Page popup, redirecting and while surfing steady ad popups. [Solved]

Please try running SecurityCheck in safe mode.

Can you also run Farbar Recovery Scan Tool, (FRST), again and send a new log.

Satchfan

Uninstall programs

Uninstall these programs if present:

quickpick
Popcorn Time

• click Start, Control Panel, Programs and Features
• click on quickpick and then on Uninstall. Repeat this for Popcorn Time.

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

================================================

Open notepad. Please copy the contents of the code box below.

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
URLSearchHook: HKU\S-1-5-21-177457807-164583720-2097069978-1000 - (No Name) - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - No File
Toolbar: HKU\S-1-5-21-177457807-164583720-2097069978-1000 -> No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
CHR HomePage: Default -> hxxp://search.babylon.com/?affID=110790&tt=3612_8&babsrc=HP_ss&mntrId=48272ab200000000000078e400499c70
S2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [179200 2014-10-09] (Company) [File not signed]
S2 fa6789c5; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\VideoCnv\Zet.dll",serv
2014-11-01 18:37 - 2014-11-10 21:38 - 00000000 ____D () C:\ProgramData\quickpick
2014-11-01 18:37 - 2014-11-01 18:37 - 00000000 ____D () C:\ProgramData\takegif
2014-11-01 18:37 - 2014-11-01 18:37 - 00000000 ____D () C:\ProgramData\e4eef711879cbdc
2014-10-25 01:14 - 2014-10-25 01:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-11-23 19:57 - 2011-12-16 00:54 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-11-22 10:40 - 2014-10-24 13:58 - 00000000 ____D () C:\Users\monroe county\AppData\Local\Avg
C:\Program Files (x86)\Popcorn Time\Updater.exe
c:\Program Files (x86)\VideoCnv\Zet.dll
C:\ProgramData\quickpick
C:\ProgramData\takegif
C:\ProgramData\e4eef711879cbdc
C:\Windows\setuperr.log
C:\Program Files (x86)\AVG
C:\Users\monroe county\AppData\Local\Avg

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

================================================

Let's rule out the fact that malware has affected safe mode.

Download & run SafeBootKeyRepair-CF from here:

It’ll only take a moment for it to finish running and then a log will be produced at C:\SafeBoot_Repair.txt. Please post that in your next reply.

================================================

Reset Chrome’s home page:

Your Chrome home page has been changed and will have to be reset manually, (our tools can’t fix it, which Google knows about and couldn’t care less, which is why I wouldn’t use it on principal).

• open Google Chrome
• click on the Customize icon 🖼Click to load external image (Chrome.gif), at the top right
• click on Settings
• under “On start-up”, check Open a specific page or set of pages and then on Set pages
  search.babylon.com and any other pages that you don’t recognise
• set your start page to the page you want, eg www.google.com.

Once you have typed in the address in the 'Open this page' box, this change is saved. If you close this tab and click on the home icon you should now get your home page.

When all this is complete, please run FRST again and send the new logLogs to include in the next post:

Fixlog.txt
SafeBoot_Repair.txt
New FRST log

Thanks

Satchfan

I don’t know the FRST fix log was saved but it didn’t work so we’ll try another tool.

Run OTL

• download OTL to your desktop.
• double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• click Scan all users.
• under Custom Scan paste this in
  

  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  services.exe
  /md5stop
  %systemroot%\*. /rp /s
  DRIVES
  CREATERESTOREPOINT
  
   

• click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
• when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• you may need two posts to fit them both in.

Logs to include with next post:

OTL.txt
Extras.txt

Thanks

Satchfan

OK, that found some stuff that needs to be removed and then we’ll see what’s left.


Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

• double click on the icon to run it.
• copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Services
  :OTL
  O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O4 - HKU\S-1-5-21-177457807-164583720-2097069978-1000..\Run: [EPSON Stylus Photo RX580 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBPA.EXE /FU "C:\Windows\TEMP\E_S399.tmp" /EF "HKCU" File not found
  [2014/11/01 18:37:17 | 000,000,000 | —D | C] – C:\ProgramData\quickpick
  [2014/11/01 18:37:07 | 000,000,000 | —D | C] – C:\ProgramData\takegif
  [2014/11/01 18:37:03 | 000,000,000 | —D | C] – C:\ProgramData\e4eef711879cbdc
  [2012/01/07 09:44:11 | 000,017,408 | —- | C] () – C:\Users\monroe county\AppData\Local\WebpageIcons.db
  
  :Reg
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
  "EnableFirewall"=dword:00000000
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall"=dword:00000000
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
  "EnableFirewall"=dword:00000000
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
  "{07C2B39A-E125-4A9B-85E8-5099D5130CF8}" =-
  "{3959314A-D232-4B48-B283-07E2C2762357}" =-
  "{3E420474-1815-4152-9151-308E4E234E4B}" =-
  "{514FEB7B-794A-449E-9EBF-077FDC4221D4}" =-
  "{67845F03-755D-477A-A6D8-E25209C21B2C}" =-
  "{6B887924-F58F-4A70-BB2A-299576D90561}" =-
  "{6D4E497A-F524-46A9-A98D-EBD1E2E1D7B6}" =-
  "{6E615FDE-E65A-47EA-8425-ABFA3FA7A925}" =-
  "{79007E73-F3AE-44BD-8062-AA0E8CE46384}" =-
  "{7C281E18-0097-48F1-871B-AD9CCBFCC140}" =-
  "{CA73A384-9D79-46F6-9FAE-4835B7A36AF7}" =-
  "{D36C3E5F-85DB-4D87-8392-7B24D5CCB087}" =-
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• click the Run Fix button at the top
• let the program run unhindered, reboot when it is done
• post a new OTL log
• please post the OTL fix log.

===================================================

Please download SystemLook from one of the links below and save it to your Desktop.

SystemLook (32-bit)
SystemLook (64-bit)

• double-click SystemLook.exe to run it.
• copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:
  
  

  :filefind
  *Popcorn Time*
  *VideoCnv*
  *quickpick*
  *e4eef711879cbdc*
  *Conduit*
  
  :folderfind
  *Popcorn Time*
  *VideoCnv*
  *quickpick*
  *e4eef711879cbdc*
  *Conduit*
  
  :Regfind
  Popcorn Time
  VideoCnv
  quickpick
  e4eef711879cbdc
  Conduit
  
  ::safeboot
  

• click the Look button to start the scan
• when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Logs to include in the next post:

OTL fix log
SystemLook.txt

Satchfan

 

Run Tweaking.com Registry Backup

We are going to make some changes to the registry which can create unforeseen problems so you need to back it up first.

• download the tool found here
   to your Desktop so it is easy to find
• double click on the file you just downloaded to install it to your system
• once the tool is installed, double-click on the Tweaking.com Registry Backup icon
  *Note:* The tool should automatically open to the Backup Registry tab.
• press Backup Now
• when the back up is complete, the tool will tell you that “Successful */* Files Backed Up”
• you have now successfully backed up your Registry.

Next

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

• double click on the icon to run it.
• copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Reg
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\4e9082b_0]
  @=""
  [-HKEY_CURRENT_USER\Software\Popcorn Time]
  [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
  "C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe"=-
  [-HKEY_USERS\S-1-5-21-177457807-164583720-2097069978-1000\Software\Popcorn Time]
  [HKEY_USERS\S-1-5-21-177457807-164583720-2097069978-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
  "C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe"=-
  [HKEY_USERS\S-1-5-21-177457807-164583720-2097069978-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
  "C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe"=-
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{12A61307-94CD-4F8E-94BC-918E511FAA81}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_fa6789c5]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{10482B1F-306E-4F4C-9A3A-973C8F62CA0B}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10482B1F-306E-4F4C-9A3A-973C8F62CA0B}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{10482B1F-306E-4F4C-9A3A-973C8F62CA0B}]
  
  :Services
  fa6789c5
  
  :Files
  C:\Users\monroe county\AppData\Local\VirtualStore\Program Files (x86)\Popcorn Time d
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• click the Run Fix button at the top
• let the program run unhindered, reboot when it is done, please post the OTL fix log and new OTL log.

Logs to include in the next post:

OTL fix log
New OTL log

Satchfan

I will be out of town this upcoming week. Will it be possible to resume this treatment when I return?

Yes. Thanks for letting me know.

Can you tell me when you expect to return and I'll keep the thread open until then

Satchfan