.tmp popup on every startup

[Seif1993]

That registry backup is extremely old... I really don't want to take that route if there is any other way to tackle this.

[kevinf80]

I agree the reg back up is old, that is the only back up available where your system worked correctly without issue. One other point would be System Restore, are there any restore points available prior to the problem starting.

Do you recall what you were doing just prior to this nuisance poping up...

[Seif1993]

I had an automatic system restore point created a day or two before creating this thread, but I didn't go that route thinking it would be a relatively easy fix. I have a manual one created now which I reverted back to after uninstalling the software with no success of terminating the pop-up. Is there a way to find old system restore files? I cannot find any of the older ones other than the manual one I created. 

[kevinf80]

The first scan with FRST showed the following RP`s, obviously one was created by FRST before the scan complted..

30-11-2018 12:02:39 Windows Update
06-12-2018 04:33:36 Restore Point Created by FRST

Is the one dated 30 - 11 - 2018 priorto the problem ocurring..

https://www.howtogeek.com/howto/windows-vista/using-windows-vista-system-restore/

[kevinf80]

Can you check this file at VirusTotal... C:\Program Files\Haste\Haste Esports Accelerator\WinDivert64.sys

Upload a File to Virustotal Go to http://www.virustotal.com/   Click the Choose file button Navigate to the file C:\Program Files\Haste\Haste Esports Accelerator\WinDivert64.sys Click the Scan it tab If you get a message saying File has already been analyzed: click Reanalyze file now Copy and paste the URL address back here please.

[Seif1993]

https://www.virustotal.com/#/file/8c0743aef7aa497cb1091c9e93e6a2f45e5377434b2bdd5d2a424a53b39ad23d/detection 

 

I had this since before the pop-up occurring. 

[Seif1993]

I had an automatic recovery point configured on Dec 3 or 4 but I cannot find it now. These are the only ones available. 

[Seif1993]

Earlier this morning when I first opened my PC the popup did not appear, it's becoming a trend where If i leave my PC shut off for a long time then power it back on, the pop-up doesn't seem to appear on the first startup but re-appears after restarting, does this tell us anything? 

[kevinf80]

Hiya Seif1993,

Can you disconnect your PC from your router or switch router off if that is easier, now boot up. If the popup does not show, reboot again... any change..?

[Seif1993]

I rebooted twice without internet and it didn't pop up, I rebooted again with internet and it popped up. Atleast now we know it is internet dependent. 

[kevinf80]

Thanks for that update, do the following see if we have stopped the popup..

Reset your router, instructons available at the following link: http://setuprouter.com/networking/how-to-reset-your-router/ Follow those instructions very carefully. Next, Download and unzip DNSJumper to your Desktop, the tool is portable no installation necessary. Tool can be downloaded here: http://www.sordum.org/downloads/?dns-jumper   Right click on Dnsjumper.exe and select "Run as Administrator" to start the tool, For XP just double click to run. From the left hand pane select "Flush DNS" From the main interface select the dropdown under "Choose a DNS Server" From the list select either "Google Public DNS" or "Open DNS" From the left hand pane select "Apply DNS" When done re-boot your system....

Edited December 13, 2018 by kevinf80
typing error

[Seif1993]

Resetting the router would not be ideal for me as ill have to call out a tech from my ISP to do the initial setup. I flushed the DNS and changed to Google's DNS and still got the pop-up on reboot. Is there a way to isolate services that are internet dependent? It would narrow down our search by quite abit. 

[Seif1993]

Also, right before the popup appears I can see my mouse flickering indicating that there is a process going on which is then followed up by the pop up appearing. 

[kevinf80]

A router reset just resets to default settings, you would have to reset the password. Can you not do that yourself, I was thinking the issue is with the router. With the connection off the popup does not happen..

[Seif1993]

I am not aware of the default PW and ID at the moment. I did a router reset a few months back and ended up having my ISP's technician come out because of the weird protocols that they have when setting up a router. I would rather keep that as a last ditch effort.

 

Is there a way to isolate services that are internet dependent? 

[kevinf80]

Try the following, see we make any headway:

Please download and scan with SUPERAntiSpyware Free for Home Users Double-click SUPERAntiSpyware.exe and use the default settings for installation. An icon will be created on your desktop. Double-click that icon to launch the program. If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.) Under "Configuration and Preferences", click the Preferences button. Click the Scanning Control tab. Under Scanner Options make sure the following are checked (leave all others unchecked):   Close browsers before scanning. Scan for tracking cookies. Terminate memory threats before quarantining.   Click the "Close" button to leave the control center screen. Back on the main screen, under "Scan for Harmful Software" click Scan your computer. On the left, make sure you check C:\Fixed Drive. On the right, under "Complete Scan", choose Perform Complete Scan. Click "Next" to start the scan. Please be patient while it scans your computer. After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". Make sure everything has a checkmark next to it and click "Next". A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. If asked if you want to reboot, click "Yes". To retrieve the removal information after reboot, launch SUPERAntispyware again. Click Preferences, then click the Statistics/Logs tab. Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. Please copy and paste the Scan Log results in your next reply. Click Close to exit the program. Thanks, Kevin

[Seif1993]

The scan was run with the pop-up open and .tmp files present. Most of the results were files and folders that existed on my PC way before this pop-up issue ever occurred. 

SUPERAntiSpyware Scan Log - 12-15-2018 - 00-50-16.log

[kevinf80]

Thanks for the log, I assume the popup is still showing its ugly face.... You mentioned KMS earlier, AutoKMS spico is a program designed to crack Windows OS and MS Office, in recent times malware writers are taking advantage and using that program to infect computers. That program is also present on the guys system being investigated at Bleeping computers.

[Seif1993]

Yeah my younger brother had this genius idea of downloading a file from a piracy website which came with this AutoKMS thing, my windows and office are already activated... It is exactly AutoKMS spico which caused this pop-up.

[AdvancedSetup]

Hello @Seif1993 I'm going to step in and see if I can assist you with this issue. Unless told otherwise please attach all logs, do not copy/paste into your reply.

I know you've done a lot of things already, but I want to start from scratch.

Let's start by resetting your browsers.

 

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome

Follow the directions from this topic

 

Restart your computer and proceed with the following steps.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

STEP 04

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here.
• Save Autoruns.exe to your desktop and double-click it to run it.
• Once it starts, please press the Esc key on your keyboard.
• Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures
• Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
• When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.
• Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
• Attach the Autoruns.zip folder you just created to your next reply
  

 

Thanks

Ron

 

[Seif1993]

Hello Ron, appreciate your time and effort into helping me resolve this issue. The logs requested are attached. The scans were all run with the pop-up present and .tmp files not deleted. 

 

 

SHELBY.zip

MalbytesLog.txt

AdwCleanerLog.txt

Addition.txt

FRST.txt

[Seif1993]

Once again, I left my PC shut off for around 8 hours and after powering it back on, the pop-up did not appear. 

[AdvancedSetup]

Please temporarily uninstall Java 8 Update 191

Please permanently uninstall the following software:
RegVac Registry Cleaner 5.02
Wise Registry Cleaner 10.1.3

Do I need a Windows Registry Cleaner?

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thank you

Ron

 

[Seif1993]

Pop-up appeared post reboot. Once again, when the PC was shut for several hours, it did not appear on startup. 

Fixlog.txt

[AdvancedSetup]

Okay, please temporarily uninstall all iObit software. If you have a license key make sure you have it available to use to reinstall later on.

Once all iObit software has been removed please post back new FRST logs.

Thanks