Outbrain pop up can't get it out.

[Bonnie Jean]

I started to get Outbrain pop ups 3 or 4 at a time and they are a nuisance to say the least.
I have a desktop HP windows 7 64 bit pc.
I ran my virus scan and nothing. I downloaded Emsisoft Emergency Kit found Trojans but not this one. I think I got the Trojan's from the same place the outbrain thing is from. I have run that program - Emsisoft 3 times. The first it found Trojans and the last 2 they said I was clean.' I don't like it my pc and I don't know how to get rid of it. As soon as I am reading something the popups come and cover part of what I doing.

Thank you for any help you can give me. Please remember to give directions in old lady.

 

[Snick]

Hi Bonnie Jean
Directions coming for as you stated "Old Lady".
I have no problem working with less Tech Savvy individuals, and that's why we're here!
Give me a few to put together a resolution.

Nic

 

[Snick]

1. Please click on following blue text Malwarebytes, it will open a popup installer for Malwarebytes, and follow the install instructions. You don't need the Premium Trial version, but you can select it if you wish. It will provide you with real time protection for the trial period. Real Time means as the computer is on.
2. Click on the Malwarebytes Icon if the program doesn't automatically start. On the Malwarebytes home screen, click Update which is on the right-side of the screen across from Database Version. When the Update is finished, click Scan and let it run, when it finishes delete what it finds.
3. At the top of the Malwarebytes home page click History, upper left corner click Application Logs, then click Export, at the popup window click Text file .txt.
4. Upper left hand corner of window, you may have to move the scroll bar down to see Desktop choose Desktop.
5. Lower right hand corner choose Open, save fiile as ScanLog, click Save. close all Malwarebytes screens if any are open.
6. Below the post window on SevenForums click Go Advanced. Scroll down the screen and click on Manage Attachments.
7. Popup click top Browse, upper left of screen choose Desktop, find the Scan Log and click on it.
8. Lower right hand corner click on Open in the popup that you clicked Browse in, click Upload. You will see it appear in a new box entitled Current Attachments.
9. Close that popup by clicking Close this Window or click the Red X it will now be attached to your reply when you click Submit Reply.

I'll have a look at the logs and recommend further action to remove the remnants if there are any.

There are no dumb/stupid questions!

Nic

 

[Bonnie Jean]

There was no history in upper L corner or anywhere. I clicked around and found something said export so I went from there.

If this is wrong let me know. Thank you the old lady appreciates old lady speak.

 

[Snick]

Good job you found it Bonnie Jean!

 

[Snick]

Please download and run these on default settings. Delete what they find.

ADWCleaner
SuperAntiSpyware
TDSSKiller

Post log from each scanner please!

Nic

 

[Bonnie Jean]

Hi! Malware Bytes has run daily and found a Trojan every day and the pop up stopped a couple of days ago.
I downloaded the 3 apps you said I should do but do I really need to run them? TDSS there was nothing to save the report maybe because there was nothing found. The Super adware won't save a scan.
The Adware one is attached I think. Nope
SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 09/24/2018 at 09:07 PM

Application Version : 6.0.1264
Database Version : 15036

Scan type : Complete Scan
Total Scan Time : 00:31:43

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 744
Memory items detected : 0
Registry items scanned : 73654
Registry items detected : 0
File items scanned : 25165
File items detected : 31

Adware.Tracking Cookie
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\68AR6NKZ.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\68AR6NKZ.txt [ /adform.net ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\PNWA5KNT.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\PNWA5KNT.txt [ /mathtag.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\YXQ2WM9U.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\YXQ2WM9U.txt [ /netmng.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\7JFEPLF0.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\7JFEPLF0.txt [ /p.liadm.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\A4IQ7RRM.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\A4IQ7RRM.txt [ /traversedlp.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\1I3MKI5H.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\1I3MKI5H.txt [ /track.adform.net ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\L3FG2XAB.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\L3FG2XAB.txt [ /scorecardresearch.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\9LUI1WNR.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\9LUI1WNR.txt [ /flashtalking.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\ZV9I0JU4.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\ZV9I0JU4.txt [ /intentiq.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\BU63N7MA.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\BU63N7MA.txt [ /s.thebrighttag.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\2LKI0UEN.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\2LKI0UEN.txt [ /lijit.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\P9K3X3B2.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\P9K3X3B2.txt [ /taboola.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\VVKAAYZL.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\VVKAAYZL.txt [ /adnxs.com ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\XEMZT988.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\XEMZT988.txt [ /doubleclick.net ]
C:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\76PBQO9T.txtC:\Users\Bonnie\AppData\Roaming\Microsoft\Windows\Cookies\76PBQO9T.txt [ /dotomi.com ]
.amazon-adsystem.com\ad-id [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.amazon-adsystem.com\ad-privacy [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.e-monsite.com\_gat_brandTracker [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.joann.com\mm-t15-drawer-counter [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.liadm.com\lidid [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.popads.net\fraudcheck [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.taboola.com\taboola_fp_td_user_id [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.trackbar.navigator-lxa.mail.com\_ga [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.trackbar.navigator-lxa.mail.com\_gat_UA-56425893-1 [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.trackbar.navigator-lxa.mail.com\_gid [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
p.liadm.com\tuuid [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
p.liadm.com\tuuid_lu [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
serve.popads.net\PopAdsCount [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
serve.popads.net\PopAds_CF_Pass [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
serve.popads.net\PopAds_FL_5 [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.joann.com\kampyleSessionPageCounter [ C:\USERS\BONNIE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

============================
Unwanted Programs Detected
============================
MiPony
Driver Support

============
End of Log
============

 

[Snick]

You doing great
run all three and delete what they find.

If Superantispyware won't run.

Click rb: type Superantispyware > you should have a couple choices > choose SUPERantispyware alternate start delete what it finds.

If it doesn't appear click rb: click All programs > scroll down to superantispyware > click on the folder to expand it > choose SUPERantispyware alternate start > click Click here to check for updates > lower right corner click OK > click Scan Computer > click Complete Scan

Again, delete what it finds

Download FRST64 > place it on your Desktop > double Click FRST64 > in searchbox type Outbrain > click Search registry

When FRST64 completes post log please.

Click Go Advanced > click Manage Attachments > click Browse > upper left corner click Desktop > click SearchReg > click Upload > click Close > it should be attached to your post.

Nic

 

[Bonnie Jean]

Sorry it has taken so long. Life caught up with and stomped all over me. I am just crawling out from the rubble. I ran the antispyware and it found only cookies which are deleted. attaching the FRST64 scan. I haven't had any pop ups but it is hard to get anything open. Click on my down-loader 2 or 3 times. Open an email I put on my desktop and it takes several tries to get it to open. Maybe just an over used pc. Thank you so much.

 

[DavisHill]

Great tips snick. Gonna test those malware programs as well.

 

[Snick]

@DavisHill
Peruse this
Recommended AV's etc.

 

[Snick]

Hope life is treating you better Bonnie Jean!
Great job so far!
Please make sure FRST is on you Desktop
Start FRST
in the Search type
outbrain
click Scan Registry,
when scan completes, please post SearchReg.txt

 

[Bonnie Jean]

Hi Nic,
After all the scans and deletes I did the first go around the pop ups were gone. Now the pop ups say Sendspace.com at the bottom, Seems outbrain either changed names or it is another one. I ran all of the scans and yesterday there were 16 cookies. I reran them all today and there was nothing there except a couple of cookies. I ran the FRST recovery scan and the registery scan on that. I have those pages to attach. I saw a Windows repair app was suggested and after running it it said I had 24 questionable programs. But I see before I can do more I need money which I don't have. Hate it being old and broke.

 

[Snick]

I saw a Windows repair app was suggested and after running it it said I had 24 questionable programs. But I see before I can do more I need money which I don't have.

Great job, I'll have a more detailed look at the logs you posted (great job there as well) and we can proceed from there.

I the meantime:
Where did you see a Windows repair app?
I didn't suggest that! I'm extremely careful in the links I provide to webpages, downloads, programs, etc. to help keep malicious programs off the individual's computer I assist with their computer woes.

Why do you need money? I haven't suggested anything that involves $$$$. I like free, as in free software, free assistance, etc.

You ran FRST with a search for Send Space?

We still need to see if outbrain is lurking in your registry.
Please run FRST again, in search type outbrain click Search registry
when it completes please post SearchReg.txt

 

[Bonnie Jean]

Well I see that the tip at the top of page 2 said Windows repair was not a tip anyone gave me. Yes I ran it with Send space. Here is the outbrain. No pop ups this morning but the pc is doggy. taking forever to open anything and even amazing if it does. I will be more careful I must remember that I will see ads that are popped in.

 

[Snick]

Well I see that the tip at the top of page 2 said Windows repair was not a tip anyone gave me. Yes I ran it with Send space.

Top of page 2 of what please?

Bonnie Jean
Great job again with the logs. Logs look OK!
Which Web Browser do you normally use?

 

[Bonnie Jean]

I use Google Chrome up at the top right corner where my avatar is it is now a pink area that says Error on it. It wasn't there yesterday.
The pc is just plain weird when I put a link in a lot of time it times out. I have a hard time getting an email to open and often when it does open it loads and that little circle just keeps going around and around until I get mad and turn it off. I ruined my pc by running that stupid app I thought I was supposed to!
I use Microsoft Security Essentials and run a scan on each of the external hard drives and the pc itself. Never anything there.
Can't think of anything else.
Thanks for all of the time you are taking. Bonnie

 

[feetand nches]

I ruined my pc by running that stupid app I thought I was supposed to!

Please post the link to that app you downloaded and ran!

Your pc is just full of junk and needs lot's of work IMO. Hopefully Snick can get you fixed up but I see some stuff on there that I'm not sure got removed.

Snick, did this one get removed?

2018-10-02 07:01 - 2018-10-02 07:03 - 050360488 _____ (Privat Kommunikation AB) C:\Users\Bonnie\AppData\Local\Temp\tmp9AA9.tmp.exe

 

[Snick]

Nasty7,
That code snipped you posted is Private VPN & was founded in 2009 in Stockholm, Sweden. The full company name is Privat Kommunikation Sverige AB, and the company was originally named privatvpn.se.

 

[Bonnie Jean]

link for what I ran

Tip: Download Windows Repair Tool

It showed there were tons of things wrong but nothing was removed although I suppose it could have filled me up good - it gave the price in Kronor - I think it was 279 sek.
I have a VPN so I can watch the soap in the US that I followed for almost 40 years. Terrible aren't I? Ya can't give up a soap just because you marry someone in a country that doesn't show it.