Sagipsul popup! Please help

[jayrat]

Ok so whenever im searching the net or at my desktop i get these stupid pop ups mostly trying to connect to a fake site called sagipsul.com there really annoying and i can see them all open when i press alt+tab but can't close them and even if i did they would just come back. Its my dads comp thats getting this problem and im trying to fix it for him.

Other people have gotten the same problem such as: techspot.com/vb/topic118604.html but that same solution didn't help me because i probably have different files then they do. I've done a virus check with avast and a scan with malwarebytes antimalware and still get the problem.

please help! heres my hijackthis log if anyone can help:
View attachment 40255

 

[rev_olie]

Hi jayrat

Welcome to Techspot!!

Wow is all i can say to you at this moment...half these entries have no information on them what so ever very weird.

Anyhow. You are infected for a start with Spyware Remover and Save.exe

1.
Download Smitfraud

Now DO NOT RUN THIS YET.

Boot into safe mode

#

1. Restart your computer

2. After hearing your computer beep once during start up, but before the Windows icon appears, press F8.

3. Instead of Windows loading as normal, a menu should appear

4. Select the first option, to run Windows in Safe Mode.

5. When you are at the log on prompt, log in as the same user which you had done the previous steps.

# When your computer has started in safe mode and you see the desktop.

# Close all open Windows.

# Now, double-click on the SmitFraudfix icon that should be residing on your desktop.The icon will look like the one below

# When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen.

# You will now see a menu as shown in the image below. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended)

#The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program as shown by the image below.

Once the computer has finished scanning it will reboot. You will be presented with a Notepad screen containing a log of all the files removed from your computer. Save the log and attach it to your next post

NEXT

1) Click on Start, Control Panel, Add/Remove Programs
2) For SaveNow, search for Save!, SaveNow, or WhenUShop entries and click on Change/Remove to remove them
3) Also look for a program called BSplayer and uninstall if there

Next do a search of your PC and delete the following files if there:
save.cch
savecms.exe
saveupdate.exe
search.db
searchupgrader.exe
sync.exe
uninst.exe
whenusave.txt.
save.db
save.exe
save.htm

saveuninst.exe in Program Files\save\

Then delete if there the following files:
Program Files\save

Then run a fresh HJT scan and attach:

Fresh Hijackthis file
Smitrem file

Also report on the finding's in Add/Remove programs

DO NOT use this PC for anything other than the removal of this virus and non internet based use untill the problem is solved