PUP.Bundleinstaller.Somoto [Solved]

Hi guys, This is my first ever forum post on any forum ever so forgive me if I don't get all the rules correct the first time around. I had recently noticed double underlined ads popping up on which ever website i decided to visit. For the first couple of weeks I put up with it and I didn't really think anything of it as I am seldom at my PC. But now it's started to get on my nerves and have decided to do something about it. I didn't believe it was a virus an Microsoft anti-virus hadn't picked anything up, so I was advised to download Malwarebytes and there it was: PUP.Bundleinstaller.Somoto I've never had to rid a virus before so any help I can get would be great as all the posts I have read on other forums look like they are going to help… then don't really :-( Here is the Malware log: Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.05.07 Windows 7 Service Pack 1 x64 NTFS [administrator] 10/12/2012 18:19:52 mbam-log-2012-12-10 (18-46-31).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 226800 Time elapsed: 1 minute(s), 55 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\Leon\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) -> No action taken. (end) Thanks for reading and I look forward to any responses I get. Leon

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.
  
• If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Right-click and Run as Administrator dds to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
• Click the Scan button to start scan.
• If you are asked to update the Avast Virus database please allow it to do so.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

Still need help?

Hi Jeffce, Yes, still need help. As I say, not at my computer much as am away from home alot. Give me 2 minutes and I'll read the first post and crack on with the Tasks. Cheers B

Here we go Jeff, 1st part anyway. ASW still downloading I hope this is all you need. Really appreciate the help.

And the asw. Cheers

Download Combofix from the link below, and save it to your desktop.
Link

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.

———-

Still need help?

Thanks Jeff, As soon as I am at my home PC (Tues) I will carry out the request. Regards, Leon

Ok sounds good. Thanks for letting me know.

Hi Jeff, As requsted, here's the ComboFix report. Seems to have deleted some bits and bobs Many thanks

While I am looking this over, I notice that you have ComboFix running from your Downloads folder…Please move it to your Desktop.

I will return with my next set of instructions as quickly as I can.

Sorry Jeff, I can run it again from the Desktop if you prefer? Cheers

Sorry Jeff,

I can run it again from the Desktop if you prefer?

No no…thats not a problem.

How is your system running?

The system is running fine… pretty much the same speed as before, but I'm still getting the popup ads

See attached. This i-phone add pops up on as i hover over the word log and also if you look underneath it also happens if i hover over the word Modules

Thanks.