DownLoadNSave still there

neversatisfied · Nov 5, 2012

Hello,

I have followed the directions in the READ/RUN ME thread and still have an issue.

About 1-2 weeks ago I started seeing random words transformed into hyperlinks to little ad boxes appearing on many websites or some times just a line saying "ads by downloadnsave". I don't really do any risky stuff online so I'm not sure where this came from. There were also lots of stationary ad boxes from downloadnsave appearing on certain pages like youtube but those seem to be gone now.

here are the logs

TimW · Nov 6, 2012

You need to attach the log from running MGTools.exe -- C:\MGLogs.zip.

neversatisfied · Nov 6, 2012

Is this what you mean?

chaslang · Nov 7, 2012

Yes that's the file specified.

Just an FYI. You picked this up from porn sites.

Exit your Firefox browser ( it must be shutdown to do the below ) and use IE to read this:

Navigate in Windows Explorer to the below file

C:\Users\CouldBAny1\AppData\Roaming\Mozilla\Firefox\Profiles\y83npvu6.default/prefs.js

Open this file in notepad and delete only the lines beginning with the below. I had to shorten them because they are very long lines. These should be line number 35, 36, and 37.

user_pref("extensions.5072606b10d87.epoch", "1352255856");
user_pref("extensions.5072606b10d87.scode", ..........
user_pref("extensions.5072606b10d87.url"............

After deleting only those lines, save the file.

Then rerun Firefox and see if you still have a problem.

neversatisfied · Nov 7, 2012

Forgive me but I can't seem to figure out how to locate the file specified. There is no AppData folder in user CouldBAny1??? I must be looking in the wrong place. Also the hyperlinks are showing up in IE as well (I never use it so I hadn't noticed). Is this a problem associated only with certain browsers?

As far as porn goes do you mean any/all porn sites? because (full disclosure) I have had a recurring membership to Videobox for over a year now and never had any problems with it. It's a business/pay site which I assume would be safe and clean. I don't really mess with anything else as far as that goes because I don't need to, and I know it's all poisonous.

Two things I just recall that may have been mistakes on my part. About 9 months to a year ago I used a couple of youtube2MP3 converter websites that did look kind of sketchy with obnoxious ad banners and links every where but I got nervous about that and stopped using them. Never noticed any problems after that though.

Also after watching the movie Dread I Did a google Image search for 1 of the actresses and did follow some of the links to the images but it was just the type of stuff you would find on IMDB not nude/porn type sites. And that was about 1-2 months ago and the hyperlink ads only showed up last week. Don't these type of problems show up as soon as you get infected??

TimW · Nov 8, 2012

Have you installed a pop up blocker on your browsers?

neversatisfied · Nov 8, 2012

Update-progress!

I Did not have a pop up blocker on firefox so I added one, and then I checked the add-ons (should have done this at the start I know) and found DownloadNSave. So I deleted it and found the same add-on in IE but the options were disabled, so I located the file on the main drive and deleted that.

Afterwards I was able to find and edit the file you said and things seem to good now, although downloadnsave is still listed in the IE add-ons tab under 'not available'. I can't seem to do any thing to it but IE seems clean now as well. Is this a remnant or whats left of the file?

Anyways thank you very much for your help!

TimW · Nov 11, 2012

Try running CCleaner.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

After doing the above, you should work thru the below link

How to Protect yourself from malware!

Malware removal from a National Chain =$149
Malware removal from MajorGeeks = $0

Log in or Sign up

DownLoadNSave still there

neversatisfied Private E-2

Attached Files:

mbam-log-2012-11-05 (18-31-39).txt

RKreport[1]_S_11052012_02d1825.txt

hijackthis.log

TDSSKiller.2.8.15.0_05.11.2012_18.40.53_log.txt

HitmanPro_20121105_1854.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

neversatisfied Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

neversatisfied Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

neversatisfied Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member