Problem with Anythicago, alwaysisobar, simplesitescan, optiguardzip Popups

[REDACTED]

Hello, i've been struggling with a PC that has repeated popups from avast that mention a URL:Mal infection of the process svchost.exe. The URL's listed in the title are the ones displayed in the popups. I recently removed multiple PUPs from this PC including weatherbug, PCTechHotline, and a few misc toolbars that were wreaking havoc. I believe they originated from the installation of an outdated version of CCleaner that was downloaded from a third party site.

I began with a malwarebytes scan of all drives. This removed most of the issues except for these URL:Mal popups. Then i performed a full system scan with Avast which didn't seem to catch the cause of these popups. I then performed a scan with AdwCleaner which also did not seem remedy the cause.

In other posts I saw that people requested to see the logs from a Farbar Recovery Scan so I have them attached. If anyone can help me, it would be greatly appreciated. Also if I did anything wrong or out of order with the virus scans, let me know so I can make sure I dont make the same mistakes again.

Thanks in advance!

[Eddy]

We also want to see the Mbam log.

[TwinHeadedEagle]

Monitoring...

[REDACTED]

Here are the mbam logs. I ran two scans.

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
  
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:

Code: [Select]

createsrpoint;
autoclean;
bitsadmin /reset /allusers;b
emptyalltemp;
ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
  
• Push Run Script and wait patiently. The scan may take a couple of minutes.
  
• When the scan completes, a zoek-results logfile should open in notepad.
  
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.