browser abuse

[vhelp]

Hi, I keep getting these and other kinds of pop-up messages. It happened when I thought I was downloading an app and it turned out to be this browser download manager. When I realized it was not the app in question, i uninstalled the app. But it left behind all these nagging abusive webpages that in most cases take over my browser and I have to shut it down via ctrl+alt+del.

While I was out this afternoon, i picked up Kaspersky internet security, and malwarebytes anti-malware premium. But if they will not remove this annoyanc or you guys don't recommend it, I can returned them and get the correct one.

What software do I need to install in order to get rid of this annoyance ?

[october262]

try clearing your internet cookies & history

[vhelp]

No, that doesn't work. This app purposely left crippling routines for any browser I try. its not cookies or anything like that. this is some kind of hard-coded hook purposes left to annoy and abuse, and who knows what else.

[Marsia Mariner]

Just switch to a browser that supports NoScript.

[vhelp]

I don't want to fiddle with scripts. I use this forum site, amazon, ebay, and a few others. I don't want to have to turn on/off scripts. It defeats the purpose of browsing. no one should have to do that. even doing that is annoying enough, which is why i stopped doing that long ago.

[sambat]

System Restore to a point before the download?

[vhelp]

no, too late. last one was on 11/9 but i can't be sure the app wasn't installed before it. plus i've installed other apps and worked on various projects since. and i don't want to upset that less i forget something that was critical. it would be better to install the necessary software that removes this type of nonsense. i just don't know the exact term for this particular intrusion that a specific software can remove just this once. and then i can create a restore point from that time on. it would be better if i could image this thing but this is over 700gig and i don't have the time to image, which is another reason i prefer partitions, one very small one and the rest for programs.

[usually_quiet]

@vhelp Are you seeing this pop-up only at VideoHelp? Several weeks ago I was seeing a similar (maybe the same) pop-up once in a while, when scrolling down random pages here at VideoHelp using a laptop touchpad. I hadn't installed any software recently, malware scanners found nothing, and I could never figure out how to make it appear on purpose, so I didn't report it as a problem/infection at VideoHelp. I couldn't be sure that the trackpad wasn't registering a click on some dubious advert that I wasn't intentionally clicking on. I haven't seen the pop-up for a while, so I figured whatever was causing it had been removed.

[JVRaines]

Here is a 3-5 step procedure to get rid of this nuisance.

[vhelp]

UQ, it depends. sometimes a lot and sometimes once in a while. but i know what it was. it was the app that i installed because this never happened to me, well, it did once early this year i was getting it but i managed to get rid of it but don't recall how. in fact, i believe i posted about it here, back then and someone told me ? how to remove it. i don't quiet remember how i got rid of it but its back now and its really annoying. i gonna try JVR's suggestion now. i'll let you know how it goes, if its not too convoluted, but anything is better than purchasing software, and if this can resolve it, i can save myself a $100 bucks and return what i picked up today.

[vhelp]

ok. before i begin. where the heck is "create a restore point" ? i don't want to restore. i want to create a restore point but can't find it.

EDIT: never mind. i found it. under control panel/system....

[vhelp]

ok. it took exactly 1 minute to create a restore point. win 7 home prem.

[vhelp]

..and while i was entering this post, a pop-up occured, "Recommend: stop search tracking - incognito"

when i hover my mouse at the TAB (i'm using chrome) the balloon pop-up says "Search Incognito - The Privacy Enhanced Search Engine"

warning: dont click on the link below, or you will prob get infected. i'm just showing what just popped up.

http://www.getsearchincognito.com/pq/aff?implementation_id=aff142-pp&offer_id=399&aff_...JjZT05NjgxNzc=

Either videohelp or else "https :// toolslib.net/downloads/finish/1/" had triggered that pop-up, (as well as all the other one's it randomly choose).

[vhelp]

success.

it appears to be gone. i had 17 infections. after downloading and running "adwcleaner_6.030.exe" (link in post # 9), when you get to the part where you have to [clean] and select it, you will be alerted that any and all apps will be closed. I had a lot of things open plus some screen shots, oh boy. i lost those. anyway. after it cleans, it will reboot. let it reboot, it has to make sure that it rids this annoyance once and for all. And sure enough, it did. my dead give away was whenever i launch internet explorer (IE) a different menu pops up. its a fake. yes, i use chrome full time but i like to switch to IE for quick a browse while chrome is running. anyway. LSS, in IE, I got my old tab menu back. no sign of anything so far. keep you fingers and eyes crossed. well, ok. not your eyes. or else

oh, and thanks to JVR for the website. I knew I had been there once before (from a recommendation here, back in sept/2015, i ran these same steps, well, only step 1, it was all that was needed--i remember that--so just so you know, i did not run the rest of the steps)

note, this shows your username, so bare that in mind. i use "dell" as mine, because its short and easy to type and remember.

# AdwCleaner v6.030 - Logfile created 19/11/2016 at 22:33:41
# Updated on 19/10/2016 by Malwarebytes
# Database : 2016-11-19.2 [Server]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : dell - DELLPC
# Running from : C:\Users\dell\Downloads\adwcleaner_6.030.exe
# Mode: Clean
# Support : hxxps://www.malwarebytes.com/support



***** [ Services ] *****



***** [ Folders ] *****

[-] Folder deleted: C:\Users\dell\AppData\Roaming\SpringFiles


***** [ Files ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****

[-] Shortcut disinfected: C:\Users\Public\Desktop\Google Chrome.lnk
[-] Shortcut disinfected: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[-] Shortcut disinfected: C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[-] Shortcut disinfected: C:\Users\dell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[-] Shortcut disinfected: C:\Users\dell\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[-] Shortcut disinfected: C:\Users\dell\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[-] Shortcut disinfected: C:\Users\dell\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
[-] Shortcut disinfected: C:\Users\dell\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk


***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKU\S-1-5-21-3918671400-1602108748-3655803097-1001\Software\SrpnFiles
[#] Key deleted on reboot: HKCU\Software\SrpnFiles
[-] Key deleted: HKLM\SOFTWARE\SrpnFiles
[#] Key deleted on reboot: [x64] HKCU\Software\SrpnFiles
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\programask.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.programask.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\programask.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.programask.com


***** [ Web browsers ] *****



*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [1578 Bytes] - [20/09/2015 12:40:58]
C:\AdwCleaner\AdwCleaner[C2].txt - [2531 Bytes] - [19/11/2016 22:33:41]
C:\AdwCleaner\AdwCleaner[S1].txt - [1442 Bytes] - [20/09/2015 12:38:58]
C:\AdwCleaner\AdwCleaner[S2].txt - [3541 Bytes] - [19/11/2016 22:29:19]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [2750 Bytes] ##########

[vhelp]

and now to create a new restore point. just in case. you know, dot your eyes and cross your T's...

[usually_quiet]

There are removal guides for the "Search Incognito.com" redirect. https://www.pcrisk.com/removal-guides/9646-searchincognito-com-redirect

[jollyjohn]

http://www.bleepingcomputer.com/virus-removal/remove-windows-has-been-block-tech-support-scam/