Random pop-ups appearing then disappearing

[Backwards_Logic]

A few days ago, I mistyped a web address into Firefox and was sent to a website that said my computer was infected with something and I had to do X, Y, and Z to get rid of it.  I instead left the website and did nothing, as both Malware Bytes and Windows Defender came back negative (The website in question is wowsreplays(DOT)com, I meant to go to wowreplays(DOT)com).  Since then, I have had these random pop-ups appear towards the upper-left hand section of my screen, only to disappear the next instant without displaying anything in the pop-up - too quick for me to screencapture.  I have noticed no other symptoms besides this, and the computer is otherwise running fine for the moment.  Attached are the requested logs.  Thank you in advance for any assistance, and I look forward to getting whatever is running in the background of my computer off of my system.

FRST.txt

Addition.txt

[AdvancedSetup]

Hello @Backwards_Logic and

 

Please restart the computer first and then run the following steps and post back the logs when ready.

STEP 01
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 02

 

 

Fix with AdwCleaner

 

Please download AdwCleaner by Xplode and save the file to your Desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now.
• After reboot, logfile will be opened. Copy its content into your next reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

STEP 03
Download Sophos Free Virus Removal Tool and save it to your desktop.
 

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View Log file (bottom left-hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program
• If no threats were found, please confirm that result.

STEP 04
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[Backwards_Logic]

Thanks for your assistance AdvancedSetup!  Here's the results requested:

 

JRT results:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 10 Home x64
Ran by Scott Savarese (Administrator) on Thu 06/01/2017 at  8:38:21.69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

File System: 1

Successfully deleted: C:\Users\Scott Savarese\AppData\Roaming\Mozilla\Firefox\Profiles\4o4e3mtk.default\extensions\trash (Folder)

Deleted the following from C:\Users\Scott Savarese\AppData\Roaming\Mozilla\Firefox\Profiles\4o4e3mtk.default\prefs.js
user_pref(browser.urlbar.suggest.searches, true);

 

Registry: 0

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 06/01/2017 at  8:38:57.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ADWCleaner:

# AdwCleaner v6.047 - Logfile created 01/06/2017 at 08:44:51
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-05-31.2 [Server]
# Operating System : Windows 10 Home  (X64)
# Username : Scott Savarese - DESKTOP-8NLDH3L
# Running from : C:\Users\Scott Savarese\Desktop\AdwCleaner.exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support

 

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Web browsers ] *****

No malicious Firefox based browser items found.
No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [1009 Bytes] - [01/06/2017 08:44:51]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1082 Bytes] ##########

Sophos Virus Removal tool came back clean.

~~~Right after this scan completed, but right before I ran FRST, I got the strange pop-up once again at the expected time (XX:58 of every hour)~~~

See attachments:

FRST.txt

Addition.txt

[AdvancedSetup]

Please see if this may be your issue and let me know.

 

Please see the following post concerning an hourly popup from a Microsoft Office scheduled task. Credit to ArnoldLayne for information about this issue.

OfficeBackgroundTaskHandlerRegistration flashes a window every hour

Quote by Microsoft employee below

Quote

Microsoft’s Gregory Jensen replied: “This issue is fixed starting with build 16.0.8201.2025 which is now available as the latest update for those participating in the Office Insiders Slow program.

“It will be included in a future update for those not participating in Insiders.”

It currently is unclear when exactly the fix will be rolled out for all Office users.

 

 

[Backwards_Logic]

It's very possible.  I do have Office 365 installed, and I am also noticing the same bug on my work computer as well (which has Office installed as well).  Given the problem is fairly widespread, I'm inclined to think this is in fact the problem.  Still, it hasn't hurt to double-check everything.  If you have any other suggestions to try to remove it, I'm all ears.  Otherwise, I suppose I'll wait for a fix from Microsoft and hope the problem ends there.

[AdvancedSetup]

Following one of those articles you can try setting the scheduled task to happen maybe once a week until Microsoft patches it for everyone. Then see if that removes the popup.

I'll be out most of the day tomorrow but will check back with you late tomorrow night if you do reply.

Thanks

 

[Backwards_Logic]

I've set the scheduled task to once per week and for the time being it seems to have fixed it.  I'll keep an eye on it and if it acts up again I will let you know.  Thanks for your help!  Shall I uninstall everything I downloaded to scan my computer?

[Backwards_Logic]

I just wanted to confirm that setting the task to once per week does in fact solve the problem, or at least makes it only appear once per week instead of every hour.  Thanks again for your help.

[AdvancedSetup]

Great, glad that turned out to be the issue. Hopefully Microsoft will soon release a fix to everyone and not just a select few.

You can go ahead and uninstall or delete any files or tools we've used to scan your system.

Take care

 

Edited June 5, 2017 by AdvancedSetup

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!