Unknown infection. False warning window, phantom windows. [Solved]

Ok, still no little windows! My computer seems to be running better, generally. There's still a little lag when I open new tabs in Firefox or scroll through open browser windows. Both could be related to Ghosterly, the Firefox extension I am now using to filter out scripts (I previously used NoScript, but it hasn't been updated to work with the new version of Firefox).

Ok, still no little windows! My computer seems to be running better, generally. There's still a little lag when I open new tabs in Firefox or scroll through open browser windows. Both could be related to Ghosterly, the Firefox extension I am now using to filter out scripts (I previously used NoScript, but it hasn't been updated to work with the new version of Firefox).

 
This sounds good and the security you have on the computer could likely be the culprit here.

DelFix

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• – This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

************************************

Done. Should I also uninstall and EEK?

 

Log:

 

# DelFix v1.010 - Logfile created 03/11/2017 at 09:15:40
# Updated 26/04/2015 by Xplode
# Username : Smash - SIDEKICK
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Activating UAC … OK

~ Removing disinfection tools …

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\Smash\Desktop\FRST-OlderVersion
Deleted : C:\Users\Smash\Desktop\Addition.txt
Deleted : C:\Users\Smash\Desktop\AdwCleaner.exe
Deleted : C:\Users\Smash\Desktop\AdwCleaner[S0].txt
Deleted : C:\Users\Smash\Desktop\adwcleaner_7.0.4.0.exe
Deleted : C:\Users\Smash\Desktop\Fixlog.txt
Deleted : C:\Users\Smash\Desktop\FRST.txt
Deleted : C:\Users\Smash\Desktop\FRST64.exe
Deleted : C:\Users\Smash\Desktop\JRT.exe
Deleted : C:\Users\Smash\Desktop\JRT.txt
Deleted : C:\Users\Smash\Desktop\RogueKiller_portable64.exe

########## - EOF - ##########
 

 

Should I also uninstall and EEK?

 

yes

Done. Are we finished? Should I bounce back over to the Windows forum to finish Phill's work?

Aren't you tired of hanging out over here with me?

lol

 

Yes, we're done here in the malware removal forum.

If you have unfinished work to do with Phill head back over that way.

 

Haha not at all. You've been extremely helpful and easy to work with. Thanks for keeping a sense of humor!

We're glad to help.

Hi Juliet. I have bad news. One of those little fake windows just popped up.

Listen, if it's just a nuisance, I can live with it. What always worried me was the possibility they correspond to some malicious process.

Otherwise, my PC is running fine. Phill helped me to clean up the autoruns and that helped a lot.

Hi Juliet. I have bad news. One of those little fake windows just popped up.
Listen, if it's just a nuisance, I can live with it. What always worried me was the possibility they correspond to some malicious process.
Otherwise, my PC is running fine. Phill helped me to clean up the autoruns and that helped a lot.

Let's try a couple things

for the script running

turn off script debugging and notifications.
a. Open Internet Explorer.

b. Click the Tools button, and then click Internet Options.

c. Click the Advanced tab, select the Disable script debugging (Internet Explorer) and
Disable script debugging (Other) check boxes.

d. Clear the Display a notification about every script error check box, and then click
OK.
https://support.microsoft.com/en-us/help/308260/how-to-troubleshoot-script-errors-in-internet-explorer

*****

I went back over logs and found a script I had created that somehow was omitted.
It appears to be one we had done earlier that was run twice

Since we've deleted Farbar Recovery Scan Tool we will just download it again and run the script.
There shouldn't be one located on your desktop any more….
and, there is no need to have Farbar Recovery Scan Tool run another scan at this time but to just run the script.


[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.

Start Farbar Recovery Scan Tool with Administrator privileges
or Right click on the FRST icon and select Run as administrator

Right click/highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-4071271752-2530744919-2841666311-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.startpage.com/
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 semav6msr64; \??\C:\Windows\system32\drivers\semav6msr64.sys [X]
S3 semav6thermal64ro; \??\C:\Windows\system32\drivers\semav6thermal64ro.sys [X]
Emptytemp:
End::




Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

fake windows pop up again?

I'm afraid so. Two phantom windows popped up when I revived the PC from a "sleep" state and opened Firefox, iTunes, and Outlook. At the same time, in Task Manager, I saw two instances of "update.exe," one of which was hogging the CPU and using about 500,000 MB of RAM. I tried to open file location but it didn't open, then the entry disappeared. I know update.exe is part of VAIO's updating software, but I've never noticed two instances like that before. Not sure if that has anything to do with anything, it's just the one weird thing I noticed.

I've been cautious about using my computer for banking and online payments while we've been working on this. Am I overthinking it?

Wow. This is weird and maybe tenacious? A false Firefox update warning just took over a tab on my browser, where I was viewing a more or less trusted website (a fan-operated sports site I've visited numerous times without a problem), prompting me to download a javascript update to "Firefox 60" from a dropbox URL. I'm attaching the screen capture. Firefox continued to reflex the desired URL, as the image shows. When I hit cancel, then reload, the desired URL came up again.