How to remove JW Player (and lax1) AD viruses

Question

How to remove JW Player (and lax1) AD viruses

Anonymous

I don't do questionable searches on this computer, so I have no idea where these AD viruses came from.

A couple of weeks ago, some lax1 AD virus asked me for my Geo Location, which I denied -- and it seemed to go away (acted the same as the JW Player virus described below).

But this week, something called JW Player is plaguing my IE 11.0 browser - randomly, spontaneously running short advertisements that are annoying beyond belief. They run for awhile, then they seem to go away, but then they come back. Sometimes they seem to be associated with me opening a new tab in the browser.

There is a lot of information about these viruses on the Internet -- and all of the information points to programs in the Programs and Features list and mainly to an illegal add-on in my IE browser. Yet none of the names exist in my browser add-on list, or anything close to them (only have Bing in my search list).

I can't find PW Player or lax1 anyplace in my system EXCEPT I found both names (i.e. "url1 REG_SZ http://www.jwplayer.com/" and "url2 REG_SZ http://lax1.id/") in the SearchScopes entry in my Registry (HKEY_CURRENT_USER/software/Microsoft/internet explorer/SearchScopes) and in . . . TYPED URLS/url1.... & url2..... Also the lax1.ib.adnxs.com was found in Geolocation and .../Low Registry/DOMStorage/lax1.ib.adnxs.com. (I think these locations are pretty much accurate -- I can get accurate information if it makes a difference).

I have run the Microsoft Safety Scanner and I have run Malewarebytes a couple of times -- nothing seems to affect these guys -- they are still there and the JW Player is very active (did a Properties on one of the short Ads to get the JW Player name).

Some of the other internet advice is to run SpyHunter -- some say it is free, others say it will find them free, but charge you to get rid of them.

Anyone have experience with these things. Haven't done a Reset on my browser yet, but I was wondering if I can just delete the entries containing JW Player and lax1 from my Registry. Of course, I get squeamish when messing around in the Registry. Would prefer they must be removed with some AD virus tool, but don't know which ones are safe to run (and of course, I don't want to pay) -- and want to be able to handle this myself until I figure out where I am picking them up from.

So can someone help me out with ridding my machine of these annoying random spontaneous ADs. Thanks ron in round rock

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

2 additional answers

Answer 1

You need more than MBAM. Remove Adware & PUPs with these tools. Check for updates first and then scan with each one at a time until your machine is clean.

AdwCleaner (Free)
http://www.bleepingcomputer.com/download/adwcleaner/

Malwarebytes (Get the free version)
https://www.malwarebytes.org/free/

When offered, uncheck: Enable free trial of Malwarebytes Anti-Malware Premium.

Junkware Removal Tool (Free)
http://www.bleepingcomputer.com/download/junkware-removal-tool/

HitmanPro (30 day free trial)
http://www.surfright.nl/en/hitmanpro

If necessary, reset your browsers. For IE:
http://windows.microsoft.com/en-us/windows7/reset-internet-explorer-settings

Some reading:

About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs)
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/?p=3187642

Answer 2

I too have the same problem and have no idea how this has happened and this is the third time dealing with malware and trying locate and remove. So really I don't know it this is some kind of Super Rootkit that is on my computer and makes me think I've cleared my computer of it by inviting friends to distract me of it's presence. Or am I really that dumb and don't realize that a certain action I'm doing lets them back on. Either way I've ran multiple scans especially the ones on this page. Hitman Pro found tracking cookies in Firefox (only had it for 1 day), adnxs com, doubleclick net, imrworldwide com, krxd net, rlcdn com, scorecardresearch com, vizu com, w55c net, and nym1.ib.adnxs com. Super Anti-Spyware found 388 tracking cookies (too many to name) in my games & music apps in appdata. I don't know if there are anymore, but I thought I put my two cents in and say Hitman Pro and Super Anti-Spyware the other 3 listed didn't work for me. Plus thank you for the link Bruce on toolbars and add-ons. Thx

Answer 3

Floretta-

Mine have gone away, but I never did anything that I know of -- actually, I really don't remember why or how -- EXCEPT I did disable the Flash add-on in my IE 11.0. Actually it is enabled for certain sites, a feature in IE 11.0, but don't know if that option is available in all the other browsers. Sorry I can't remember, but I think disabling the Flash add-on did it (it may have been one of those Flash viruses everybody is complaining about).

Disabling Flash did not cause me any problems, except I have a "pretty much constant" warning at the bottom of each screen saying that Flash wants to run -- and I can allow it to run on this one site. But there have been very few sites where I have allowed it to run -- and I don't miss those little Flash advertisements.

I was disappointed that I did not get any help in getting rid of the JW player virus. There surely must be a cure for that guy. I don't run all of those virus checkers that Bruce suggested. They/Some might be OK, but, in general, I don't trust them -- because in the past, they have just been a source for more viruses.

Anyway, I wish I could be of more help. IF you do find a solution, please post it back here -- because I think the darn thing is still lurking somewhere in my registry. ron in round rock

Share via

How to remove JW Player (and lax1) AD viruses

2 additional answers