which I set myself). I can upload the logs from before and after running the cleaner if it helps.

Also, I forgot to mention that Malwarebytes didn't detect anything (it's the free version, if that makes any difference).

Update: It also happens on zippyshare. The domain I saw this time was lp.sharelive.net.

andrew129260 · May 29, 2014

Try the following Microsoft fix it on this article,

How can I reset the Hosts file back to the default?

Then I suggest the following just to see if anything turns up:

1.) Download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool

Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
Upload the contents of that logfile in your next reply using the paper clip on the reply box.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

2.) Using AdwCleaner v3: Scan & Clean:

Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Upload the contents of that logfile in your next reply using the paper clip on the reply box.

Junkware Removal tool:

3.) Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Upload the contents of that logfile in your next reply using the paper clip on the reply box.
When completed make sure to re-enable your antivirus

ThisIsMadness91 · May 30, 2014

When resetting the hosts file, would it be better to use the "fix it for me" method or the "let me fix it myself" method?

andrew129260 · May 30, 2014

I would use the fix it for me.

ThisIsMadness91 · May 30, 2014

Here are the logs for AdwCleaner and JRT. I didn't use AdwCleaner's cleaner because it didn't detect anything apart from the homepages I'd set. Unfortunately, I forgot to disable my anti-virus when running the latter. Should I run it again with the AV disabled?

andrew129260 · May 30, 2014

Logs look fine, and do not worry about turning off the av. We just have that in there in case for some reason the AV is being not smart (FP)and calling it a virus.

Are you still having the redirect issues after repairing the host file? I have a lot more steps we can try if that is the case.

LuzTeTT · May 30, 2014

Is this happening on any other browsers of yours?

3D Jed · May 30, 2014

Sounds like a typical warez site scam. You go to a site offering 'free' stuff, click the link, and get re-directed to malware. This is how the warez sites make their money. Sleep with dogs, get fleas etc. Mediafire hosts mainly copyright infringing content - there's the clue. This ain't a computer problem, it's an illegal download problem, and the op is asking for help to do it.

LuzTeTT · May 30, 2014

3D Jed said:
Sounds like a typical warez site scam. You go to a site offering 'free' stuff, click the link, and get re-directed to malware. This is how the warez sites make their money. Sleep with dogs, get fleas etc. Mediafire hosts mainly copyright infringing content - there's the clue. This ain't a computer problem, it's an illegal download problem, and the op is asking for help to do it.

Mediafire goes out of their way to prevent illegal and copyright infringing content from being shared on their servers.

The OP's issue has nothing to do with clicking on scams. There is a real security issue here that is probably related to a toolbar infestation or hosts file jack, both of which are legitimate and innocent from any angle that you look at them.

The OP did not ask for help to download anything illegally.

ThrashZone · May 30, 2014

Kind of funny in a way,
mabm flags everything from Mediafire as corrupt and blocks it automatically

Did it to me attempting to download something Nick = PoomanUK posted there ?
I doubt it would of worked anyway different version of CorelDraw

Can't remember the other item I attempted to download ? a free photoshop file I believe from another reputable host I think Blue lightening t.v offering or tip squirrel ?
Cheers.

ThisIsMadness91 · May 31, 2014

I'm still being redirected, unfortunately. I've only checked in Firefox so far, so I'm not sure if it happens in Internet Explorer as well.

UsernameIssues · May 31, 2014

What version of Internet Explorer do you have?

Be careful if you go checking a website like this when using IE8.

ThisIsMadness91 · May 31, 2014

I'm pretty sure I'm using a more recent version than IE8, but is there a way for me to check?

UsernameIssues · May 31, 2014

See this post:
http://www.sevenforums.com/browsers...8-9-10-i-got-my-windows-7-pc.html#post2395795

ThisIsMadness91 · May 31, 2014

Thanks. I just checked and it's IE11. Should I check mediafire in that?

UsernameIssues · May 31, 2014

First, please turn on Enhanced Protected Mode per this tutorial:
http://www.sevenforums.com/tutorial...10-enable-32-bit-64-bit-ie10-windows-7-a.html
The info is the same for IE11.

Then you can test mediafire's site with IE11.

andrew129260 · May 31, 2014

If it does not happen in internet explorer, reset firefox under help, or uninstall and then reinstall again making sure to check the box to clear personal settings.

ThisIsMadness91 · May 31, 2014

Sorry for the late reply. I had to go out today. I just took a quick look at the tutorial, and I'm a little confused. On my PC, the "enable protected mode" box in the security tab is ticked, and the "enable enhanced protected mode" box in the advanced tab is unticked. Should I tick them both or only one?

Getting redirected when visiting mediafire download pages

New member

My Computer My Computer

At a glance

Retired ol' hound...

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

IT Support Pro

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

IT Support Pro

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

IT Support Pro

My Computer My Computer

At a glance

Developer

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Developer

My Computer My Computer

At a glance

R.I.P. Britton30=Gary

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

a.k.a. UNI

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

a.k.a. UNI

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

a.k.a. UNI

My Computer My Computer

At a glance

IT Support Pro

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer