72 replies to this topic

[kunash]

sadly, yes I am still getting the pop ups.   I will run the fix for the shop saver later this morning

[kunash]

here is the otl log

 

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
c:\program files (x86)\shopsave toolbar folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Simon\Desktop\cmd.bat deleted successfully.
C:\Users\Simon\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYJAVA]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Simon
->Java cache emptied: 860 bytes
 
Total Java Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Simon
->Temp folder emptied: 236096 bytes
->Temporary Internet Files folder emptied: 3059822 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 540 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7580 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 3.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 06232014_083038

Files\Folders moved on Reboot...
C:\Users\Simon\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\DhmkJ2TR0QN[2].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\DhmkJ2TR0QN[3].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\EvPKapBawcLZ3hbihjhqAT8E0i7KZn-EPnyo3HZu7kw[1].woff moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\fastbutton[1].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\HqHm7BVC_nzzTui2lzQTDT8E0i7KZn-EPnyo3HZu7kw[1].woff moved successfully.
File\Folder C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\rs=AItRSTNgkFTGNv6LMThqCTzx60dwtZJn5A[1].js not found!
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\s-BiyweUPV0v-yRb-cjciBsxEYwM7FgeyaSgU71cLG0[1].woff moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UCPEWH3Z\sp1_LTSOMWWV0K5VTuZzvQ[1].woff moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T4MYC7CD\A4RWZsncmJ25G8iqn2EHN_esZW2xOQ-xsNqO47m55DA[1].woff moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T4MYC7CD\xIAtSaglM8LZOYdGmG1JqQ[1].woff moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JRDKL8Q2\index[1].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JRDKL8Q2\postmessageRelay[1].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3WZMZ5KX\like[1].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F46ZT980\reg2[1].htm moved successfully.
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[ken545]

Good morning,

 

I spent the better part of an hour searching for a cure for this virus and it looks like all we have done so far has gotten rid of it, thanks for hanging in there with me.

 

Why dont you run a new scan with FRST and post the log please, then do this

 

You will need the 64 bit version of this program

 

Download and Run SystemLook

 

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

64 Bit Version

 

•  

• Double-click SystemLook.exe to run it.

• Copy the content of the following codebox into the main textfield:

:regfind
mshta.exe

• Click the Look button to start the scan.

• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[kunash]

hi thanks for hanging in there with me also

 

here is the frst log

 

 FRST.txt   63.22KB   176 downloads

[kunash]

systemlook log

 

 SystemLooklog.txt   6.99KB   243 downloads

[ken545]

I am going to post two fixes, lets do the one with FRST first and then a new script with Combofix

 

If you still have a fixlist and CFScript still on your desktop delete them both

 

 

 

Open notepad (Start =>All Programs => Accessories => Notepad).

Please copy the entire contents of the code box below.

(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).

Save it to the same direction as frst.exe (or frst64.exe) as fixlist.txt.

 

Start

HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\...\Run: [SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] => mshta.exe http://gmk.ubosnejs....yJP8FDAh2&log=1

HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\...\Run: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] => mshta.exe http://gmk.ubosnejs....uq9jR1yJP8FDAh2

HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\...\RunOnce: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] - mshta.exe http://gmk.ubosnejs....uq9jR1yJP8FDAh2

Hosts::

End

 

Then open frst.exe (or frst64.exe) and click on Fix, then post the log it produces please

[ken545]

 

Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard,  then paste it into Notepad, make sure there is no space before and above Registry::

 

 

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
"RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\runonce]
"RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
[HKEY_USERS\S-1-5-21-2615214989-2497064625-3642582449-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
[HKEY_USERS\S-1-5-21-2615214989-2497064625-3642582449-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
[HKEY_USERS\S-1-5-21-2615214989-2497064625-3642582449-1000\Software\Microsoft\Windows\CurrentVersion\runonce]
"RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-

 

Save this as CFScript to your desktop.

 

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

 

 

 

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

[kunash]

frst log

 

 Fixlog.txt   1.41KB   195 downloads

 

 

[kunash]

combofix log

 

 

[ken545]

Logs look like they done there job.  Reboot and see if this pest is gone 

[kunash]

combofix log

 

 

Attached Files

•  combofix log.txt   37.5KB   191 downloads

[kunash]

the pop up seems as if it is super glued to my computer.

 

rebooted and still there, sadly

[ken545]

Look for it in these folders and delete it if found

 

Your personal startup folder should be C:\Users\<user name>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

 

The All Users startup folder should be C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

[kunash]

looked in both and nothing there

[ken545]

OK, just hang in and let me get another pair of eyes to look this over