Infected with something that creates pop-up ads and surveys

[MrCharlie]

Open up Chrome and disable all the extensions.

 

See if the ads go away.

 

If so ad some back until you find the culprit.

 

MrC

[Melinda59]

Spent about 15 minutes on FF with no popups and no double underscores.  So looks like just chrome.  

[MrCharlie]

OK, check post above yours.....MrC

[Melinda59]

    Top Hits Arcade was an extension (with a note about not being downloaded from Google)  Disabled and Removed. 

Have been to several sites and no underscore or pop ups    

[MrCharlie]

and it never showed in the FRST log.

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[Melinda59]

It is odd that it didn't show on the FRST log and odd that the FF extension showed on the scan but not in the browser and I never did find the Advertising Center program that showed on the scan.  Should I be concerned about that?

 

 Results of screen317's Security Check version 0.99.74  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

Microsoft Security Essentials   

 Antivirus up to date!  

`````````Anti-malware/Other Utilities Check:````````` 

 Spybot - Search & Destroy 

 Malwarebytes Anti-Malware version 1.75.0.1300  

 Java 7 Update 40  

 Adobe Flash Player 11.8.800.94  

 Adobe Reader XI  

 Mozilla Firefox 23.0.1 Firefox out of Date!  

 Google Chrome 29.0.1547.76  

 Google Chrome 30.0.1599.69  

````````Process Check: objlist.exe by Laurent````````  

 Microsoft Security Essentials MSMpEng.exe 

 Microsoft Security Essentials msseces.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Spybot Teatimer.exe is disabled! 

 Malwarebytes' Anti-Malware mbamscheduler.exe   

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 

````````````````````End of Log`````````````````````` 

[MrCharlie]

I never did find the Advertising Center program that showed on the scan. Should I be concerned about that?

No, you should be able to remove the entry with CCleaner though.

-----------------------------------------

Looks OK, just check your FF for an update if available:

Mozilla Firefox 23.0.1 Firefox out of Date!

~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

If you used FRST:
Download the fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-----------------------------

Please download OTC to your desktop.
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Melinda59]

I never did find the Advertising Center program that showed on the scan. Should I be concerned about that?

No, you should be able to remove the entry with CCleaner though.

-----------------------------------------

 

Advertising Center program did not show up in CCleaner list.  

 

I will check on Firefox update and take a look at your other suggestions.  With any luck you won't see me again 

 

Thank you so much for all your help.

 

Melinda

[MrCharlie]

OK....Take Care MrC

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.