Windows 10: Bitsadmin pops up randomly and immediately disappears.

Hi.
Read about Hola.org here:
Adios, Hola! - Why you should immediately uninstall Hola

And here:
Hola Review

Read about Pokki here:
C’mon Lenovo. Superfish hooked, but Pokki Start Menu still roaming free • The Register

Reimage is another problem:
http://answers.microsoft.com/en-us/p...9-c5075a454441

Conduit is considered a browser hijacker.

I think everything ADWCleaner found is good to get rid of. You could create a restore point before "cleaning", but I'm pretty sure you need to get rid of everything it found.

Might want to go ahead and run the ESET Online Scan. It will take quite a while. Be sure to post that log as well. Thanks.

 

ADWCleaner deleted all unwanted files, and it didn't find any other file second time. I run full Kaspersky Total Security and it didn't find any infected data. I also ran ESET Online Scan as you mentioned and it found four infected files after one and a half hours. Unfortunately, then it stopped at 99 percent as the attached image shows then Windows asked me to close the program as did not respond. I run the scan again but the same result at the end, however, I saw that ESET marked CCleaner installation file as an infected file. What can I do now?

 

Okay, good.

That's good to know. Kaspersky would have to be disabled when you run ESET, as they can conflict. Maybe that's why ESET hung?

I'd like to see the log file from ESET please:
The ESET Online Scanner saves a log file after running, which can be examined or sent in to ESET for further analysis. The path to the log file is "C:\Program Files\ESET\EsetOnlineScanner\log.txt" (on 64-bit systems this directory will be "C:\Program Files (x86)\ESET\Esetonlinescanner\log.txt"). You can view this file by navigating to the directory and double-clicking it in Windows Explorer.

Ccleaner would not be flagged unless you downloaded it from someplace else besides Piriform, and so it came with an installer (a PUP).

 

Please follow method #2 here and give me a screenshot of the 4 infected files ESET found:
How do I restore files quarantined by the ESET Online Scanner?ESET Knowledgebase


Do not restore them - just give me the screenshot to evaluate please.

 

I followed your instructions and I disabled Kaspersky before I run ESET. I forgot to mention that there is no ESET folder in neither of the Program Files folder so I can't send you log file....

 

Okay. Are you able to follow method #2 in the link below and give me a screenshot of the 4 infected files ESET found?
How do I restore files quarantined by the ESET Online Scanner?ESET Knowledgebase


Do not restore them - just give me the screenshot to evaluate please. Thanks. (If you had checked the box to delete them, they will not be available.)

 

I'm not able to follow as there is no ESET folder in Program Files.

 

Okay then, we can't identify what ESET found. The box must have been checked to uninstall the program upon closing.

Let's see if you get any more popups in the next few days then.

 

I think we are good to go here - ADWCleaner did it's job, the only non-Windows BITS transfer relates to Geolocaton/Intellectual property rights (not sure which) - probably Google/Chrome tracking your phone.. or Amazon getting over-protective of their products.

 

I downloaded and ran the full version of the ESET Smart Security, and it didn't find any infected data. I was still concerned about the 4 infected files that ESET Online Scan has previously found, and I run the ESET Online Scan in Safe mode. In this mode, the scan was complete and it found these files:


C:\Users\Krisztian\Downloads\ccsetup517 (1).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Krisztian\Downloads\ccsetup517 (2).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Krisztian\Downloads\ccsetup517 (3).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Krisztian\Downloads\ccsetup517.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application


Surprisingly, Ccleaner from Piriform was flagged, and I deleted these files immediately. I still didn't get a pop-up window so I believe my system is fine now.


Thank you for everyone I really appreciate your help and support!

 

That's because there's an option to install Google Toolbar in the installer - no big deal; nothing to worry about.
I think you're good too. Go ahead and mark the thread as solved. If it pops up again, you can "unmark" it, and we'll be back! *Smile

 

Hi - I had this problem on my laptop running win 8.1. Superfly's code to clear the queue followed by adwcleaner clean-up seems to have done the trick!! (I'll report back if the problem persists) Thanks Superfly! Thanks all for the thread - very much appreciated.

 

Heyo, same issue, I'm trying to fix this issue as well. It's a pretty cool coinidence that we're both here commenting at the same time or so. Anyway, if you get it figured out or something could you give me your procedures or something? Only if you had to do something different. But anyway, sorry for disturbing you. I just thought it was silly how closely timed we are to this old thread. *Smile

 

Glad that worked for you and thanks for posting to let us know.

Start at post #13 in this thread, and see if it helps you.

 

Hey guys, I used Superfly's original code (Get-BitsTransfer -AllUsers | select -ExpandProperty FileList | Select -ExpandProperty RemoteName)
which gave me this image

was wondering what this means since i don't know that much about computers