Solved how to get rid of russian adware and pop ups

[el gitano]

Some days ago, I noticed the appearance of pop ups in my laptop while using chrome. They are in a vast majority Russian ads and i do not know how they got there. I downloaded Farbar Recovery Scan tool and i obtained a file to share you.

I hope that someone can help me!! please.

Thanks!

 

[el gitano]

here, fixlog

 

[el gitano]

i used adblock and it worked a little bit.

 

[el gitano]

I installed superantispyware and bitdefender removal tool

 

[TwinHeadedEagle]

Do you still need my help?

 

[el gitano]

yes, because the problem is still there... can you analyze the files? could you tell me if you see any problem? I have bitdefender and apparently there arent files or "things" downloaded by this "thing" but... it still exist. One person recommended me to restart my pc to original settings but I dont agree because the "virus" locates my IP... can you give me a possible solution, Twin?

Thanks.

 

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyclsid;
  emptyalltemp;
  ipconfig /flushdns >>"%temp%\log.txt";b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[el gitano]

here, the log...

btw... the adblock works a little bit... because although it blocks the ad, the ad blocks me the page... so adblock effect is kind of useless....

 

[TwinHeadedEagle]

How is the situation now? If you still have ads, do they appear in all browsers?

 

[el gitano]

Hi, well, the ads dont appear in Facebook, Gmail, Youtube, etc.... but they do appear in websites like newspapers, or .com or .net endings...

In the photo below, the ad is blocked by the Chrome extensions I added to do it.... but... i cant watch the page, the ad is frozen but i cant enter to the page.

Now, i'm saving my files. Btw... i clicked in "restore system" to take the pc back to 2 weeks ago... but it didnt worked

I'm skeptical about the possibility of a general reboot and re-installing of windows..... that "thing" detects me anyways.

What do you think?

thanks.

 

[TwinHeadedEagle]

Let's reinstall Google Chrome:

Uninstall Chrome

Export your bookmarks
Import or export bookmarks - Chrome Help


Close all Chrome windows and tabs.
Go to the Start menu > Control Panel.
Click Programs and Features.
Double-click Google Chrome.
Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.


Click Start, copy in search %LOCALAPPDATA%\ and remove folder Google

Download Chrome
Chrome Browser

 

[el gitano]

it didnt work.... :/ i'm resigned haha I'm wondering about the possibility of a windows re-installation but I dont know yet.

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition and Shortcut.txt options are checked.
• Press Scan button and wait.
• The tool will produce three logfiles on your desktop: FRST.txt, Shortcut.txt and Addition.txt.

Please attach them into your next reply.

 

[el gitano]

I attached them in the first message. Do you want me to do the test again?

Thanks.

 

[TwinHeadedEagle]

Yes.

 

[el gitano]

Here the files.

 

[TwinHeadedEagle]

How is your PC behaving now?

 

[el gitano]

normal, but the problem is there.... and yesterday, a friend sent me a mail worried about something taxes, i opened the file but it was a spam file for him and for me.... I guess I solved the problem. Noob attitudes so sad...

what do you see in the files provided?

 

[TwinHeadedEagle]

They doesn't show signs of infection.

 

[el gitano]

Ok, well... apparently, the problem is over. I dont know why, how... but my idea/belief is that since I deleted some folders in Documents&Settings of old programs I downloaded, the bug who activated everything was there and now dissappeared. I'll maintain the ad blockers just in case. Thanks for the help given.