Virus causing new pop up ads in IE?

[lpaul626]

Hi Everyone-

I believe I've picked up some sort of virus that is forcing new advertising pop ups every time I am using Internet Explorer (ver 10). Each time I click on a link, a new window opens with a random ad. Also, websites I normally frequent now have links in certain areas which will bring me to an ad if I click on it (see below).

I believe I picked up the virus after being directed to an add on site while using a program called Audacity.

I also ran Avast with no luck.

Thoughts?

 

[richnrockville]

iPaul626, You might want to take a look at your tools in IE, Select Manage Add-On's and your browser highjacker might be there.
Or you could download the free Malwarebytes at https://www.malwarebytes.org/
and run it in the full scan mode.
It might not be what they call a Virus but in reality a browser hijacker..

Rich

 

[lpaul626]

iPaul626, You might want to take a look at your tools in IE, Select Manage Add-On's and your browser highjacker might be there.
Or you could download the free Malwarebytes at https://www.malwarebytes.org/
and run it in the full scan mode.
It might not be what they call a Virus but in reality a browser hijacker..

Rich

Thanks! I'll try that!

 

[ThrashZone]

Make sure your set on the Middle left column to Show All Add-ons to see what is installed,

http://windows.microsoft.com/en-us/internet-explorer/manage-add-ons#ie=ie-10-win-7
You can also go through your Uninstall a program list for items you might not recognize,
See above my signature picture on how to post screen shots here,
Cheers.

 

[x BlueRobot]

I would also suggest running AdwCleaner Download

 

[robinb9]

i would suggest running a full scan in malwarebytes, not a quick scan

 

[ICIT2LOL]

I see Blue beat me to it but another would be
http://www.superantispyware.com/

Now if you can find the authour personally I go look in Program s and Features or try Revo
http://www.revouninstaller.com/revo_uninstaller_free_download.html

if they are persistent I go to regedit and scroll down through the Software in the HKEYs - User and Local Machine right click and delete the entry for it. My pics are for example only and you do not have to do this

But back the registry up first - as you should always do on a machine just in case

 

[lpaul626]

Thanks guys. Malwarebytes got rid of a lot. But then IE started locking up and I noticed Conduit popping up. Then ran ADWcleaner and that seemed to work.

 

[Computer0304]

Why conduit? Which program did you download before this happened?

 

[ICIT2LOL]

Mate out of interest I wouldn't mind betting it is still sitting in the reg in one of those HKEYS I mentioned > Software.

 

[lpaul626]

Why conduit? Which program did you download before this happened?

I was attempting to convert an Audacity file to an mp3. It directed me to a remote site stating that I needed an add on. I did and that's when the issues started.

 

[lpaul626]

Mate out of interest I wouldn't mind betting it is still sitting in the reg in one of those HKEYS I mentioned > Software.

Once the issues started, I noticed three new programs, Scorpian Saver, Kinksicle, and Sendori. I removed all three. I'm assuming they're probably still there?

 

[ICIT2LOL]

Mate out of interest I wouldn't mind betting it is still sitting in the reg in one of those HKEYS I mentioned > Software.

Once the issues started, I noticed three new programs, Scorpian Saver, Kinksicle, and Sendori. I removed all three. I'm assuming they're probably still there?

Paul if you run Revo it digs a little deeper inti the reg so winkling the thing out if you like go to regedit don't use admin just yet and go to those HKEYs and open out the Software look for Makisoft for the Sendori see this scorpion saver - Microsoft Community for Scorpian Saver but check down both Software lists anyway the other I can out find any reference to but do the same as for Scorpian Saver look for entries with that as that first reference .

 

[ThrashZone]

Once the issues started, I noticed three new programs, Scorpian Saver, Kinksicle, and Sendori. I removed all three. I'm assuming they're probably still there?

Might be interesting to know how exactly you were directed to this add-on download and what site you downloaded from so others might be warned about the malicious site.

 

[ICIT2LOL]

Once the issues started, I noticed three new programs, Scorpian Saver, Kinksicle, and Sendori. I removed all three. I'm assuming they're probably still there?

Might be interesting to know how exactly you were directed to this add-on download and what site you downloaded from so others might be warned about the malicious site.

Actually TZ it looks like it was bundled in with some browser stuff as a Google came up with some stuff on Ebay, facebook etc Remove Scorpion Saver pop-up ads (Virus Removal Guide)
and https://isc.sans.edu/diary/Suspect+Sendori+software/16466 the other I cannot find anything on

 

[lpaul626]

Once the issues started, I noticed three new programs, Scorpian Saver, Kinksicle, and Sendori. I removed all three. I'm assuming they're probably still there?

Might be interesting to know how exactly you were directed to this add-on download and what site you downloaded from so others might be warned about the malicious site.

In Audacity, when you attempt to export an Audacity project as an mp3, you get a message stating that Audacity cannot convert to an mp3 unless you download an add on. The link to the site was included in the message.

 

[Computer0304]

Maybe it was a trojan horse?

 

[ICIT2LOL]

Well try the TDSS Killer scroll down the list and run it form the link Free Malware Removal Tools and the one directly below it - Xorist

 

[Jacee]

If you cleaned/deleted everything that AdwCleaner found, then it cleaned the registry too.