also @ TechSpot: Tech Tip: Turn Off your Display Using a Windows Shortcut and More
Welcome to the TechSpot OpenBoards. Please read the FAQ if you have any questions. Login to participate.

Go Back   TechSpot OpenBoards > Operating Systems & Software > Virus & Malware removal

Sagispul.com pop-up

Closed Thread
Bookmark Thread Tools
  #1  
Old 01-03-2009
Newcomer, in training
 
Member since: Jan 2009, 3 posts
Sagispul.com pop-up

The malware infection on my computer started with fake virus alerts, prompting me to "scan." It would also create short cuts to web pages on my desktop.
I cleaned it up best I could (running mcaffee, physically deleting all files I could find related to this new "virus scanner"). This seemed to stop most of the problems. All that was left was a consistent annoying pop-up to sagispul.com.

I ran the 8-steps, and attached are the logs. So far so good, no pop-ups, and the computer seems to be running smooth. Just wanted to make sure it's gone. Anything more to get rid of?

I appreciate any help that may be provided!
Attached Files
File Type: txt mbam-log-2009-01-02 (06-12-42).txt (6.0 KB, 3 views)
File Type: log SUPERAntiSpyware Scan Log - 01-02-2009 - 07-23-58.log (828 Bytes, 1 views)
File Type: log hijackthis.log (10.6 KB, 3 views)
  #2  
Old 01-03-2009
kimsland's Avatar
TS Special Forces
 
Location: Australia
Member since: Dec 2007, 17,019 posts
Uninstall your McAfee
Then run the removal tool: http://download.mcafee.com/products/...tches/MCPR.exe

Run Startup Control Panel and remove any not required startups: (should be most!) http://www.mlin.net/StartupCPL.shtml

Install Avira

Start up Malwarebytes again; Update it; then run a full scan (remove all found Malwares) There are still more to remove
Actually you'd be best to run it 3 times (trust me, seen this too often )
To remove this ad, sign in. To register for a new account, click here.
  
  #3  
Old 01-03-2009
Newcomer, in training
 
Member since: Jan 2009, 3 posts
is McAfee no good? I take it Avira is a better replacement...
  #4  
Old 01-03-2009
TechSpot Booster
 
Location: Illinois, USA
Member since: Feb 2007, 905 posts
System specs
Kimsland is a straightshooter. McAfee is a well-respected product that is just a bit behind the competition. Periodic scans with MBAB & SAS can give assurances that McAfee is being effective - or not.
Code:
Memory Modules Infected:
C:\WINDOWS\system32\btctwadc.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ssqomkKd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mnnhpy.dll (Trojan.Vundo) -> Delete on reboot.

HJT residue - no computer restart?
O20 - AppInit_DLLs: mnnhpy.dll
MBAB did not handle all that it found until the computer restart.

Rescan with MBAB & SAS (run as pairs) until clean or something that cannot be cleaned.

HJT scan informs what has not been handled (computer restart before HJT scan).
  #5  
Old 01-04-2009
Newcomer, in training
 
Member since: Jan 2009, 3 posts
thanks, really appreciate the help!
just finished running both mbab and sas - they reported the computer is clean, no found malware
  #6  
Old 01-04-2009
TechSpot Booster
 
Location: Illinois, USA
Member since: Feb 2007, 905 posts
System specs
Establish a new clean restore point and Clear your existing System Restore points:
  • New
    • Go to Start > All Programs > Accessories > System Tools > System Restore>
    • Select Create a restore point> OK.
  • Clear Old
    • go to Start > Run > cleanmgr > Select the More options tab >
    • Choose the option to clean up System Restore > OK
      • This will remove all restore points except the new one you just created.
Closed Thread

Tip: Download Advanced SystemCare 3 Freeware - 1 Click A Day to Clean, Repair, Protect & Optimize your PC.

Thread Tools


Similar Topics
Topic Category Replies Last Post
Sagispul Popups Virus & Malware removal 4 01-12-2009 11:19 PM
Help removing sagispul.com Virus & Malware removal 6 01-10-2009 12:35 PM
Sagispul and vundo Virus & Malware removal 5 01-03-2009 10:45 PM
Sagispul and probably other viruses Virus & Malware removal 4 01-03-2009 10:35 PM
Sagispul attack and maybe others Virus & Malware removal 7 01-03-2009 02:07 AM


All times are GMT -4. The time now is 03:35 PM.