PC Anti-spyware Popup - Need help.

[smorgan21]

I accidentally posted in someone else's thread and am reposting here. I apologize for not realizing I was in "Moderate's" Thread.

I ran combofix and have attached that log.
I ran Hijack This and have attached that log.

Any help you can provide will be greatly appreciated.

 

[Blind Dragon]

Malwarebytes' Anti-Malware

• Please download Malwarebytes' Anti-Malware to your desktop.
  
• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Your Hijackthis log wasn't attached please attach it in your next reply, scan with Hijackthis after running MBAM

 

[smorgan21]

Here are the logs

Hope this helps you to help me solve the problem. I had to go delete the hijackthis log from the wrong thread before...wouldn't let me upload here until I did that. Thanks again for your assistance.

 

[Blind Dragon]

CFScript

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)

File::
C:\Program Files\PC-Antispyware\PC-Antispyware.exe

Folder::
C:\Program Files\PC-Antispyware
C:\Users\All Users\bslgrdfa
C:\ProgramData\bslgrdfa
C:\Users\All Users\qlrekavw
C:\ProgramData\qlrekavw
C:\Users\All Users\ubghudqx
C:\Users\All Users\amvqadyl
C:\ProgramData\ubghudqx
C:\ProgramData\amvqadyl

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amvqadyl"=-
"2zX7yIZ7Lo"=-
"qlrekavw"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC-Antispyware"=-

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), attach Combofix.txt in your next reply.




Update your Java Runtime Environment

• First try going to Start -> Control Panel -> double click Java
• Select the Update Tab at the top of the Java console
• Click the Check for Updates button at the bottom
• If it finds the newer version (Java 6 Update 5) Follow the on screen instructions
• After it installs the newest version Go back to Control Panel -> Add/remove programs
• Uninstall any older versions of Java

If for some reason you couldn't update through the above instructions.

• Click the following link
  Java Runtime Environment 6 Update 5
• The 4th option down is the one you want (click Download)
• Check the box to agree to terms of service
• Check the box for your operating system and click 'Download selected'at the bottom
• After the install Go to Start-> Control Panel-> add/remove programs (Programs and features), and uninstall any old versions
• Navigate to C:\programfiles\Java -> delete any subfolders except the jre1.6.0_05 folder

Afterwards run another scan with Hijackthis and attach the log along with combofix.txt

 

[smorgan21]

I'm doing exactly as you said to do with combofix but it is not producing a log file for me in the C:/ drive. Please advise.

What I am seeing is a Combofix window with a status bar...once it is completely blue, it goes away, all the desktop icons flash quickly, then a blue command prompt looking window flashes...after that, it stops. Am I doing something wrong or is there another step? Could the version I am using not be a complete download? Just looking for suggestions.

 

[Blind Dragon]

Make absolutely sure it is installed to your desktop not a temp file or anywhere else, if it is go to Start -> Run -> type combofix /u and redownload it through my previous link, this time installing to desktop

Have no other programs running. Your Task Bar should be clear of any program entries including your Browser. (That means this window too)

Disconnect from the Internet.

Disable your Antivirus software. If it has Script Blocking features, please disable these as well.

Try again, if it still doesn't work try renaming Combofix.exe to Combo-fix.exe

 

[smorgan21]

Hey Blind Dragon,

I actually started this thread that you were helping me on...the user bigguy2008 someone sent a post reply to me...unsure of how, why, or what but when I posted my reply to him it was in a different thread. This one is mine and I am certainly aware that there is a huge difference between symptoms and being rid of malware/adware. I am just thankful that so far, so good.

 

[Blind Dragon]

We never finished up obviously. Even after you are clean we need to secure the work you have done.

Please run me a fresh Hijackthis as well as:

Run Kaspersky Online AV Scanner

Order to use it you have to use Internet Explorer.
Go to Kaspersky and click the Accept button at the end of the page.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

• Read the Requirements and limitations before you click Accept.
• Allow the ActiveX download if necessary.
• Once the database has downloaded, click Next.
• Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK.
• Click on "My Computer"
• When the scan has completed, click Save Report As...
• Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
• Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

Attach the report into your next reply