How do I get rid of small green box with arrow

February 27, 2014 at 23:05:05
Specs: Windows 7
I have contracted something on my computer that makes these small green boxes (with arrow in the top right corner) appear on all my web pages. If my mouse crosses over them a pop up ad appears. If I then hover over it - it says "Click to continue > by PNGcOnvert".
I have tried disabling extensions (PNGcOnvert appears here but won't allow me to disable it) and checked my ad block settings are ticked in Google Chrome and Internet Explorer. Can you please help? I have tried to add a screen capture but it doesn't seem to work.

Thank you

See More: How do I get rid of small green box with arrow

Report •

February 28, 2014 at 00:58:49
You should be able to uninstall it through 'programs and features' in control panel. However having that on your computer usually means you have other junk that needs to be removed. AdwCleaner is recommended. Here's some step-by-step instructions on removing PNGcOnvert and related malware:

message edited by DAVEINCAPS

Report •

February 28, 2014 at 03:31:00
When you are finished the cleanup process, you will see from your logs, you had a lot of stuff installed, that you did not know had been installed.
A lot of programs, now give you the choice to install toolbars & other during the install. Either uncheck these items during install, or use Custom install. No more click, click during an install, you have to read after each click.
I use Softpedia, down the bottom of the page, they make you aware what Ad-supported programs the author of the program has included.
Sample pages
Users are advised to pay attention while installing this ad-supported application:
· Offers to change the homepage for web browsers installed in the system
· Offers to change the default search engine for web browsers installed in the system
· Offers to install StartNow Toolbar that the program does not require to fully function
SS ( screenshots ) of above

Use Unchecky to help prevent these third party installs. Nothing is perfect, the badies are always ahead of the goodies.
How to download from Softpedia
A reliable application that aims to protect your computer against third-party components often offered during software installations.

message edited by Johnw

Report •

March 3, 2014 at 21:29:56
Thanks for the help, I do appreciate it ( I only work Tue, Thu & Fri so sorry for not replying sooner) but it does not seem to relate to me - this is a work computer and I haven't downloaded any new programmes. PNGcOnvert does not show in uninstall programmes - there is nothing showing there at all within the last week. I did receive an email Excel file from my Boss that I was to work on so had to enable it which is where I first saw these green boxes so I assumed that I had contracted some sort of virus, but mostly they appear on my Web Pages. I have run Spybot Search and Destroy and Malawarebytes Anti-Malaware but these found minimal files. I do not generally download new programmes or go on obscure web sites so can only assume I got "it" from this Excel File.
I have nothing much showing that I do not want or know what it is - there is BuzzSearch 21/11/13, IncrediBar 26/7/13, 14/6/13 and Andrea Vacondio PDF Split and Merge Basic 16/04/2013, pdfforge 30/11/12, Ivan Zahariev 12/07/2012 and Philipp Winterberg 6/07/2012. I have only been using the computer since Nov 2013 so these were already on here before this problem started.
I would appreciate any further help

Report •

Related Solutions

March 3, 2014 at 21:40:16
Sorry forgot to mention that the AdwCleaner didn't work - still getting the little green boxes - thanks anyway!!

Report •

March 4, 2014 at 00:29:29
1. Download ZHPDiag from one of these links. Copy & Paste the contents of the log into your next reply.
Screenshots ( SS ) How to install.

(Don't be alarmed if the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message.)

2. Save the file on your Desktop.

3. Double click on ZHPDiag.exe and follow the installation instructions.

(For Vista and Win 7 users, click right to ensure you execute with admin right)

The tool creates two icons ZHPDiag and ZHPFix.

4. Double click on the short cut ZHPDiag on your Destktop.

5. If you need to change the language, click on the little house, (bottom right) and change to English.

6. Click on the "Configure" button.

7. Click on the Magnifying glass "Default diagnosis with legitimate".

8. Click on "Search" and answer yes if a message appears.

Wait for the tool to finished (maybe a long time) A ZHPDiag log will be on the Desktop.

9. Close ZHPDiag.

Report •

March 5, 2014 at 21:07:59
Hi - did as instructed but file is too large to copy and paste even if cut into four - is there a special section that you are interested in?? (File is 273 KB)

Report •

March 6, 2014 at 01:18:10
Best if you upload the file please & give us the link.

I upload to for images & for files ( neither need an account ) Give us the link please.
Free file sharing sites come & go, if & are too busy ( or not working ) here are others to try.
free file upload no account needed

Image Uploader

How to use for files.

message edited by Johnw

Report •

March 6, 2014 at 20:07:30

Report •

March 6, 2014 at 22:41:41
Ok, got it, I shall address the problems I can see on that scan first, probably about a 5 step process.

Run both of these, in this order.

1: Run AdwCleaner again.
How to download from Softpedia
Author's site
Please download AdwCleaner by Xplode onto your Desktop.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Clean.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please Copy & Paste the contents of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

2: Run Junkware Removal Tool
How to download from Softpedia
Download Junkware Removal Tool to your Desktop.
Warning! Once the scan is complete JRT will shut down your browser with NO warning.
Shut down your protection software now to avoid potential conflicts.
Temporarily disable your antivirus and any antispyware real time protection before performing a scan.
Click this link to see a list of security programs that should be disabled and how to disable them.
Run the tool by double-clicking it. If you are using Windows Vista or Windows 7/8, right-click JRT and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Copy and Paste the contents of the JRT.txt log please.

message edited by Johnw

Report •

March 10, 2014 at 23:50:22
Thanks again Johnw - Here they are!

# AdwCleaner v3.021 - Report created 11/03/2014 at 14:27:32
# Updated 10/03/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Administrator - CHRIS-PC
# Running from : C:\Users\Administrator\Downloads\adwcleaner (1).exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
Key Deleted : HKCU\Software\FLEXnet

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518

-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\lzxbs88a.default\prefs.js ]

[ File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\pythzews.default\prefs.js ]

-\\ Google Chrome v32.0.1700.102

[ File : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]


AdwCleaner[R0].txt - [11392 octets] - [04/03/2014 13:34:05]
AdwCleaner[R1].txt - [1665 octets] - [11/03/2014 14:26:31]
AdwCleaner[S0].txt - [11439 octets] - [04/03/2014 13:35:03]
AdwCleaner[S1].txt - [1545 octets] - [11/03/2014 14:27:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1605 octets] ##########

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Professional x64
Ran by Administrator on Tue 11/03/2014 at 14:41:56.54

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

Scan was completed on Tue 11/03/2014 at 14:45:43.15
End of JRT log

Report •

March 11, 2014 at 03:37:00
3: Update & Run Mbam again.
Run Malwarebytes' Anti-Malware ( MBAM ) Free Version. Use Quick scan. Copy and Paste the contents of the log please. Note how to avoid the trial period.
If you can't find the log, do a search for malwarebytes or look in here.
C:\Users\Pete\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs
Replace Pete with the User's name.
Make sure you Uncheck > Enable free trial at the End of the install.
If your MBAM log indicates "No action taken". That's usually a result of NOT clicking the Remove Selected button after the scan.
Quick Scan versus Full Scan

Report •

March 12, 2014 at 19:09:44
Here it is

Malwarebytes Anti-Malware

Database version: v2014.03.12.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Administrator :: CHRIS-PC [administrator]

13/03/2014 9:49:03 AM
mbam-log-2014-03-13 (09-49-03).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 259787
Time elapsed: 5 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Administrator\Local Settings\Temporary Internet Files\Content.IE5\YDEPD7FS\stubinst_pkg_en-ap[1].cab (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.


Report •

March 12, 2014 at 22:28:54
4: Run ZHPDiag again & upload the log please.

Report •

March 13, 2014 at 18:20:44

Report •

March 13, 2014 at 19:10:33
You have 3 entries in the registry to remove, after doing so & rebooting, do you have any issues?

[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] =>PUP.SpecialSavings
[HKLM\Software\Classes\Extensions.CSearchQueries] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Classes\Extensions.CSearchQueries] =>Adware.Bandoo

Learn How to Use the Windows Registry Editor (Regedit) in One Easy Lesson

Report •

March 18, 2014 at 00:53:40
I found the first one, (the 21111... etc) removed it and still have the same issue. The other two I can't find. I get to ....\Classes with both of them but can't find Extensions.CSearchQueries.

Unfortunately I am off on two weeks leave this afternoon but would still appreciate your help when I return. Thank you for your time.

Report •

March 31, 2014 at 21:55:12
Hi John

I'm back from holidays and would appreciate any other help you may be able to offer.


Report •

April 1, 2014 at 01:24:01
5: Download OTL, save & run from your Desktop.
Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)
1: When the window appears, underneath Output at the top, make sure Standard output is selected.
2: Select Scan all users
3: Change Drivers to All
4: Under the Extra Registry section, check Use SafeList
5: In the lower right corner, checkmark "LOP Check" and checkmark "Purity Check".
6: Click Run Scan and let the program run uninterrupted.
Screenshots ( SS ) of 1 - 6
When the scan is complete, two text files will be created on your Desktop
OTL.Txt <- this one will be opened
Extras.txt <- this one will be minimized

Upload the logs please Dee.

Report •

April 3, 2014 at 01:26:15
Hi John

So sorry to take up all your time but I have accidentally stumbled on a "cure" that I did not even consider. This problem only occurs in Google Chrome and I only realised this when I was directed to Internet Explorer by another programme.

I have now uninstalled Chrome and use Firefox instead and I no longer have an issue.

Thanks again for all your time, I really do appreciate it.


Report •

April 3, 2014 at 01:35:10
Good news Dee, thanks for the info.

Report •

Ask Question