Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Downloaded Trovi, still getting redirects to ads


  • This topic is locked This topic is locked
8 replies to this topic

#1 dennis2015

dennis2015

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:13 AM

Posted 11 January 2015 - 07:10 PM

Hi,

 

I downloaded the Trovi malware yesterday and ever since then I am experiencing redirects to ad sites when browsing using firefox. I am using windows 8.1, firefox 34.0.5. The problem only shows once or twice in a row every dozen or so times I click a link, does not seem to depend on where I am going though. I tried all of the following steps listed in this link I found regarding deleting Browser redirect viruses, but I am still experiencing the problem. http://malwaretips.com/blogs/remove-browser-redirect-virus/. The programs listed did quarantine or remove a number of files, but apparently didn't catch everything.

 

I have also noticed slower start up times, where the windows login screen will appear but will not respond to keyboard or mouse input for several seconds. Also, I noticed that when my machine goes into sleep mode and I try to start it back up, it does not respond to keyboard or mouse input, and I am forced to press the power button to shut it down, then restart the machine entirely. Don't know if that is related.

 

I tried to run DDS found on your site, but apparently it only works for windows 7 and earlier, and I could not find a windows 8 version on the site. When I try to run the windows 7 version the program terminates with a pop up message saying "dds was not meant to run in compatibility mode". Do you know of a safe alternative to getting the logs you need? I did find some links online but not sure if I should trust those.

 

I understand that this process will take at least a week or so, especially since I don't have the logs right now. Can you advise if it is safe to do my banking online or use online merchants such as amazon?



BC AdBot (Login to Remove)

 


m

#2 satchfan

satchfan

  • Malware Response Team
  • 2,640 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:03:13 PM

Posted 12 January 2015 - 05:31 AM

Hello dennis2015 and welcome to Bleeping Computer.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.


  • run AdwCleaner
  • when it has finished, select Clean
  • if it asks to reboot, allow the reboot
  • on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

thisisujrt.gif Please download Junkware Removal Tool to your desktop.

  • shut down your protection software now to avoid potential conflicts.
  • run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
  • the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • on completion, a log (JRT.txt) is saved to your desktop and will automatically open
  • post the contents of JRT.txt into your next message.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • press Scan button
  • it will produce a log called FRST.txt in the same directory the tool is run from
  • please copy and paste log back here.
  • the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Logs to include with next post:

AdwCleaner log
JRT.txt
FRST.txt
Addition.txt


Thanks

Satchfan

 


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#3 dennis2015

dennis2015
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:13 AM

Posted 12 January 2015 - 05:35 PM

I tried running ADW cleaner, left all boxes checked, and selected clean. I got a log. But now firefox will not open, and that is unacceptable. What went wrong here? The log is attached.

Attached Files



#4 satchfan

satchfan

  • Malware Response Team
  • 2,640 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:03:13 PM

Posted 12 January 2015 - 05:46 PM

firefox will not open, and that is unacceptable.

 

Please use your terms of phrase a little more respectfully. You came here for help and we are volunteering our time for nothing in order to help you.

The programs that you were advised to run are dealing with what was seen in your logs and only deal with infections. If Firefox is no longer working then our programs were not the problem, the infections were.

Please continue with the other instructions in another browser if necessary, (IE would be my choice as Chrome comes with its own problems).

Satchfan


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#5 dennis2015

dennis2015
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:13 AM

Posted 12 January 2015 - 05:54 PM

Firefox has stopped opening entirely. By that I mean stop opening, period. No error message, no new window. The icon on my taskbar flashes a few seconds and nothing happens.

 

Just had to download firefox again from the mozilla website, and fortunately I am able to use it normally now, with all my bookmarks and settings intact. What Adw did was EXTREMELY worrying though. What if I got this problem with IE, and it was my only browser? Did you ever see anyone else get this problem running anti-malware, was it something I selected in ADW before clicking clean, judging from the log I sent you? If it was something I selected, please be aware that I have no idea what those files do and whether I actually need them to get my machine to work properly. If there are certain files I should specifically avoid tampering with, I will need advance warning.


Edited by dennis2015, 12 January 2015 - 05:56 PM.


#6 satchfan

satchfan

  • Malware Response Team
  • 2,640 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:03:13 PM

Posted 12 January 2015 - 06:14 PM

Did you ever see anyone else get this problem running anti-malware, was it something I selected in ADW before clicking clean
I have never had anyone having a problem using AdwCleaner. AdwCleaner only targets Adware and does not affect Windows system files.

I don't feel safe following the rest of your instructions until I have some reassurance that it will not leave my internet access even worse off.
We do not "guarantee" anything as every computer has a different problem/infection. However, the state of your Internet connection would not be affected by any instructions you receive here but by the infections on your computer or problems with your provider.

If you don't feel comfortable about following the advice, please let me know and I'll close the topic.

Satchfan

My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#7 dennis2015

dennis2015
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:13 AM

Posted 12 January 2015 - 06:59 PM

Alright, I will continue using my browser normally and see what develops. Please close the topic, I will be back if I want more help.



#8 satchfan

satchfan

  • Malware Response Team
  • 2,640 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:03:13 PM

Posted 13 January 2015 - 02:47 AM

Please close the topic, I will be back if I want more help.

 

 

OK will do but AdwCleaner got rid of "Astromenda" and I daresay there is more that needs cleaned up.

 

As you request, I'll close this and if the problems persist, please start a new topic and we'll deal with what's left.

 

Satchfan


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#9 satchfan

satchfan

  • Malware Response Team
  • 2,640 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:03:13 PM

Posted 13 January 2015 - 02:47 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users