1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

In Progress Pop-ups reappear even after restart

Discussion in 'Virus & Other Malware Removal' started by Robbieboy, Oct 9, 2018.

Thread Status:
Not open for further replies.
Advertisement
  1. Robbieboy

    Robbieboy Thread Starter

    Joined:
    Nov 29, 2005
    Messages:
    94
    Hi, I'm having a very frustrating problem with my PC. I use Mozilla Firefox with a pop-up blocker which generally works well, but I still get pop-ups from time to time. Sometimes I get the bogus "critical alert from Microsoft" fake virus alert type pop-ups, I also get 'uber' ones and 'Roblox' ones. I'm very wary of these and I never close them off with my mouse as I have been told this can embed viruses on a PC. In the past I have always done a restart on my PC to get rid of these. However I am now finding that after a restart, the very same ones from my aborted session re-appear- the same ones, and the very same amount. It's as if the restart didn't work properly.

    Personally I don't think there is a virus or malware causing this (although I could be wrong). I have good anti-virus protection and I have also run a couple of the most well-known malware detection programs e.g. malwarebytes on my PC, which detected nothing. Also, these pop-ups do not randomly present themselves on my PC and my browser does not get hijacked, redirected etc. They only ever appear during visits to websites from which I download music (not illegally, I hasten to add). For some reason my pop-up blocker is not catching them. As mentioned, it's as if the restart hasn't worked properly, or a setting is not quite right.
    Anyway, thanks in advance to anyone who can help out.

    Tech Support Guy System Info Utility version 1.0.0.4
    OS Version: Microsoft Windows 10 Home, 64 bit
    Processor: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz, Intel64 Family 6 Model 94 Stepping 3
    Processor Count: 4
    RAM: 12236 Mb
    Graphics Card: NVIDIA GeForce GT 720, -2048 Mb
    Hard Drives: C: 1831 GB (908 GB Free); E: 1863 GB (0 GB Free);
    Motherboard: LENOVO, 30C7
    Antivirus: Windows Defender, Enabled and Updated
     
  2. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,283
    First Name:
    Derek
    restarting W10 with any browser windows open ( especially using Edge browser) results in the same windows being opened
    you need to close them by using the red X button, ( if they will )

    I find with edge & unwanted pop ups especially the critical alert junk, I need to sue task manager to close edge browser completely because the pop ups just don't close otherwise

    Firefox is the same

    Check under Firefox / Settings / Options General, that restore previous setting is unchecked
     
  3. Robbieboy

    Robbieboy Thread Starter

    Joined:
    Nov 29, 2005
    Messages:
    94
    Hi, thanks for taking the time to help.
    I checked my Firefox settings and found that the restore session box was already unchecked.
    What worked for me was using task manager to end Firefox, then doing a restart- thanks!
    I’m still a bit unclear as to whether I have adware or some such. On the one hand, scans with adwcleaner, malwarebytes and Hitman Pro revealed no sign of infection. However I did some reading about adware that said pop-ups such as ‘critical alert’ ‘uber’ and ‘roblox’ which seem to be activated only when visiting certain specific websites may indicate the presence of malware/adware.

    So for now I’ll use the task manager/end process/restart method for closing off these pop ups.
     
  4. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,283
    First Name:
    Derek
    I will move this to Malware cleaning where we can examine more deeply & see what we find

    It does sound slightly possible that there might be malware / adware lurking
    Make sure you empty cache/ Temp internet files as sometimes a rouge javascript sits in there that can be automatically enabled on visiting certain sites
     
  5. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,283
    First Name:
    Derek
    Please download Farbar Recovery Scan Tool and save it to your Desktop or downloads folder.

    Note: You need to download and run the 64 bit version

    • Right click to run as administrator. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will produce a log called FRST.txt in the same directory the tool is run from.
    • Please copy and paste log back here.
    • The first time the tool is run it generates another log (Addition.txt - also located in the same directory/folder/place as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
     
  6. Robbieboy

    Robbieboy Thread Starter

    Joined:
    Nov 29, 2005
    Messages:
    94
    Hi, thanks for the response. I’ll make sure I empty the cache and delete temp internet files.
     
  7. Robbieboy

    Robbieboy Thread Starter

    Joined:
    Nov 29, 2005
    Messages:
    94
    Thank you! I will be sure to get that done ASAP.
     
  8. Robbieboy

    Robbieboy Thread Starter

    Joined:
    Nov 29, 2005
    Messages:
    94
    Hi, further to yesterday here are the resultant FRST.text and Addition.txt logs:
     

    Attached Files:

  9. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,283
    First Name:
    Derek
    Download attached fixlist.txt file and save it to your desktop.

    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    • Open FRST/FRST64 by right clicking the icon and select run as Administrator ( in the same way you did the first time)
    • Do NOT press scan instead press the Fix button just once and wait.
    • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    • When finished FRST will generate a log on the Desktop (Fixlog.txt).
    • Please post the fixlog.txt to your reply.


    then when it has rebooted do this

    OK can you now please go to C:/FRST

    look for the quarantine folder

    Right click it & zip the folder ( select send to compressed folder, if you don't have winzip , WinRAR or some other zipping program already installed) That creates a zip file called quarantine.zip inside the FRST folder

    Then please upload the zip file so we can get the entries checked thoroughly and added to anti-malware tools ( if needed) to protect other users

    https://myonlinesecurity.co.uk/malware-submission-form/
     

    Attached Files:

  10. Robbieboy

    Robbieboy Thread Starter

    Joined:
    Nov 29, 2005
    Messages:
    94
    Guys thank you so much for your assistance and sorry for the delay in responding. I am pretty comfortable and confident that nothing is amiss. As has been pointed out to me, Windows 10 will restore the previous session if not all windows and pop-ups were closed prior. Your help was much appreciated.
     
  11. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1217562

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice