What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Having Some Weird Pop Ups In The Background For 2 Laptops Can you Help

53 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 4/6/19
Scan Time: 4:48 PM
Log File: d17aea60-5848-11e9-b78e-2cd05a10fb35.json
 
-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.538
Update Package Version: 1.0.10024
License: Trial
 
-System Information-
OS: Windows 10 (Build 17134.648)
CPU: x64
File System: NTFS
User: PEANUT\KengLing
 
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 330304
Threats Detected: 78
Threats Quarantined: 78
Time Elapsed: 14 min, 41 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Detect
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 13
PUP.Optional.uTab, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\BPMMANDCADFLHNNAICLIPADOMFMDBJBP, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\BPMMANDCADFLHNNAICLIPADOMFMDBJBP, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bpmmandcadflhnnaiclipadomfmdbjbp, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\NAHHMPBCKPGDIDFNMFKFGIFLPJIJILCE, Quarantined, [2062], [440037],1.0.10024
PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\NAHHMPBCKPGDIDFNMFKFGIFLPJIJILCE, Quarantined, [2062], [440037],1.0.10024
PUP.Optional.SearchManager, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Quarantined, [2062], [440037],1.0.10024
PUP.Optional.TTab, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\OONBCPDABJCGGCKLOPGBDAGBFNKHBGBE, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\OONBCPDABJCGGCKLOPGBDAGBFNKHBGBE, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\oonbcpdabjcggcklopgbdagbfnkhbgbe, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Quarantined, [2062], [183362],1.0.10024
PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Quarantined, [2062], [183362],1.0.10024
PUP.Optional.SearchManager, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Quarantined, [2062], [183362],1.0.10024
PUP.Optional.WinYahoo.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5760BFA0-07E0-6E20-B660-1EA066E0CD20}, Quarantined, [772], [542290],1.0.10024
 
Registry Value: 4
PUP.Optional.uTab, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|BPMMANDCADFLHNNAICLIPADOMFMDBJBP, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.SearchManager, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|NAHHMPBCKPGDIDFNMFKFGIFLPJIJILCE, Quarantined, [2062], [440037],1.0.10024
PUP.Optional.TTab, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|OONBCPDABJCGGCKLOPGBDAGBFNKHBGBE, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.SearchManager, HKU\S-1-5-21-336608445-27866453-704810108-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Quarantined, [2062], [183362],1.0.10024
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 9
PUP.Optional.WinYahoo.TskLnk, C:\PROGRAMDATA\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}, Quarantined, [772], [484243],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\_metadata, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Extensions\BPMMANDCADFLHNNAICLIPADOMFMDBJBP, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\_metadata, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Extensions\OONBCPDABJCGGCKLOPGBDAGBFNKHBGBE, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\USERS\KENGLING\APPDATA\LOCAL\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}, Quarantined, [772], [542290],1.0.10024
 
File: 52
PUP.Optional.WinYahoo.TskLnk, C:\PROGRAMDATA\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\sifa, Quarantined, [772], [484243],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\ProgramData\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\aowLC, Quarantined, [772], [484243],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\ProgramData\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\hdat1, Quarantined, [772], [484243],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\ProgramData\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\hdat2, Quarantined, [772], [484243],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\ProgramData\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\KBspm, Quarantined, [772], [484243],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\ProgramData\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\nolira, Quarantined, [772], [484243],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\ProgramData\{9A595F3A-101B-D5FC-96DD-4BBE0C9FC070}\soterefe, Quarantined, [772], [484243],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\_metadata\verified_contents.json, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\background.js, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\jquery-3.1.1.min.js, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\manifest.json, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\ntab.html, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\ntab.js, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\search.png, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\searchIcon.png, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\stats.js, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpmmandcadflhnnaiclipadomfmdbjbp\2.3.0_0\style.css, Quarantined, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [2158], [465110],1.0.10024
PUP.Optional.uTab, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [2158], [465110],1.0.10024
PUP.Optional.SearchManager, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [2062], [440037],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\_metadata\verified_contents.json, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\jquery-3.1.1.min.js, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\manifest.json, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\ntab.html, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\ntab.js, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\search.png, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\searchicon.png, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\stats.js, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\Users\KengLing\AppData\Local\Google\Chrome\User Data\Default\Extensions\oonbcpdabjcggcklopgbdagbfnkhbgbe\1.2.0_0\style.css, Quarantined, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [2573], [591237],1.0.10024
PUP.Optional.TTab, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [2573], [591237],1.0.10024
PUP.Optional.SearchManager, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [2062], [183362],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\USERS\KENGLING\APPDATA\LOCAL\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HOWTOREMOVE\HOWTOREMOVE.HTML, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\chromium-min.jpg, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\control panel-min-min.JPG, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\down.png, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\ff menu.JPG, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\ff search engine-min.png, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\hp-min ff.png, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\hp-min ie.png, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\search engine.gif, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\setup pages.gif, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\sp-min.png, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\start-min.jpg, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\HowToRemove\up.png, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\redesalit, Quarantined, [772], [542290],1.0.10024
PUP.Optional.WinYahoo.TskLnk, C:\Users\KengLing\AppData\Local\{8E37B86B-AA9F-D4D3-C707-F13BE36F0DA3}\uninst.exe, Quarantined, [772], [542290],1.0.10024
PUP.Optional.InstallCore, C:\USERS\KENGLING\APPDATA\LOCAL\NUNAGA\FEDUBO.EXE, Quarantined, [427], [574764],1.0.10024
PUP.Optional.SearchManager.BITSRST, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [266], [626729],1.0.10024
PUP.Optional.DriveTheLife, C:\USERS\KENGLING\DESKTOP\DOWNLOADS\DRIVERTALENT_SETUP.EXE, Quarantined, [431], [475783],1.0.10024
PUP.Optional.SearchManager.BITSRST, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [266], [628563],1.0.10024
PUP.Optional.SearchManager.BITSRST, C:\USERS\KENGLING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [266], [626729],1.0.10024
 
Physical Sector: 0
(No malicious items detected)
 
WMI: 0
(No malicious items detected)
 
 
(end)
Post #33

No issues with downloading though.

 

Computer running well now.

Thanks so much for the help rendered.

 

 

My goodness that machine was heavily infected. I'm surprised you could download tools to scan with.

I'm going to go out on a limb here and say it might have started here when this was downloaded. There may have been other adware on the computer at that time but theres no way to know.

kwmusic
https://blog.malwarebytes.com/detections/adware-chinad/

~~~~~~~~~~~~~~~~~~~~
How is the computer now?

Post #34
Let's remove tools and quarantine folders
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Click the Run button.
  • – This will remove the specialized tools we used to disinfect your system.
    Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete    ).
**************

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI