Popups in IE and Chrome, suspected Malware

Welcome to Major Geeks!

What exactly happens when you run it and did you have protection software disable? Also is UAC disabled? Try the below.


Run the C:\MGtools\ReZip.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator). .

It should take a couple seconds to run. You will see a black command prompt window while it is running and it should tell you that the C:\MGtools\MGlogsR.zip file as been created. Attach this ZIP file.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

 

This is not a popup. Based on your logs, that is what you have your start page ( home page ) set to. If you don't want this as your start page, then just change it. For example, for Internet Explorer I see the below setting:


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.car-truck-accessories.com/


And for Chrome, I also see the below:

"homepage": "http://www.car-truck-accessories.com/",

 

Still not sure I see a "popup". Are you referring to the Download and Play Now buttons that are showing?

Please run CCleaner as requested in step 5 of the READ & RUN ME and then do the below.


Download HostsXpert and then follow the below steps.

• Unzip HostsXpert.zip
• It will create a folder named HostsXpert in whatever folder you extract it to.
• Run HostsXpert.exe by double clicking on it.
• Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
• Click Restore Microsoft's Hosts File and then click OK.
• Click the X to exit the program

Then reboot your PC. See if there is any change.


Also now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

Also what is the below:

O4 - Global Startup: Jungle Disk Workgroup.lnk = C:\Program Files\Jungle Disk Workgroup\JungleDiskWorkgroup.exe

 

You're welcome.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
3. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!