Removing SavingsCool Adware Virus

[SteveJames]

I'm following the instructions given to me from TwinHeadedEagle and the post  https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/.  Attached are the two files generated by the FRST software scan.

 

Thanks for your help.  

Addition.txt

FRST.txt

[TwinHeadedEagle]

Why didn't you answer in the original topic?

[SteveJames]

Sorry if I did something wrong, but the instructions that you provided said to post a new topic and gave the link.  See below:   

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.

You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to the disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach logs to your reply if possible. Otherwise you may copy/paste the logs directly if you have to.

• Then post a new topic here.
• After posting your new post, make sure under options, you select Follow this topic button and choose Immediate Email Notification

 

[TwinHeadedEagle]

No problem, we will continue here:

 

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

fixlist.txt

[SteveJames]

Here is the file that the scan produced.  

Fixlog.txt

[TwinHeadedEagle]

How is the situation now?

[SteveJames]

The only way I knew I was infected was that every so often a new browser window would open on my 2nd monitor screen and display an ad for something.  I'll have to wait and see if it happens again and if it does then I'll know the problem isn't fixed. However for now I'll assume it is and will let you know if I found out later it isn't.  

Thanks so much for your help. 

Steve 

[SteveJames]

The Malwarebytes program did another scan this morning and appears to find the same items that it's been finding before.  Also Malwarebytes shows a number of reports of SavingsCool malware being blocked this morning, so clearly the problem isn't solved but perhaps Malwarebytes is helping at some level.   In any case the problem isn't fully solved.  

Malwarebytes Report 3.txt