Avast WEBforum

Other => Viruses and worms => Topic started by: Mamag on March 05, 2013, 05:56:49 PM

Title: Annoying popups and chitka, please help me stop them!
Post by: Mamag on March 05, 2013, 05:56:49 PM
I've been getting those annoying popup ads and chitka, plus redirections.  Aggravating stuff.  Please help!  Thank you!
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: essexboy on March 05, 2013, 06:06:14 PM
Hi run this and attach the logs please

Download OTL (http://oldtimer.geekstogo.com/OTL.exe)  to your Desktop
Secondary link  (http://www.itxassociates.com/OT-Tools/OTL.exe)
(https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif)

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT


Title: Re: Annoying popups and chitka, please help me stop them!
Post by: Mamag on March 05, 2013, 11:50:13 PM
Hopefully - file will be attached..
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: Mamag on March 05, 2013, 11:51:30 PM
Other file attached
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: essexboy on March 06, 2013, 04:12:24 PM
Let me know if this kills it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
Code: [Select]
:OTL
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O3 - HKU\S-1-5-21-1068401455-3545607458-2383532500-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1068401455-3545607458-2383532500-1001\..\Toolbar\WebBrowser: (no name) - {575BDDF5-790A-4D01-A37D-2863DEC1C085} - No CLSID value found.
O3 - HKU\S-1-5-21-1068401455-3545607458-2383532500-1001\..\Toolbar\WebBrowser: (no name) - {F897EB0E-A3A4-46C3-80EB-2729699D8892} - No CLSID value found.

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: Mamag on March 06, 2013, 04:46:18 PM
I ran the quick scan - file attached. 
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: Mamag on March 06, 2013, 04:50:21 PM
 :D I visited some of the sites where I always see the popups and chitka - and no popups and no chitka!  THANK YOU!!!! 
Is there something I can do to avoid this?  Thank you so much! 
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: essexboy on March 06, 2013, 05:30:59 PM
Not really as this one writes a new Host file and no antivirus or antimalware monitors that area

Subject to no further problems   :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change thatClear Restore Points

Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button
(https://dl.dropbox.com/u/73555776/disc%20clean.JPG)


Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

(http://img233.imageshack.us/img233/7729/mbamicontw5.gif) Malwarebytes (http://www.malwarebytes.org/mbam-download.php).

Update and run weekly to keep your system clean

Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport  (http://www.trusteer.com/Products/Trusteer-Rapport-for-Online-Banking)

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)Keep safe  :wave:
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: Mamag on March 08, 2013, 12:50:21 AM
 :D :) :) Thank you, Thank you, Thank you!  Day after your support got rid of those annoying popups and chitka ads - and all is clear!  Thank you so much! 
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: essexboy on March 08, 2013, 03:24:23 PM
My pleasure  ;D
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: par on March 16, 2013, 04:58:54 PM
Hi! i m having trouble with the unwanted advertisements, please help.

Title: Re: Annoying popups and chitka, please help me stop them!
Post by: essexboy on March 16, 2013, 05:00:19 PM
Could you follow the steps here and attach the logs http://forum.avast.com/index.php?topic=53253.0
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: par on March 16, 2013, 05:56:36 PM
Hello!
I have followed the steps and attachment is here.
Thanks
Title: Re: Annoying popups and chitka, please help me stop them!
Post by: essexboy on March 16, 2013, 06:34:02 PM
Download the attached fix.txt to your desktop

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
THEN

Download AdwCleaner from here (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/2-adwcleaner) to your desktop
Run AdwCleaner and select Delete

(https://dl.dropbox.com/u/73555776/AdwCleaner.GIF)

Once done it will ask to reboot, allow this
On reboot a log will be produced please attach that