Probably infected, popups and ads I don't want or need. [Solved]

Hello,

I've gotten a strange popup both on my mobile phone and my laptop, saying it's from my ISP and that I have been entered in a contest, blah blah blah, but when I called the ISP they said it wasn't.  However, I am not so sure about that.  But, it seems to have died down to maybe once a week on the mobile and not on the computer.

Yesterday, I had a popup that took up my entire screen on the laptop which is the computer I am having problems with, Acer Windows 7, Home Premium, AMD 64 bit system.

This popup covered the entire screen but had a small graphic in the center stating my computer was being tracked, etc, etc, and to click this big blue button to stop it.   Of course, I know better than to do such a thing.  I took a screen shot of it, which includes the URL that was at the top in the browser in case anyone wants or needs to see that. 

About a week ago, I installed a browser extension that is supposed to help one save money and compare prices when I am shopping online, then let me know if there is the same item, sold for less on another website. The thing seemed to be working fine on Amazon which it advertised it could find cheaper if I was contemplating something on there.  It kept telling me what I was looking at was the best price on Amazon.  

But, this popup for being tracked seems to have started around the time I installed the extension.  I uninstalled it, yesterday, even though I had shut it off because I was getting little popups at the sides of the screen at the bottom, about stuff that was not shopping or comparing prices and then it seemed like everything went nuts on me.  So I deleted the extension, altogether. 

Then I went onto AOL via the web as I don't have the full program installed on this computer, and find I have a huge row of ads going on the right side of the screen which is something I never had before.  After exploring how to shut that off, AOL said I couldn't shut it off, then later gave me a list of all the ads they supposedly allow to be shown so I clicked them all except the 1 AOL ad and told it to block them.  They're not blocked.  It didn't work and I am wondering if this is also related to that extension.

So. I know I need to have this computer gone over to see what I've got going on here and fix it if at all possible.

Thank you very much!

Thank you.  Starting scans now.

I have noticed there are more popups starting plus the computer would not run Windows Update.  I finally shut that off and will not attempt it until the computer is clean and I get the go ahead from you.

As soon as I closed this page, I started getting popups and got two from what looks like my ISP but probably isn't.  I took screen shots, then x'd out the corner so I didn't touch anything in the windows.  I am uploading them as one contains a URL you may want to see. 

after I ran Run Farbar Recovery Scan Tool, I did not tell it to CLEAN OR FIX, whichever button is on the right.  I believe that was what I have been told to do in the past

You had nothing to ‘fix’ or ‘clean’ before I looked at the log.


Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF HKLM-x32\…\Thunderbird\Extensions: [[removed]] - C:\Program Files\McAfee\MSK => not found
CHR StartupUrls: Profile 1 -> "hxxp://search.conduit.com/?ctid=CT3300196&SearchSource=48&CUI=UN38189234359725179&UM=2"
Task: {8B2AF8D4-7B8C-4160-A171-9F3EE3F5127E} - System32\Tasks\{ADCE5B3C-0C4C-4666-8910-97C0DD32899D} => pcalua.exe -a C:\Users\CHRISB~1\AppData\Local\Temp\jre-8u31-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION
AlternateDataStreams: C:\Users\Chris Blaze\AppData\Local\Temporary Internet Files:J5NmI6leURLnKx1viNZ1It7 [1970]
AlternateDataStreams: C:\Users\Chris Blaze\AppData\Local\Temporary Internet Files:ZwKYLSnlJp4kMBhrZgrXP [1982]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
C:\Program Files (x86)\unins000.dat
C:\Program Files (x86)\unins000.exe
C:\Users\Chris Blaze\AppData\Local\ars.cache
C:\Users\Chris Blaze\AppData\Local\census.cache
C:\Users\Chris Blaze\AppData\Local\housecall.guid.cache
C:\Users\Chris Blaze\AppData\Local\resmon.resmoncfg
C:\Users\Chris Blaze\AppData\Local\sponge.last.runtime.cache
C:\ProgramData\ArcadeDeluxe5.log
C:\ProgramData\PS.log
C:\Users\Chris Blaze\AppData\Local\Temp\libeay32.dll
C:\Users\Chris Blaze\AppData\Local\Temp\msvcr120.dll
C:\Users\Chris Blaze\AppData\Local\Temp\sqlite3.dll
C:\Users\CHRISB~1\AppData\Local\Temp\jre-8u31-windows-au.exe
CMD: ipconfig /flushdns
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Download zoek.exe to your Desktop:

Important: Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.
 

• on Windows Vista, 7, 8 and 10, right-click Zoek.exe and select: Run as Administrator
• give it a few seconds to appear
• copy/paste the entire script inside the codebox below into the input field of Zoek:
  

  autoclean;
  emptyalltemp;
  emptyclsid;
  FFdefaults;
  iedefaults;
  chrdefaults;
  

• close any open programs.
• click the Run script button, and wait. It takes a few minutes to run.
• when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\
• if a reboot is needed, the log will be opened after the reboot.

Logs to include with next post:

Fixlog.txt
zoek-results.log

Thanks

Satchfan

OK, sorry.   Confused.  Am I supposed to copy the text of the 1st box into the Farbar tool or only into Notepad? Or both? Or do I drag and drop the Notepad file into the text box?

Sorry for the confusion. 

Am I supposed to copy the text of the 1st box into the Farbar tool or only into Notepad? Or both?

Copy it into Notepad and save it as Fixlist.txt to your desktop. Then open FRST and hit Fix.

Any change?

I just got back online 8 hours after having posting the logs.  I guess that fix reset all the chrome or google settings?  I have to keep manually opening tabs and lining them up the way I need them to be.  When I signed off, they were all lined up except one which I can't find, now. Also all extensions are gone from the browser.  Should I not reinstall Adware Blocker Plus? I had another for a game that no longer exists and I can't get the extension back for that one. 

Otherwise, sol far, the computer is running much, much faster but I am not sure about popups, so far.  I am so used to Ad Blocker taking care of everything, I'm not sure, yet.  Need to be online a bit longer to find out.  Looking pretty good so far! 

Still getting the popups both the large, full page ones and small ones.  Can I reinstall Adbocker-Plus or Adblocker? 

Can I reinstall Adbocker-Plus or Adblocker?

Yes. However, by default, AdBlock Plus allows "unobtrusive" adverts in order to support the websites. Go here to read more.

We’ve flushed the DNS so let’s try to reset the router and then have a look with another tool.

Reset the Router

Let’s try to reset the router to its default configuration.

• this can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labelled "reset" located on the back of the router.
• press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
• if you don’t know the router's default password, you can look it up. here
• you also need to reconfigure any security settings you had in place prior to the reset.
• you may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

Note: After resetting your router, it is important to set a non-default password, and if possible, username, on the router. This will assist in eliminating the possibility of the router being hijacked again.

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/7/8/10, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on ‘Report’ and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.
Please post the contents of the RKreport.txt in your next reply.

OK, the router does not belong to me.  It is my son's and he uses it for XBOX and XBOX 1 plus a few other systems and also his mobile and mine.   I can't go in there and change anything without his approval because he's worked for literally hours with Microsoft to get it set up just so, to access his games and Twitch plus he uploads 100s of youtube videos and also shoots video via Xbox and the mobile as well.  The only thing belonging to me, here, is the computer.  It's not my ISP, either.  That is something paid for by my ex husband for my son.

So, can we go ahead and do the RogueKiller, first, while I figure out and discuss with them about the router?

I did find out, last night after I posted, that Avira and the firewall that comes with it were not turned on.  Strange as they always turn back on when I reboot but didn't last night.  When I turned them back on, I am not getting many types of popups at all.

As far as Adblocker, I do a lot of video recording, myself, which is then uploaded to youtube.  What I am recording are streaming webcams and in the past, my experience with youtube is that it runs a lot of ads over the video as well as some other streaming sites and Adblocker stops that.   I may be forced to use it, despite it's qualities but will not reinstall it right now.

AdBlocker is fine: all I'm saying is that it won't block all ads.

Don't worry about the router but please run RogueKiller.