Japanese pop-up ads when pc is started and keep appearing [Solved]

Hi,

I believe my pc is infested with virus.  A Japanese pop-up ads always appear when I boot by PC.  Keep appearing even though I end the process in task managed. I appreciate if someone can help me, please?  Thank you.

Below are the log file.

Hello eric1932, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.  
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• Ensure you are following this topic. Click [external image: etYzdbu.png] at the top of the page. 
   

======================================================
 
STEP 1
[external image: 6JO0hXH.png] Revo Uninstaller

• Please download and install Revo Uninstaller Free.
• Double-click Revo Uninstaller to run the programme. 
• From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.
  • PopularScreensavers Internet Explorer Toolbar
  • SpyHunter
• ​Double-click the programme. 
• When prompted if you want to uninstall click Yes.
• Ensure the Moderate option is selected and click Next.
• The programme uninstaller will run. If prompted again click Yes.
• Work your way through the uninstaller, ensuring you read each page thoroughly.
• Note: Ensure you decline offers of additional software if applicable. 
• Once the built-in uninstaller is finished click Next.
• Once the programme has searched for leftovers click Next.
• Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
• When prompted click Yes, followed by Next.
• Click Select all, followed by Delete.
• When prompted click Yes, followed by Next.
• Once done click Finish.
   

STEP 2
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  (COMPANYVERS_NAME) C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibarsvc.exe
  C:\Program Files (x86)\PopularScreensavers_7i
  ( ) C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\AppIntegrator64.exe
  (VER_COMPANY_NAME) C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibrmon.exe
  (VER_COMPANY_NAME) C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibrmon64.exe
  HKLM\…\Run: [PopularScreensavers Home Page Guard 64 bit] => C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\AppIntegrator64.exe [485960 2014-06-30] ( )
  HKLM\…\Run: [] => [X]
  HKLM-x32\…\Run: [FAStartup] => [X]
  HKLM-x32\…\Run: [PopularScreensavers EPM Support] => C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7imedint.exe [12872 2014-06-30] (Mindspark Interactive Network, Inc.)
  HKLM-x32\…\Run: [PopularScreensavers Search Scope Monitor] => C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7iSrchMn.exe [55368 2014-06-30] (Mindspark)
  HKLM-x32\…\Run: [PopularScreensavers_7i Browser Plugin Loader] => C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibrmon.exe [61512 2014-06-30] (VER_COMPANY_NAME)
  HKLM-x32\…\Run: [PopularScreensavers_7i Browser Plugin Loader 64] => C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibrmon64.exe [71752 2014-06-30] (VER_COMPANY_NAME)
  HKU\S-1-5-21-331950763-2705558308-3931168685-1000\…\Run: [SystemBootinXhlf8emaM10tSLTxkhF5PlINz94QLS] => mshta.exe http://fvl.xozihhay….lINz94QLS&log=1
  HKU\S-1-5-21-331950763-2705558308-3931168685-1000\…\Run: [RegWriteinXhlf8emaM10tSLTxkhF5PlINz94QLS] => mshta.exe http://fvl.xozihhay….xkhF5PlINz94QLS
  HKU\S-1-5-21-331950763-2705558308-3931168685-1000\…\RunOnce: [RegWriteinXhlf8emaM10tSLTxkhF5PlINz94QLS] => mshta.exe http://fvl.xozihhay….xkhF5PlINz94QLS
  URLSearchHook: HKU\S-1-5-21-331950763-2705558308-3931168685-1000 - (No Name) - {0953a3a2-9223-4990-a1c9-efb4d4686ef2} - C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7iSrcAs.dll (Mindspark)
  SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  BHO-x32: Toolbar BHO -> {0709f2cc-d1e6-4b43-9efc-1c0701cb173d} -> C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibar.dll (Mindspark)
  BHO-x32: Search Assistant BHO -> {3a6625a2-591b-4e83-ac3f-8c25eea30ac0} -> C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7iSrcAs.dll (Mindspark)
  Toolbar: HKLM-x32 - PopularScreensavers - {f339a07f-9578-412d-85e0-b8a80277151a} - C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibar.dll (Mindspark)
  FF Plugin-x32: @popularscreensavers.com/Plugin -> C:\Program Files (x86)\PopularScreensavers\NPp5Stub.dll (popularscreensavers.com)
  C:\Program Files (x86)\PopularScreensavers
  FF Plugin-x32: @PopularScreensavers_7i.com/Plugin -> C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\NP7iStub.dll (Mindspark)
  CHR HomePage: Default -> hxxp://sg.yahoo.com/
  R2 PopularScreensavers_7iService; C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibarsvc.exe [88648 2014-06-30] (COMPANYVERS_NAME)
  S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
  U3 aswMBR; \??\C:\Users\Hpc\AppData\Local\Temp\aswMBR.sys [X]
  U3 aswVmm; \??\C:\Users\Hpc\AppData\Local\Temp\aswVmm.sys [X]
  2014-11-24 01:13 - 2014-11-26 23:56 - 00003642 _____ () C:\Windows\System32\Tasks\RegWrite
  C:\Users\Hpc\AppData\Local\Temp\efabe345-63d7-41d2-a9f5-a27f71299ed1.exe
  C:\Users\Hpc\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
  C:\Users\Hpc\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
  C:\Users\Hpc\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
  C:\Users\Hpc\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
  C:\Users\Hpc\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe
  C:\Users\Hpc\AppData\Local\Temp\qedildir.dll
  C:\Users\Hpc\AppData\Local\Temp\SearchWithGoogleUpdate.exe
  C:\Users\Hpc\AppData\Local\Temp\SHSetup.exe
  C:\Users\Hpc\Downloads\yet_another_cleaner_mar.exe
  C:\Users\Hpc\Downloads\FlvPlayerSetup.exe
  CustomCLSID: HKU\S-1-5-21-331950763-2705558308-3931168685-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Hpc\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
  CustomCLSID: HKU\S-1-5-21-331950763-2705558308-3931168685-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Hpc\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
  CustomCLSID: HKU\S-1-5-21-331950763-2705558308-3931168685-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Hpc\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
  CustomCLSID: HKU\S-1-5-21-331950763-2705558308-3931168685-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Hpc\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
  Task: {1B2CA8AC-B12A-4D3A-9991-25F91AA469D5} - System32\Tasks\SystemBoot => mshta.exe http://fvl.xozihhay….xkhF5PlINz94QLS
  Task: {D4E0AD20-74B3-4C5D-994D-ED8E0609CC7F} - System32\Tasks\RegWrite => mshta.exe http://fvl.xozihhay….xkhF5PlINz94QLS
  reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RegWriteinXhlf8emaM10tSLTxkhF5PlINz94QLS" /f
  reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SystemBootinXhlf8emaM10tSLTxkhF5PlINz94QLS" /f
  CMD: ipconfig /flushdns
  CMD: netsh winsock reset all
  CMD: netsh int ipv4 reset
  CMD: netsh int ipv6 reset
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 3
[external image: BY4dvz9.png] AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

– File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 
 
STEP 4
[external image: E3feWj5.png] Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files before running JRT.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.

 
======================================================
 
STEP 5
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Did the programmes uninstall OK?
• Fixlog.txt
• AdwCleaner[S0].txt
• JRT.txt

Hi Adam,

Thank you very much for your help.  I think the pop-up is gone now.

Below are the observations:

1.  I managed to uninstall "Popular screensavers."  But for SpyHunter, somehow I could not see it in Revo Uninstaller (even though i click on details).  In the eagerness to uninstal, I used the Windows to uninstall.

2.  The Fixlog file.

Hi Adam,

Attached are the log file.

1.  Adwcleaner