Help Please. Multiple Windows Popping Up During Use.

GoodZwell · Jan 22, 2017

HI. So my wife's laptop has issues. HP Beats 15 Notebook, Windows 10 64 bit.

A few months ago it seems like she had a Bing hi jack taking over her home page which is Google.ca. Now it defaults to bing. Last night it started popping up windows when she was on FaceBook. Windows are blank message windows. The pointer keeps changing to a four head crossed arrow until you click something off the side of the screen then returns to normal. I ran through all the programs your site says to run before asking for help and complete all of them but one would not give me a log file. Hitman Pro ran but when I tried to export the log it shut down and windows forced me to close it. I did take a picture of the screen as I had to run all of these programs off line and in Safe mode because the problem is so bad you can't open anything in normal mode without this dam virus or malware taking over completely.

Hope I done this right.. have to add some more pictures.

Thanks in advance

GoodZwell · Jan 22, 2017

second part .

TimW · Jan 22, 2017

Let's start by rerunning RogueKiller and delete these items:

¤¤¤ Registry : 11 ¤¤¤
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\SweetLabs App Platform -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\SweetLabs App Platform -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\Microsoft\Internet Explorer\Main | Start Page : https://startpage-home.com/?s=hp&m=start -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3891553219-3572483063-1964976757-1002\Software\Microsoft\Internet Explorer\Main | Start Page : https://startpage-home.com/?s=hp&m=start -> Found

¤¤¤ Files : 10 ¤¤¤
[PUP.Gen1][File] C:\Users\cagal_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"f22abfeae27a67446927d078890381efc546d3e1" -> Found
[PUP.Gen1][File] C:\Users\cagal_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"menu" -> Found
[PUP.Gen1][File] C:\Users\cagal_000\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Start Menu.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"menu" -> Found
[PUP.Gen1][Folder] C:\Users\cagal_000\AppData\Local\SweetLabs App Platform -> Found
[PUP.Gen0|PUP.Gen1][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk [LNK@] C:\Users\cagal_000\AppData\Local\Pokki\Engine\HostAppService.exe /OPEN"f22abfeae27a67446927d078890381efc546d3e1" -> Found
[PUP.Gen0|PUP.Gen1][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk [LNK@] C:\Users\cagal_000\AppData\Local\Pokki\Engine\HostAppService.exe /OPEN"menu" -> Found
[PUP.Gen1][File] C:\$Recycle.Bin\S-1-5-21-3891553219-3572483063-1964976757-1002\$RV2WXTW.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"menu" -> Found
[PUP.Gen1][File] C:\$Recycle.Bin\S-1-5-21-3891553219-3572483063-1964976757-1002\$RY1Y3Z1.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"f22abfeae27a67446927d078890381efc546d3e1" -> Found
[PUP.Gen1][File] C:\Users\cagal_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"f22abfeae27a67446927d078890381efc546d3e1" -> Found
[PUP.Gen1][File] C:\Users\cagal_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk [LNK@] C:\Users\CAGAL_~1\AppData\Local\SWEETL~1\Engine\SERVIC~1.EXE /OPEN"menu" -> Found

The have ADWCleaner delete all it found.

Reboot and try to rerun Hitman in normal mode. Be sure to right click and run as admin.

Rerun RogueKiller and attach that log as well.

GoodZwell · Jan 23, 2017

Okay removed all but when I ran Hitman I temporarily lost the use of the keyboard but it seems to be working ok now after running Rougekiller. When trying to locate and figure out which logs I was going to send the time stamps were really confusing so I'm attaching all of them. sorry. Here are the logs. Thanks for the really quick response that was unexpected.

TimW · Jan 23, 2017

Your logs are clean. Any remaining issues should be addressed in the software forum.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

GoodZwell · Jan 31, 2017

Sorry for the delayed response. Thanks so much for your help. The laptop is working fine now. I guess the OS head a heart attack when I ran all those malware programs and it messed up the keyboard until I restarted the computer a second time.

You're da BOOMB. Thanks man!

TimW · Jan 31, 2017

You're welcome.

Log in or Sign up

Help Please. Multiple Windows Popping Up During Use.

GoodZwell Private First Class

Attached Files:

AdwCleaner[S0].txt

malware b log.txt

MGlogs.zip

rk_D343.tmp.txt

20170122_144139.jpg

GoodZwell Private First Class

Attached Files:

20170122_144149.jpg

20170122_144152.jpg

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

GoodZwell Private First Class

Attached Files:

AdwCleaner[C0].txt

AdwCleaner[S1].txt

HitmanPro_20170122_2159.log

rougekiller.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

GoodZwell Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Help Please. Multiple Windows Popping Up During Use.

GoodZwell Private First Class

Attached Files:

GoodZwell Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

GoodZwell Private First Class

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

GoodZwell Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches