pop up

[REDACTED]

I have been getting pop ups when connected to the internet on this machine. I am scanning ms security scan right now.
there are about 20 items in malwarebyte quarantine but all the the logs show nothing found. I also ran there anti rootkit beta and it stopped the pop ups for one start up as also with the regular version. the pop up is the web shield saying its blocking this url... http://mirutaruda.com/params/da5429b83d9531a3351ac76ff9c625e5/getdll/23005/6.1.760... and three variations of C:windows\Syswow64\  . I have scanned all the files and the url. I am attaching the log files for the Farbar Recovery Scan Tool (x64)

[Eddy]

Start with deciding what av you want to use.
avg or avast ?
http://blog.kaspersky.com/multiple-antivirus-programs-bad-idea/

Delete the one you will not use anymore:
http://www.ache.nl/index.php?location=mal-01

[magna86]

Hello 677zn6 and welcome to avast!. I will be working on your Malware issues. 

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper

You had a powerfull RootKit on your systems. I shall need both MBAM and MBAR logreporst. Please post them as well.

---     ---     ---     ---     ---





1. Please download ComboFix by sUBs () from here and save it to your Desktop.
If you are unsure how ComboFix works, read this guide.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:
• Right click on the avast! system tray icon () in the lower right corner of the screen and scroll up to avast! shield controls;
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note:  Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.

--------------------------------------------------------------------
3. Run ComboFix. Then, on disclaimer window, click I Agree! button.

- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
- If malware is detected, ComboFix will begin with its removal, and may need to restart Windows.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt)
=> Attach log report (ComboFix.txt) back to topic.

ComboFix shall also create addition log (typical location: C:\Qoobox\ComboFix-quarantined-files.txt)
=> Please attach that report (ComboFix-quarantined-files.txt) as well.

[REDACTED]

avast is the only av I am loading at startup. the MBAM logs show nothing found but like I said there are 20 items in quarantine. I see no log option for beta MBAR. I will run MBAR again to see if I can save the log right after, but at this point it might not find anything. the MS secuirity scan took 26 hours and claimed to have removed Exploit: HTML/pangimop.v and Ransom:win32/crouti. but the pop ups still come up.
I will run combo fix.

[magna86]

Hello,

No, do not run MBAM/MBAR again. Here is how to post the logs/


> The following reports will be created in mbar folder for Malwarebytes' Anti-Rootkit Utility:
1. mbar-log-year-month-day (hour-minute-second).txt
2. system-log.txt

Please post both logs in your next reply that show the detection.



--------------



• Post the logs for MBAM (Malwarebytes' Anti-Malware). Click on the History tab > Application Logs. Double click on the Scan Log which shows the date and time of just performed scan.
- Click Export button at the bottom, and then select the 'Text file (*.txt)'
- In the Save File dialog box which appears, click on Desktop.
- In the File name: box type "mbam" (without quotes) for your scan log name and click Save.
- A message box "Your file has been successfully exported" should appear, click Ok and close the windows.


Please attach the exported/saved log named as mbam.txt to your next reply.




--------------



And post me the ComboFix.txt log for analysis.

[REDACTED]

I am waiting for combofix to finish...it has taken about 12 hours so far...it has completed the 50 stages but the cursor is still blinking. I believe I have to wait till it produces the log and ends.

[magna86]

Hello,

Sorry, I for didn't answer earlier, I did not found time for forum.

There is no need for sending me PM's, feel free to post here. 

I am waiting for combofix to finish...it has taken about 12 hours so far...

Do not worry, it happens that sometimes. You should not have to wait that long.

Stop ComboFix and reboot the mashine by force. Then delete ComboFix icon (ComboFix.exe) and download fresh copy and run it as you did before.
ComboFix should finish his work for maximum ~ 30/40 min. If the tool still does not wont to run, stop scan again and reboot mashine by force once more.

Then post me the fresh both FRST logs for re-analysis. And I still need MBAM/MBAR logs.