Warning your flash player may be out of date! Nightmare please help

[jason moffat]

This has been a real pain! Every time I open my home page I get the pop up:

WARNING your flash player may be out of date. Please update to continue.

Then I get the redirect bogus update page.

Have followed advice on similar posts but I cant shift it!

I'm using MS Security essentials and I'm always super careful!

I spend days trying to find the root of this to no avail so any help would be massively appreciated!

Logs attached!

Rgds

Jason

 

[TwinHeadedEagle]

Hi,


Please download zoek.zip or zoek.rar by smeenk (

) from here or here and save it to your Desktop.
Unpack the archive...

• Close any open browsers
• Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:
  
  

  createsrpoint;
  gpt.ini;z 
  C:\Windows\System32\GroupPolicy;v
  C:\Windows\SysWOW64\GroupPolicy;v 
  StandardSearch; 
  emptyfolderscheck; 
  installer-list; 
  installedprogs; 
  uninstall-list;

• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"

 

[jason moffat]

Here are my results! It was too big to cut and paste. I got an error message!

 

[jason moffat]

thanks for the quick reply by the way : )

 

[TwinHeadedEagle]

Re-run Zoek once more with this script:

C:\Users\hexan\AppData\Local\Mobogenie;fs
C:\Users\hexan\daemonprocess.txt;f
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run];r
"mobilegeni daemon"=-;r
C:\Program Files\Mobogenie;fs
autoclean;
emptyclsid;
emptyalltemp;

 

[jason moffat]

Here you go Mr Twinheadedeagle sir! : )

 

[TwinHeadedEagle]

Do you still have a problem?

 

[jason moffat]

yes, its the same problem!
Both IE and Mozilla!

 

[TwinHeadedEagle]

Let's run another scan:


1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
Note: ComboFix must be downloaded to your Desktop.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!

- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.




Download TDSSKiller and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Confirm "End user Licence Agreement" and "KSN Statement" dialog box by clicking on Accept button.

• Press Start Scan
• If Suspicious object is detected, the default action will be Skip, click on Continue.
• If Malicious objects are found, select Cure.

Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt


Please post the contents of that log in your next reply.

 

[jason moffat]

Here combo log.

TDSS found nothing and produced no log file!

Thanks

J

 

[jason moffat]

whoops found it! : )

 

[jason moffat]

spybot search and destroy found win32.2urface.bho - it categorised it as very critical!

It claimed to fix it but after a reboot the browser hijack remains! : (

Damn this thing!

I installed a new hard drive this week and it found me again! Worried it could be on my 2nd slave drive!

I wonder if Microsoft Security Essentials is any good as I have never clicked anything stupid or fallen for any traps!

J

 

[TwinHeadedEagle]

Try this

https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

http://support.microsoft.com/kb/923737