I keep getting this sagipsul pop up

[madaccord]

I've tried ad-aware, anti spy, and have no idea what to do.
this is my last resort before I will reformat the whole computer

 

[gillianbrown]

Your system is badly infected.

If you use your system for online banking/credit card use etc, you should immediately disconnect from the net and reformat your system. Then, contact you bank etc and tell them your system has been compromised.

If you only use your system for gaming/music etc, then cleaning may be a better option.

If you wish to clean your system, please do the following.

Go HERE, follow the instructions and post the log files once done.

.

 

[madaccord]

This is my malwarebytes log

 

[gillianbrown]

Ok, please follow the rest of the instructions and post the other log files.

 

[madaccord]

here is the superantispyware the hijackthis is coming soon

 

[madaccord]

here is the latest hijackthis log

 

[madaccord]

thanks in advance alot

 

[gillianbrown]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKUS\S-1-5-19\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'NETWORK SERVICE')

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)

O15 - Trusted Zone: *.simnetenterprise.com (HKLM)

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Burger Island\Images\armhelper.ocx

O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll

O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)

O20 - AppInit_DLLs: nmdncw.dll

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\WINDOWS\System32\febobafi.dll
C:\WINDOWS\System32\nmdncw.dll

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log and let us know if you're still having problems.

 

[madaccord]

O4 - HKUS\S-1-5-19\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'NETWORK SERVICE')
C:\WINDOWS\System32\febobafi.dll
C:\WINDOWS\System32\nmdncw.dll


i could not find these files anywhere

 

[madaccord]

nvm in the scan i got the 04-hkus and fixed them

 

[gillianbrown]

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

viewpoint

Close control panel.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

Viewpoint Manager Service

Close the services window.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKUS\S-1-5-19\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'NETWORK SERVICE')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\RICKY\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\RICKY\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).


C:\Program Files\Viewpoint<Delete the entire folder.

Reboot your system and post a fresh HJT log.

 

[madaccord]

hopefully this is everything gone,
thanks alot so far

 

[gillianbrown]

Your log is clean.

Please download OTMoveIt by OldTimer OTMoveIt.exe, unzip it and place it on your desktop.

1. Double click OTMoveIt.exe to launch it.
2. Click on the CleanUp! button.
3. OTMoveIt will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. You will be prompted to allow the clean up procedure, click Yes
5. When finished exit out of OTMoveIt

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.