Sagipsul popups

[MichaelCorleone]

I need help removing Sagipsul

Okay I did the 8 steps here are my logs.

Please help me, this is driving me nuts.

Symptoms :

I am using firefox and I am getting pop ups that resize then disapper. I click the alt-tab button and I can see the programs in the back ground, I also get this sagipsul popup everyonce and awhile.

 

[MichaelCorleone]

Any help would be appreciated. Thanks.

 

[kimsland]

Well lets try to get it at least running again
Run the Norton Removal Tool: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

Then re-open HJT, and tick all the following entry boxes, and select fix

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [lawumayizo] Rundll32.exe "C:\WINDOWS\system32\hofalobu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [lawumayizo] Rundll32.exe "C:\WINDOWS\system32\hofalobu.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

Restart
Then update Avira, and run a full scan

 

[MichaelCorleone]

Okay I performed what you told me.

Avria had 3 detections and I deleted them.

What next???

 

[kimsland]

Looks a lot better :grinthumb
A few "file missing" entries in HJT log that can be ticked and fixed (but really no issue)

How's it all running? lots better ?

 

[MichaelCorleone]

It's running a lot better thanks for all your help!!!:grinthumb

I ran malwarebytes again and it came up with a few detections.

Here's the log:

Is there anything I need to do to make sure it's gone/

 

[kimsland]

Well I know it's strange
But you must keep running Malwarebytes (also check for updates each time)
Until it's clean (zero entries found)
That's the truth of the matter

 

[MichaelCorleone]

kimsland,

Thanks for all your help, it is greatly appreciated.

I rescanned using Malwarebytes and SuperAntispyware.

Both times came up clean.

I am going to update both and update Avria then I'll rescan.

Hopefully I got everything.