Solved Unknow message pop out

[RevCrew1]

I need help,something is wrong with my laptop...
this started after i launched Win7 in safe mode i wanted to do something...
and when i launched it normaly a message jums out evry time i start any program.View attachment 271791
Here is a picture.

Specs:
Windows 7 Ultimate 32bit
Intel Core 2 duo 1.66Ghz
2GB RAM

 

[Golden]

i launched Win7 in safe mode i wanted to do something...

What was it you did?

 

[RevCrew1]

I wanted to clean my laptop with Advanced System Care 6 becuase when i reach the disc cleaning,windows crashes in a blue screen and it worked at safe mode

 

[VistaKing]

RevCrew1

I recommend uninstalling Advanced System Care 6

Use RevoUninstaller

Download one of the two below that goes with your OS bit version

RevoUninstaller Free Version
Download

For 32-bit OS
RevoUninstaller Pro 30-Day Trial Version
Download

For 64-Bit Programs

:ar: Right-click Revo Uninstaller.exe choose run as administrator to run it.
:ar: From the list of programs double click on The Program to remove
:ar: When prompted if you want to uninstall click Yes.
:ar: Be sure the Advanced option is selected then click Next.
:ar: The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
:ar: Once the program has searched for leftovers click Next.
:ar: Check/tick the bolded items only on the list then click Delete when prompted click on Yes and then on next. Put a check on any folders that are found and select delete when prompted select yes then on next
:ar: Once done click Finish.

 

[NoelDP]

I agree about uninstalling ASC - it's nothing but dangerous snake-oil.

What Anti-Virus program are you using? (or are you only using the cr^p that comes with ASC?)

What other AV programs have EVER been installed on this machine?

 

[RevCrew1]

I also have Bitdefender 2013

 

[NoelDP]

..and what was previously installed?


Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[RevCrew1]

I will try Malwarebytes,and i will reply later if it worked

 

[VistaKing]

RevCrew1


Open a new thread in System Security .

Click this link :ar: System Security - Windows 7 Help Forums

 

[Layback Bear]

Advanced System Care kills another computer.

 

[NoelDP]

Nothing new there, then!

 

[RevCrew1]

Malwarebytes result

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.06.14.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Luka :: MAJA-PC [administrator]

Protection: Enabled

14.6.2013 19:15:38
mbam-log-2013-06-14 (19-15-38).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 415709
Time elapsed: 1 hour(s), 3 minute(s), 48 second(s)

Memory Processes Detected: 1
C:\Windows\System32\dmwu.exe (PUP.InstallBrain) -> 1616 -> No action taken.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 4
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111181125} (PUP.CrossRider.BCA) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111181125} (PUP.CrossRider.BCA) -> No action taken.
HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (PUP.InstallBrain) -> No action taken.
HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Detected: 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Policies (Backdoor.Agent.PGen) -> Data: C:\Windows\system32\install\server.exe -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|HKLM (Backdoor.HMCPol.Gen) -> Data: C:\Windows\system32\install\server.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 8
C:\Users\Luka\AppData\Roaming\dclogs (Stolen.Data) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C} (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\chrome (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\defaults (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\defaults\preferences (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Users\Luka\Local Settings\Application Data\RavenBleuSA (Adware.Hotbar.RB) -> Quarantined and deleted successfully.
C:\Users\Luka\Local Settings\Application Data\RavenBleuSA\bin (Adware.Hotbar.RB) -> Quarantined and deleted successfully.
C:\Users\Luka\Local Settings\Application Data\RavenBleuSA\bin\1.0.13.0 (Adware.Hotbar.RB) -> Quarantined and deleted successfully.

Files Detected: 16
C:\Windows\System32\dmwu.exe (PUP.InstallBrain) -> No action taken.
C:\$Recycle.Bin\S-1-5-21-1145045425-4043479808-2266054014-1001\$R86ZT86.com (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-1145045425-4043479808-2266054014-1001\$RJMQW1O.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-1145045425-4043479808-2266054014-1001\$RMXHVMJ.com (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Local\Temp\Fo02AbRp49.exe (PasswordStealer.MSIL) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Local\Temp\Nd7w9YEk5g.exe (PasswordStealer.MSIL) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Local\Temp\Wa37LxMy8k.exe (PasswordStealer.MSIL) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Local\Temp\Bud hack\Bud hack.com (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Local\Temp\Rar$EX00.353\Budspawner Tools v.2.1.4.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Users\Luka\Desktop\Things\Bud hack.com (Backdoor.Agent.DCRSAGen) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Roaming\dclogs\2013-06-09-1.dc (Stolen.Data) -> Quarantined and deleted successfully.
C:\Users\Luka\AppData\Roaming\dclogs\2013-06-14-6.dc (Stolen.Data) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\chrome.manifest (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\install.rdf (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\chrome\basicscan.jar (Adware.Zwangi) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C}\defaults\preferences\prefs.js (Adware.Zwangi) -> Quarantined and deleted successfully.

(end)

 

[VistaKing]

RevCrew1

Can you open up a new thread inside System Security section ?

 

[RevCrew1]

Ok I will do it

 

[RevCrew1]

Hey HoelDP i did all that you said about Malwarebytes and it didnt worked

 

[NoelDP]

Hey HoelDP i did all that you said about Malwarebytes and it didnt worked

That is singularly uninformative.
WHAT 'didn't worked'??

 

[Layback Bear]

Malwarebytes Anti Malware sure worked quite well.
It found 24 items and deleted/quarantined them.
Or did I read the report incorrectly?

 

[VistaKing]

RevCrew1

почему вы не создание нового потока?

Translation : Why aren't you creating a new thread ?

 

[RevCrew1]

Uredu VistaKing napravicu novu temu
translate:Ok VistaKing i will make a new thread

 

[RevCrew1]

All of those were unticked shoud i clean them?