Advertisements popups under Firefox

**HiSpeed** · 03-12-2009

I am a little tech savvy, but I have tabs opening in Firefox advertising either English or some foreign language which changes often and I am unable to rectify the problem. In general I used HijackThis rule and the problem was solved, but we must admit that does nothing. I have used avast as antivirus, I try now famous anti virus windows vista, but nothing has changed it finds nothing. I also try the software Malwarebyte. If someone has an idea, I'm interested, thank you.

**Connect_Me** · 03-12-2009

I understand where it comes from but we will check before. But WOT (security module) sees your web page as being at risk. It is better to remove the link (or put a screen in place, boundary)

To advertise, use the diagnostic software stp, more comprehensive than HijackThis:

• Download Random's System Information Tool (RSITY) by random/random and save it on your desktop.
• Double click on RSIT.exe to launch the tool.
• Click on 'Continue' at the disclaimer screen.
• If the HijackThis tool is not present or not detected on your computer, download the RSITY (allows access in your firewall, if requested) and you must accept the license.
• Once the scan is complete, two reports will show: post as attachment here.

**HiSpeed** · 03-12-2009

Apparently the software (Malwarebytes) finds 8 infected file, I had a report but as in the report after the scan, I'll delete the file from quarantine and redo a clean.

**Connect_Me** · 03-12-2009

In fact, I wanted to see the files it found. Can you post the report after scan completion? You'll find in the Reports tab/logs when you open MBAM.

**HiSpeed** · 03-12-2009

Malwarebytes' Anti-Malware 1.41
Version of the database: 3277
Windows 6.0.6002 Service Pack 2

02/12/2009 17:23:18
mbam-log-2009-12-02 (17-23-12). txt

Type: Full Scan (C: \ | D: \ | E: \ |)
Items discussed: 267,836
Time elapsed: 36 minute (s), 41 second (s)

Memory Processes Infected (s): 0
Module (s) infected memory (s): 0
Key (s) Registry Keys Infected (s): 2
Value (s) Registry Keys Infected (s): 0
Item (s) Registry Data infection (s): 0
File (s) infected (s): 0
File (s) infected (s): 6

Memory Processes Infected (s):
(No malicious items detected)

Module (s) infected memory (s):
(No malicious items detected)

Key (s) Registry Keys Infected (s):
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ f8dip1of (Adware.AdRotator) -> No action taken.
HKEY_CURRENT_USER \ SOFTWARE \ AppDataLow \ HavingFunOnline (Adware.BHO.FL) -> No action taken.

Value (s) Registry Keys Infected (s):
(No malicious items detected)

Item (s) Registry Data infection (s):
(No malicious items detected)

File (s) infected (s):
(No malicious items detected)

File (s) infected (s):
C: \ Users \ cyd \ AppData \ Local \ Temp \ wmxsrconae.exe (Trojan.Dropper) -> No action taken.
C: \ Users \ cyd \ AppData \ Local \ Temp \ aeoxmscwrn.exe (Trojan.Vundo) -> No action taken.
C: \ Windows \ System32 \ F8DIp1Of.exe (Adware.AdRotator) -> No action taken.
E: \ MP3 ZIK \ Sony.Soundforge.8.Inc.Keygen-RENEGADE \ SF8.exe (Trojan.Vundo) -> No action taken.
E: \ Driver pc \ Ahead.Nero.v8.3.6.0.Incl.Keymaker-EMBRACE \ Ahead.Nero.v8.3.6.0.Incl.Keymaker-EMBRACE \ Key \ keygen.exe (Trojan.Agent) -> No action taken.
C: \ Users \ cyd \ AppData \ Local \ Temp \ 0.9473337973994082.exe (Trojan.Dropper) -> No action taken.

Obviously I deleted above files from quarantine, but I just opened Firefox at the moment but a new popup advertising comes up.

**Connect_Me** · 03-12-2009

Well, your PC is infected. That is what is causing pop-up advertising: Adware.AdRotator. It is a rare infection but it is also known as the yoogi Search. And that is what must surely be causing your infection:

E: \ Driver pc \ Ahead.Nero.v8.3.6.0.Incl.Keymaker-EMBRACE \ Ahead.Nero.v8.3.6.0.Incl.Keymaker-EMBRACE \ Key \ keygen.exe

E: \ MP3 ZIK \ Sony.Soundforge.8.Inc.Keygen-RENEGADE \ SF8.exe

In this case, a keygen trapped as we are many. I urge you to rid yourself of everything Cracks, Keygens or other (90% are rotten). And be careful with downloads, especially those by P2P.

1) To take care of Ad-Rotator, use this:

Download AD-Remover
Click on Download and save the tool on the desktop.
Double click the installation file AD-Remover, the program will install automatically.
Once launched, go to the main menu, choose option "L" and click Enter to confirm
Let the tool to work through.
The ratio (C:\Ad-report.log) will appear at the end, post-it in your next reply.

In fact, what is drive E:\?

Hard disk partition? Or a removable disk?

2) After AD Rotator, you'll also need to use ComboFix, Malwarebytes seen that did not detect an infection seen in the report RSITY:

The following software must be used with care and can do damage if misused! Do this only if someone who knows this tool.

Disable all protection software on PC (antivirus, firewall, antispyware etc.) because they may interfere with the tool

• Download ComboFix (by sUBs) and saves it on the desktop
• Double-click the executable file on the desktop
• If you request to install the Recovery Console accepts
• Run the scan and let the tool work until the end without doing anything else and without interruption (very important)
• When the search is completed, a report will appear. Post it (C:\Combofix.txt) in your next reply.