Sagipsul Popups, 8 Steps Completed Logs Attached

By daximus
Jan 5, 2009
Topic Status:
Not open for further replies.
  1. Thank you for the help in advance. These popups are driving me crazy.
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Let's clean up some leftovers:
    Please re-open HiJackThis and scan.*Check* the boxes next to all the entries listed below.
    Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis and reboot into Safe Mode:

    Right click on Start> Explore> Windows System32> right click> delete on any of the files below if found:
    I cannot reliably identify this Domain. A search for 'ambusi' brings up this site:
    http://www.wordcraftbook.com/writing_abi.php which then shows this URL within it:
    http://www.ambusi.com/member/branding/2004/03/30/naming

    There appears to be an organization named AmBusi which is the American Business Institute (AMBUSI) and internet site for layers. THAT URL is: http://www.netforlawyers.com/ambusi.htm

    So the way it's set up on your system isn't correct and I need you to verify these entries:
    If AmBusi is your legitimate Domain, the entries are not set up correctly.

    Open IE: Tools> Internet Options> Security tab> Trusted sites> Sites> remove these from the trusted zone:
    Reboot into Normal mode

    Run SDFix:
    SDFix: http://www.tech-101.com/viewtopic.php?f=18&t=38
    Boot into Safe Mode
    Run SDFix
    Update and rescan with Malwarebytes again following SDFix, the do a new scan with HijackThis. Attach all the logs when through.
  3. daximus

    daximus Newcomer, in training Topic Starter

    Wow, thank you very much for taking the time to help me out Bobbye.

    I did everything you suggested and have attached the new logs.

    In regards to Ambusi...it is the former name of the company I work for. The domain is no longer in use, however we still have the domain name. Do I need to make any changes with the ambusi.com entries?

    Thanks Again.

    -Dax
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Then the entries should be removed.

    Did you find and delete any or all of these files?
    I am concerned about the security you're running- all I see are the two Active X files loading for McAfee:
    But there are no McAfee programs entries and no McAfee Services running as there should be if you have the McAfee security installed. Can you fill me in on this please? Were you using this as part of a corporate network? Maybe the defunct Domain. Because it does not appear that you have a fully functioning security program.

    Please re-open HiJackThis and scan.*Check* the boxes next to all the entries listed below.
    Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis and reboot.


    Regarding this entry:
    Update Java:
    What is the status of the original pop-ups. Have we resolved that issue? Are you having any other problems>
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.