Solved 1-800 pop up, new variant??

[Dean Jordan]

Not entirely sure if this is a new variant. But doesn't seem to being picked up and removed.:
I've followed: Remove "Computer Health Alert" pop-up virus (Guide) without success.

Please help

Thanks
Dean.

 

[Dean Jordan]

file uploads in case that's the first thing you would like me to action

 

[TwinHeadedEagle]

Hello,

When exactly this issue occurs?

 

[Dean Jordan]

hi there,

randomly while browsing the internet, usually while trying to download some of the tools that have been mentioned in previous posts. Its definitely coming up from somewhere. I've tested it on random sites and it will do it then too. any browser as well, which seems odd.

Thanks
dean

 

[Dean Jordan]

here is an example:

 

[Dean Jordan]

bump, any suggestions for me, this computer is making me go crazy. Its definitely infected, but nothing is picking it up. I am thinking i'm going to have to reformat the whole thing and start from scratch, there is nothing that is picking it up. Any other advice greatly appreciated.

 

[TwinHeadedEagle]

Can you reset your router to factory settings?

How To Reset Your Router

 

[Dean Jordan]

can you advise why I would need to reset the router? Its the pc that has the issue and not the router? I'll do it, just not sure why I would need to?

I have done a roll back using system restore and the doctopdf or pdftodoc whatever it is, was in programs and features. I've run the scan again and still not showing any threats, but it keeps popping up when web browsing.

Thanks
Dean

 

[TwinHeadedEagle]

Sometimes router gets infected with malicious DNS settings so all traffic can go through this DNS in order to show ads.

 

[Dean Jordan]

some of the advertising is coming up saying adobe flash is out of date, Microsoft security scan has detected......
so did you want me to restart or reset the router?

 

[Dean Jordan]

sorry I see your instructions for reset, will reset and let you know, thanks heaps for your help

 

[Dean Jordan]

sorry, have restarted, re-set and reconfigured the router and restarted the computer, same pop ups and virus warning coming up. More suggestions please?

 

[TwinHeadedEagle]

Let's try with this tool:

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyclsid;
  emptyalltemp;
  ipconfig /flushdns >>"%temp%\log.txt";b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Upload it in your next reply.

 

[Dean Jordan]

Hi, and thank you for your help. I was thinking after I reset the modem about your idea about something related to the DNS. I changed the pc's DNS to different addresses with another major ISP and since I did that, no more pop ups or fake virus alerts. I'm wondering, would it be possible that somehow the DNS server that the ISP has, could have an infection that is serving up these on the pc, or any pc that is using that as their DNS server?

I'm not even sure if this is possible, but it is strange that since changing the servers, there hasn't been one pop up.

Any other thoughts are appreciated. I've held off running the ZOEK scan at the moment, but its been a real strange one to me this one!

Thanks again

Dean.

 

[TwinHeadedEagle]

Yes, I am pretty sure it was the case here. That's why I put this command for Zoek to execute just to be sure:

ipconfig /flushdns >>"%temp%\log.txt";b

Interesting reading: How to Switch to OpenDNS or Google DNS to Speed Up Web Browsing

 

[Dean Jordan]

Thank you, do you think I should contact the ISP and let them know?

Thanks
Dean.

 

[TwinHeadedEagle]

You don't need to, there was probably some malware that set these malicious settings on your PC, I think it isn't your ISP related.