Update Java Popup in Chrome [Solved]

Hello,

A few months ago I had been infected with a virus after I had been seeing popups for updating Java. I had eventually gotten the problem solved to some extent. It did not happen on any major websites that I was using any more however recently I got the popup again while I was on Imgur. I am yet to experience it on any other site but knowing the infection isn't fully gone makes me worry that it may come back on a site I use often. 

I have scanned with Norton and with Avast! which is what I am now using, as well as with Malwarebytes and still cannot find anything. I have looked through my files and downloads and can't seem to find anything that shouldn't be there. I have also reset my browser and I only use one extension (The Avast! internet security one) and the problem still remains.

Any help would be greatly appreciated. The logs are below,

Jake

aswMBR:

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software

Hello jakeb459, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• Ensure you are following this topic. Click [external image: etYzdbu.png] at the top of the page. 
   

======================================================
 

STEP 1
[external image: BY4dvz9.png] AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

– File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 
 
STEP 2
[external image: E3feWj5.png] Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files before running JRT.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

STEP 3
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 

 
======================================================
 
STEP 4
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• AdwCleaner[S0].txt
• JRT.txt
• FRST.txt
• Addition.txt

Hi Adam, 

Thanks for the response. The logs are below.

Jake

ADWCleaner:

# AdwCleaner v4.103 - Report created 04/12/2014 at 15:43:58

Hi Jake,

Please work your way through the following. 
 
STEP 1
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\Microsoft\Internet Explorer\Main,Search Page = https://uk.search.ya…p={searchTerms}
  HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = https://uk.yahoo.com…t&type=avastbcl
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://uk.yahoo.com…t&type=avastbcl
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://uk.search.ya…p={searchTerms}
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = https://uk.yahoo.com…t&type=avastbcl
  SearchScopes: HKLM-x32 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://uk.search.ya…p={searchTerms}
  SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://uk.search.ya…p={searchTerms}
  SearchScopes: HKU\S-1-5-21-2347362409-3286726880-2833528283-1003 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = 
  BHO: No Name -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} ->  No File
  FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
  C:\Program Files (x86)\Pando Networks
  FF Plugin HKU\S-1-5-21-2347362409-3286726880-2833528283-1003: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
  S3 gdrv; \??\C:\Windows\gdrv.sys [X]
  CMD: ipconfig /flushdns
  CMD: netsh winsock reset all
  CMD: netsh int ipv4 reset
  CMD: netsh int ipv6 reset
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 2
[external image: 6JO0hXH.png] Revo Uninstaller

• Please download and install Revo Uninstaller Free.
• Double-click Revo Uninstaller to run the programme. 
• From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.
  • Java 7 Update 71
• ​Double-click the programme. 
• When prompted if you want to uninstall click Yes.
• Ensure the Moderate option is selected and click Next.
• The programme uninstaller will run. If prompted again click Yes.
• Work your way through the uninstaller, ensuring you read each page thoroughly.
• Note: Ensure you decline offers of additional software if applicable. 
• Once the built-in uninstaller is finished click Next.
• Once the programme has searched for leftovers click Next.
• Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
• When prompted click Yes, followed by Next.
• Click Select all, followed by Delete.
• When prompted click Yes, followed by Next.
• Once done click Finish.
   

STEP 3
[external image: YARWD1t.png] TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to:
  • Loaded Modules
  • Detect TDLFS file system
  • Verify file digital signatures
• Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach (not copy/paste!) the log in your next reply.
   

STEP 4
[external image: mlEX1wH.png] RogueKiller

• Please download RogueKiller (x64) and save the file to your Desktop.
• Close any running programmes.
• Right-Click RogueKiller.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
• A browser window may open. Close the browser window.
• Click [external image: jpgUwzp.png]. Upon completion, click [external image: phPvmc6.png].
• Close the programme. Do not fix anything!
• A log (RKreport.txt) will be open. Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 5
[external image: xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Fixlog.txt
• Did Java uninstall successfully?
• TDSSKiller log (attached!)
• RKreport.txt

Hello Adam,
 
Yes Java was uninstalled  and is no longer on the machine. I occasionally play Minecraft which requires Java, although I can live without it. I was going to move to Java 8 anyway, so losing 7 is fine but is it that much of a risk to have on a PC? If so I won't bother installing it , like I said it's not major. Thank you for the continued help, the logs are below.
 
Fixlog:
 
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-12-2014
Ran by [removed] at 2014-12-04 21:00:02 Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\Microsoft\Internet Explorer\Main,Search Page = https://uk.search.ya…p={searchTerms}
HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = https://uk.yahoo.com…t&type=avastbcl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://uk.yahoo.com…t&type=avastbcl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://uk.search.ya…p={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = https://uk.yahoo.com…t&type=avastbcl
SearchScopes: HKLM-x32 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://uk.search.ya…p={searchTerms}
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://uk.search.ya…p={searchTerms}
SearchScopes: HKU\S-1-5-21-2347362409-3286726880-2833528283-1003 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = 
BHO: No Name -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} ->  No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
C:\Program Files (x86)\Pando Networks
FF Plugin HKU\S-1-5-21-2347362409-3286726880-2833528283-1003: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
end
*****************
 
HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\Microsoft\Internet Explorer\Main\\Search Bar => value deleted successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Bar => value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}" => Key not found.
HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
"HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key not found.
"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.
"C:\Program Files (x86)\Pando Networks" => File/Directory not found.
"HKU\S-1-5-21-2347362409-3286726880-2833528283-1003\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin" => Key deleted successfully.
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.
gdrv => Service deleted successfully.
 
=========  ipconfig /flushdns =========
 
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========= End of CMD: =========
 
 
=========  netsh winsock reset all =========
 
 
Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.
 
 
========= End of CMD: =========
 
 
=========  netsh int ipv4 reset =========
 
Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.
 
 
========= End of CMD: =========
 
 
=========  netsh int ipv6 reset =========
 
Reseting Interface, OK!
Restart the computer to complete this action.
 
 
========= End of CMD: =========
 
EmptyTemp: => Removed 891.4 MB temporary data.
 
 
The system needed a reboot. 
 
==== End of Fixlog ====
 
RK Report:
 

RogueKiller V10.0.8.0 (x64) [Nov 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Jake [Administrator]
Mode : Scan – Date : 12/04/2014  21:22:43
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 4 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 ATA Device +++++
— User —
[MBR] d89298f00c807a4e9dc88f0547f7a624
[BSP] 312803ee747cf8a7728c44ba458ad3dc : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0x0) [VISIBLE] Offset (sectors): 1 | Size: 953869 MB
User = LL1 … OK
User = LL2 … OK
 
+++++ PhysicalDrive1: Multiple Card  Reader USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
 
TDSS Killer:

📎TDSSKiller.3.0.0.41_04.12.2014_21.10.47_log.txt