How Do I Remove ATWOLA?

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I will. I have tried CCLEANER to no avail.
JW

On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW

wrote:
I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

I just discovered in a search:

atwola = AOL-Time Warner Online Advertising

So now you know which conglomerate to blame.

*******

In "ordinary" situations, a web site could be coded with
some Javascript (.js) to present some advertisements. If
AOL Times Warner somehow figured into selling those adverts,
then they need to be logged, so someone can be billed,
and someone gets the money. Once the atwola site is
accessed, that atwola server will set a cookie in
your cookies.sqlite or similar file. (Some browsers
use individual files to store cookies, which may make
it easier to find references. You can use tools like
sqlite3.exe to dump databases of such things.)

Now, spyware, browser redirects, browser proxies,
may be used by adware, to "spam" the atwola server and
bump a count for something. It's even possible for a
file to be sitting in a browser cache, and via permissions,
have it such that it cannot be removed by the normal
"cache delete" command in the browser.

And this leads to some confusion in the Google search
results. Any cookie tracking software, might put a
message on the screen that an "atwola cookie was set".
Nobody gives a rats ass about that, except it clogs
the Google search results. Cookie tracking is a privacy
issue, but the setting of cookies doesn't prevent you
from doing stuff (succeeding in setting the atwola
cookie doesn't "ruin your day").

So the question would be, how did that reference to atwola
get into that particular web page ? You're crafting an
email to Gmail, the web page should be relatively free
of third-party references (the Gmail page should be using
https encryption, to protect your mail). Could your ISP
have injected those references into each incoming web page ?
Is it an adware which is doing it ? And so on.

The Google search results don't seem to have a strong
theme on this. But of course, this is normal for the
de-tuned Google search anyway. Today, you might easily
miss a theme, because of the way searches are done. The
search returns mostly garbage. Except those "atwola
removal tools" get through :-(

*******

Adwcleaner and Malwarebytes (both from the same company),
might be an option.

There is JunkWare Removal Tool (JRT) but I don't know
what the status of updates is for such a tool. Whether
the author sweat bullets each and every day, updating it,
or it just handles older stuff. Adwcleaner, I think it was
acquired from the original author and Malwarebytes runs it
now.

You do a "scan" first, and only do a "delete" or "clean",
when you're sure of what you're removing. For example,
on Firefox, the "prefs.js" file sometimes has extra lines
added to it by adware. This tool can remove those.

https://www.bleepingcomputer.com/download/adwcleaner/

On this one, the update date suggests it is actively maintained.
It's just the list of things it removes which bothers me.
Perhaps they never update their advertisement to reflect
what they really remove ?

https://www.bleepingcomputer.com/dow...-removal-tool/

The free version of Malwarebytes removes other kinds of
threats. And in this case, I don't know where this reference
to atwola is coming from. Malwarebytes comes in several
versions:

Free on-demand scanner --- you want this one
Paid read-time AV with trial period.
Paid real-time AV you pay for.

The on-demand scanner doesn't run continuously, and when
you click the button, it checks the system. It has
heuristic checks, checking for "hooks" or the like which
are set by the bad guys. Some of the malwarebytes
scanning looks like a file system scan, but then you'll
see it go silent, and the scan counter keeps increasing,
as if it's scanning RAM.

*******

When this happens:

'https://at.atwola.com" page cannot be found

sometimes it happens if you use an older browser that
doesn't support the latest version of SSL/TLS and the
site happens to have no fallback behavior.

http All browsers should support this
https Encrypted connections, using SSL/TLS.
TLS preferred, SSL on fallback. SSL being crack-able.

https with TLS you don't This is the third level.
have and the web site Use a newer browser only
refuses to use SSL for this site.

While you could put an entry for "atwola.com" in your
HOSTS file, I can't say what the side effects would be
for "ordinary" usage of atwola cookies and tracking.
Some pages will not render the text, unless the
cookie has been set.

The address has both legit and nefarious purposes, in
terms of someone playing click fraud. This one sounds
like a click fraud, where that browser page has somehow
been hijacked into making a request to the site. Whatever
browser you're using, might not be able to handle the
"third level" I made up in the list :-) And that's why
you're seeing a visible side effect you might not have
otherwise noticed.

If this happened on my machine, I doubt I'd ever successfully
track it down. As to how it is getting in. I'm not very
good at this stuff. I have found undeletable files in
my cache folder before (and deleted them :-) ). That
stuff is easy and hardly a worry as it's such an
obvious target.

Good luck,
Paul

On Sun, 08 Oct 2017 11:30:16 -0400, wrote:

On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW

You have to be careful with Malwarebytes auto quarantine. If their
date base has a false positive that kills Windows 10, you will be in
deep ****. I always like to look at results first and then kill the
baddies.


KenW

On Sun, 08 Oct 2017 12:16:34 -0400, Paul wrote:

wrote:
I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want


I just discovered in a search:

atwola = AOL-Time Warner Online Advertising

So now you know which conglomerate to blame.


Also interesting to see that the results of visiting that page differ
when you present a different User Agent string. With some UA's, you get
a 204 No Content, while others just give you a 200 OK. I only tested a
few before getting bored, but what they all had in common was that the
body was essentially empty of any content, so the sole reason for the
site appears to be a means of collecting information from unsuspecting
users, somewhat similar to what web bots or beacons do.

On Sun, 8 Oct 2017 11:48:57 -0400, Wolf K
wrote:

On 2017-10-08 11:30, wrote:
On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW


For future reference: Add two or three other anti-virus/anti-malware
programs to your arsenal. Run a scan with them every couple of weeks or
so. No one program can shield you from all threats.



Yes, good advice. But let me just add that you should *not* run two
anti-virus programs in the background simultaneously.

On Sun, 8 Oct 2017 11:48:57 -0400, Wolf K
wrote:

On 2017-10-08 11:30, wrote:
On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW


For future reference: Add two or three other anti-virus/anti-malware
programs to your arsenal. Run a scan with them every couple of weeks or
so. No one program can shield you from all threats.

Sounds good to me!
JW

On Sun, 08 Oct 2017 12:24:35 -0700, Ken Blake
wrote:

On Sun, 8 Oct 2017 11:48:57 -0400, Wolf K
wrote:

On 2017-10-08 11:30, wrote:
On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW


For future reference: Add two or three other anti-virus/anti-malware
programs to your arsenal. Run a scan with them every couple of weeks or
so. No one program can shield you from all threats.



Yes, good advice. But let me just add that you should *not* run two
anti-virus programs in the background simultaneously.

I'll remember dat 1
JW

On Sun, 08 Oct 2017 11:02:15 -0600, KenW
wrote:

On Sun, 08 Oct 2017 11:30:16 -0400, wrote:

On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW

You have to be careful with Malwarebytes auto quarantine. If their
date base has a false positive that kills Windows 10, you will be in
deep ****. I always like to look at results first and then kill the
baddies.


KenW
Oh boy!
JW

On Sun, 08 Oct 2017 12:16:34 -0400, Paul
wrote:

wrote:
I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

I just discovered in a search:

atwola = AOL-Time Warner Online Advertising

So now you know which conglomerate to blame.

*******

In "ordinary" situations, a web site could be coded with
some Javascript (.js) to present some advertisements. If
AOL Times Warner somehow figured into selling those adverts,
then they need to be logged, so someone can be billed,
and someone gets the money. Once the atwola site is
accessed, that atwola server will set a cookie in
your cookies.sqlite or similar file. (Some browsers
use individual files to store cookies, which may make
it easier to find references. You can use tools like
sqlite3.exe to dump databases of such things.)

Now, spyware, browser redirects, browser proxies,
may be used by adware, to "spam" the atwola server and
bump a count for something. It's even possible for a
file to be sitting in a browser cache, and via permissions,
have it such that it cannot be removed by the normal
"cache delete" command in the browser.

And this leads to some confusion in the Google search
results. Any cookie tracking software, might put a
message on the screen that an "atwola cookie was set".
Nobody gives a rats ass about that, except it clogs
the Google search results. Cookie tracking is a privacy
issue, but the setting of cookies doesn't prevent you
from doing stuff (succeeding in setting the atwola
cookie doesn't "ruin your day").

So the question would be, how did that reference to atwola
get into that particular web page ? You're crafting an
email to Gmail, the web page should be relatively free
of third-party references (the Gmail page should be using
https encryption, to protect your mail). Could your ISP
have injected those references into each incoming web page ?
Is it an adware which is doing it ? And so on.

The Google search results don't seem to have a strong
theme on this. But of course, this is normal for the
de-tuned Google search anyway. Today, you might easily
miss a theme, because of the way searches are done. The
search returns mostly garbage. Except those "atwola
removal tools" get through :-(

*******

Adwcleaner and Malwarebytes (both from the same company),
might be an option.

There is JunkWare Removal Tool (JRT) but I don't know
what the status of updates is for such a tool. Whether
the author sweat bullets each and every day, updating it,
or it just handles older stuff. Adwcleaner, I think it was
acquired from the original author and Malwarebytes runs it
now.

You do a "scan" first, and only do a "delete" or "clean",
when you're sure of what you're removing. For example,
on Firefox, the "prefs.js" file sometimes has extra lines
added to it by adware. This tool can remove those.

https://www.bleepingcomputer.com/download/adwcleaner/

On this one, the update date suggests it is actively maintained.
It's just the list of things it removes which bothers me.
Perhaps they never update their advertisement to reflect
what they really remove ?

https://www.bleepingcomputer.com/dow...-removal-tool/

The free version of Malwarebytes removes other kinds of
threats. And in this case, I don't know where this reference
to atwola is coming from. Malwarebytes comes in several
versions:

Free on-demand scanner --- you want this one
Paid read-time AV with trial period.
Paid real-time AV you pay for.

The on-demand scanner doesn't run continuously, and when
you click the button, it checks the system. It has
heuristic checks, checking for "hooks" or the like which
are set by the bad guys. Some of the malwarebytes
scanning looks like a file system scan, but then you'll
see it go silent, and the scan counter keeps increasing,
as if it's scanning RAM.

*******

When this happens:

'https://at.atwola.com" page cannot be found

sometimes it happens if you use an older browser that
doesn't support the latest version of SSL/TLS and the
site happens to have no fallback behavior.

http All browsers should support this
https Encrypted connections, using SSL/TLS.
TLS preferred, SSL on fallback. SSL being crack-able.

https with TLS you don't This is the third level.
have and the web site Use a newer browser only
refuses to use SSL for this site.

While you could put an entry for "atwola.com" in your
HOSTS file, I can't say what the side effects would be
for "ordinary" usage of atwola cookies and tracking.
Some pages will not render the text, unless the
cookie has been set.

The address has both legit and nefarious purposes, in
terms of someone playing click fraud. This one sounds
like a click fraud, where that browser page has somehow
been hijacked into making a request to the site. Whatever
browser you're using, might not be able to handle the
"third level" I made up in the list :-) And that's why
you're seeing a visible side effect you might not have
otherwise noticed.

If this happened on my machine, I doubt I'd ever successfully
track it down. As to how it is getting in. I'm not very
good at this stuff. I have found undeletable files in
my cache folder before (and deleted them :-) ). That
stuff is easy and hardly a worry as it's such an
obvious target.

Good luck,
Paul
Thanks again Paul.
As Always
JW

On Sun, 08 Oct 2017 16:06:12 -0400, wrote:

On Sun, 8 Oct 2017 11:48:57 -0400, Wolf K
wrote:

On 2017-10-08 11:30, wrote:
On Sun, 08 Oct 2017 07:56:10 -0600, KenW
wrote:

On Sun, 08 Oct 2017 08:57:07 -0400, wrote:

I am getting flagged every time I send a GMAIL email that a
'https://at.atwola.com' page cannot be found.
and
Hmm, we can't reach this page.
Try this
Make sure you’ve got the right web address: https://at.atwola.com
Refresh the page
Search for what you want

Is my only recourse to buy remover software, many of which are offered
when I search 'atwola'?

Help please
JW

There is also a few manual ways. I don't know if Malwarebytes and
Superantispyware will work on it. They both have freeware versions you
could try.


KenW

I just downloaded and tried free Malwarebytes. It quarantied some
3982 'threats'. Upon reboot, ATWOLA so far does not seem to exist. So
let us pray........

Thanks for ur help..

JW


For future reference: Add two or three other anti-virus/anti-malware
programs to your arsenal. Run a scan with them every couple of weeks or
so. No one program can shield you from all threats.

Sounds good to me!
JW

Damn it! Its back this AM. Malwarebytes now finds nothing. The free
version that is.
JW

SNIP



Damn it! Its back this AM. Malwarebytes now finds nothing. The free
version that is.
JW

Try adwcleaner. Also do a web search for malware cleaner will come
up with many free programs that may work. Malwarebytes find 'new'
malware and may not include 'simple' malware which is fairly easy to
remove.


KenW

On Tue, 10 Oct 2017 08:08:15 -0600, KenW
wrote:



SNIP



Damn it! Its back this AM. Malwarebytes now finds nothing. The free
version that is.
JW

Try adwcleaner. Also do a web search for malware cleaner will come
up with many free programs that may work. Malwarebytes find 'new'
malware and may not include 'simple' malware which is fairly easy to
remove.


KenW

You are probably going to an infected site. Watch where you go to.


KenW