Your browser isn't supported
It looks like you're using an old web browser. To get the most out of the site and to ensure guides display correctly, we suggest upgrading your browser now. Download the latest:

Welcome to the MSE Forums

We're home to a fantastic community of MoneySavers but anyone can post. Please exercise caution & report spam, illegal, offensive or libellous posts/messages: click "report" or email forumteam@. Skimlinks & other affiliated links are turned on

Search
  • FIRST POST
    • tony6403
    • By tony6403 10th Feb 18, 1:01 AM
    • 1,214Posts
    • 1,017Thanks
    tony6403
    Adware.Elex.ShrtCln
    • #1
    • 10th Feb 18, 1:01 AM
    Adware.Elex.ShrtCln 10th Feb 18 at 1:01 AM
    I have tried Malwarebytes , Kaspersky , Defender and Avast but cannot get rid of the popups from this irritating infection.
    I have altered Chrome settings to no avail.
    Whatever is causing this seems to disable Windows Defender which indicates that it is "blocked by group policy".
    I can enable Defender with a reg command but it is disabled when I start up.
    I'm baffled.
    Forgotten but not gone.
Page 1
    • esuhl
    • By esuhl 10th Feb 18, 8:05 AM
    • 8,077 Posts
    • 5,841 Thanks
    esuhl
    • #2
    • 10th Feb 18, 8:05 AM
    • #2
    • 10th Feb 18, 8:05 AM
    I'd try adwCleaner (now owned by MalwareBytes), then create a Rescue Disc in Avast and boot from that.
    • DesertWind
    • By DesertWind 10th Feb 18, 8:45 AM
    • 353 Posts
    • 830 Thanks
    DesertWind
    • #3
    • 10th Feb 18, 8:45 AM
    • #3
    • 10th Feb 18, 8:45 AM
    Try Emsisoft Emergency Kit the ultimate free anti-malware and antivirus tool to scan, detect and remove viruses, keyloggers and other malware threats.

    https://www.emsisoft.com/en/software/eek/
    • AndyPix
    • By AndyPix 10th Feb 18, 9:32 PM
    • 3,417 Posts
    • 2,588 Thanks
    AndyPix
    • #4
    • 10th Feb 18, 9:32 PM
    • #4
    • 10th Feb 18, 9:32 PM
    I usually find that ADW cleaner finds bits and bobs that Malwarebytes et al seem to miss.


    It seems to be better at purging reg keys and scheduled tasks that cause reinfection.


    How is the infection presenting ?
    Are you getting popups from the desktop (sys tray area) or only when browsing ?
    Does this affect only chrome ?
    Running with scissors since 1978
    • tony6403
    • By tony6403 10th Feb 18, 11:52 PM
    • 1,214 Posts
    • 1,017 Thanks
    tony6403
    • #5
    • 10th Feb 18, 11:52 PM
    • #5
    • 10th Feb 18, 11:52 PM
    I usually find that ADW cleaner finds bits and bobs that Malwarebytes et al seem to miss.


    It seems to be better at purging reg keys and scheduled tasks that cause reinfection.


    How is the infection presenting ?
    Are you getting popups from the desktop (sys tray area) or only when browsing ?
    Does this affect only chrome ?
    Originally posted by AndyPix
    Thanks , I'll try ADWC .
    Getting mainly CNet ads only on Chrome when browsing.
    Btw Malwarebytes finds it and quarantines but it comes back on restart.
    Forgotten but not gone.
    • tony6403
    • By tony6403 11th Feb 18, 12:07 AM
    • 1,214 Posts
    • 1,017 Thanks
    tony6403
    • #6
    • 11th Feb 18, 12:07 AM
    • #6
    • 11th Feb 18, 12:07 AM
    Try Emsisoft Emergency Kit the ultimate free anti-malware and antivirus tool to scan, detect and remove viruses, keyloggers and other malware threats.

    https://www.emsisoft.com/en/software/eek/
    Originally posted by DesertWind
    Thankyou.
    Just ran that tool and it found and removed malware that has not shown on other scans.
    But didn't get the one I was after !
    Forgotten but not gone.
    • aliEnRIK
    • By aliEnRIK 14th Feb 18, 5:53 AM
    • 17,559 Posts
    • 8,209 Thanks
    aliEnRIK
    • #7
    • 14th Feb 18, 5:53 AM
    • #7
    • 14th Feb 18, 5:53 AM
    There used to be happier times when people would be all over this helping the OP
    • DoaM
    • By DoaM 14th Feb 18, 8:50 AM
    • 4,261 Posts
    • 4,305 Thanks
    DoaM
    • #8
    • 14th Feb 18, 8:50 AM
    • #8
    • 14th Feb 18, 8:50 AM
    There also used to be happier times when MSE didn't PPR people for nonsensical infractions - i.e. nuisance people would report the helpful people and MSE would actually review the report before acting on it.

    Then came the time of fire and forget - if a report was made MSE would just apply an infraction card without even checking if the report wasn't just nuisance-making - so the helpful people ended up getting PPRd, got fed up with it and left.

    That's your answer (IMHO).
    Diary of a madman
    Walk the line again today
    Entries of confusion
    Dear diary, I'm here to stay
    • onomatopoeia99
    • By onomatopoeia99 14th Feb 18, 8:56 AM
    • 4,089 Posts
    • 9,174 Thanks
    onomatopoeia99
    • #9
    • 14th Feb 18, 8:56 AM
    • #9
    • 14th Feb 18, 8:56 AM
    There used to be happier times when people would be all over this helping the OP
    Originally posted by aliEnRIK
    They are all busy changing their passwords.
    INTP, nerd, libertarian and scifi geek.
    Home is where my books are.
    • AndyPix
    • By AndyPix 14th Feb 18, 9:00 AM
    • 3,417 Posts
    • 2,588 Thanks
    AndyPix
    Eh ?


    People have helped - awaiting feedback ..


    Are you going to offer help ?
    Running with scissors since 1978
    • Cornucopia
    • By Cornucopia 14th Feb 18, 9:02 AM
    • 9,950 Posts
    • 9,829 Thanks
    Cornucopia
    There's a well-documented dialog here about removal of this PUP...

    https://forums.malwarebytes.com/topic/214310-adwareelexshrtcln-keeps-returning/?page=3
    I'm a Board Guide on the Phones & TV, Techie Stuff, In My Home,
    The Money Savers Arms and Food Shopping boards. I'm a volunteer to help the boards run smoothly, and I can move and merge threads there. Any views (especially those on the UK TV Licence) are mine and not the official line of moneysavingexpert.com.

    Board guides are not moderators. If you spot an inappropriate or illegal post then please report it to forumteam@moneysavingexpert.com
    • aliEnRIK
    • By aliEnRIK 14th Feb 18, 9:27 AM
    • 17,559 Posts
    • 8,209 Thanks
    aliEnRIK
    They are all busy changing their passwords.
    Originally posted by onomatopoeia99
    That shot over my head?
    • GunJack
    • By GunJack 14th Feb 18, 10:05 AM
    • 10,077 Posts
    • 7,560 Thanks
    GunJack
    That shot over my head?
    Originally posted by aliEnRIK
    RIK, nice to see you again Hope you're well?

    FYI, the forum has been having a couple of hisy-fits about changing your password, twice in 5-6 days....bah!

    ...and DoaM is probably right....a fair few former regulars have been PPR'd for no apparent reason, and have not necessarily returned.....
    ......Gettin' There, Wherever There is......
    • aliEnRIK
    • By aliEnRIK 15th Feb 18, 5:37 AM
    • 17,559 Posts
    • 8,209 Thanks
    aliEnRIK
    RIK, nice to see you again Hope you're well?

    FYI, the forum has been having a couple of hisy-fits about changing your password, twice in 5-6 days....bah!

    ...and DoaM is probably right....a fair few former regulars have been PPR'd for no apparent reason, and have not necessarily returned.....
    Originally posted by GunJack
    Ah. Yeah im good cheers (In fact things are better than they have ever been)
    Hows things your end?
    • GunJack
    • By GunJack 15th Feb 18, 7:53 AM
    • 10,077 Posts
    • 7,560 Thanks
    GunJack
    Ah. Yeah im good cheers (In fact things are better than they have ever been)
    Hows things your end?
    Originally posted by aliEnRIK
    Good to hear matey Still struggling on in the House of 'Jack, but as the signature says......


    ...and back to the problem in-hand...

    To the OP - if you keep getting infected after quarantining stuff in MBAM, run a Windows full disk clean-up, followed by CCleaner (clean and Registry cleaner), then run MBAM, quarantine and then delete the quarantined items, then run ADWCleaner (right-click and Run As Admin). Let it delete all it finds. Let the machine reboot as required through all this...

    Important - don't try and do anything else with the machine whilst doing this sequence of events, just do them directly one after the other. The point is some of these nasties will sit in temp files just waiting to be re-activated, so you get the infect-remove-reinfect cycle happening. Try this and come back and let us know
    ......Gettin' There, Wherever There is......
Welcome to our new Forum!

Our aim is to save you money quickly and easily. We hope you like it!

Forum Team Contact us

Live Stats

297Posts Today

3,574Users online

Martin's Twitter