Solved windows 7 annoying pop up installer wont go away

[proaalsol]

Hi everyone!!!

please im having problem with this annoying pop up installer from "amonetize .ltd" ??. that wont go away, keeps coming back every 1 minute....:shock:

Is there a way to stop W7 from asking me to install? (i do not want to install it of course)

I've tried Malwarebytes anti-malware and Ccleaner but nothing.....

Thanks

 

[cottonball]

proaalsol,

Try using the following guide, up to and including Step #3:
Remove PUP.Optional.Amonetize (Removal Guide)

On AdwCleaner, after the Scan, if you see an entry that you do not want removed, uncheck it. Then, press on with the instructions to Clean.

On Malwarebytes Anti-Malware, when removal is completed, you will see a report that opens in Notepad.

:ar: Please copy/paste the entire contents of the MBAM report in your reply.

 

[proaalsol]

proaalsol,

Try using the following guide, up to and including Step #3:
Remove PUP.Optional.Amonetize (Removal Guide)

On AdwCleaner, after the Scan, if you see an entry that you do not want removed, uncheck it. Then, press on with the instructions to Clean.

On Malwarebytes Anti-Malware, when removal is completed, you will see a report that opens in Notepad.

:ar: Please copy/paste the entire contents of the MBAM report in your reply.

Thanks Cottonball for your quick reply, but it didnt work, ill try your recomendations again in safe mode.........

 

[cottonball]

Going to Safe Mode is a good option.

Also, in Safe Mode, try the Microsoft Safety Scanner:
Download: Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free

On the Scan Type window, please select: Full scan

 

[andrew129260]

Whats great about uac is its giving you the location of the file that is trying to launch. And blocking it, thats always nice. You could just navigate to that file as well and delete it. I would then follow cottonball's suggestions to finish checking your pc for malware.

It looks like its in your app data/local/temp folder. You can set to view hidden files and folders so that these folders become visible.

 

[proaalsol]

HI, I think i 've get rid of it. I did something quite interesting (for me at least): I finally found where this .exe (musiccodepack_3646_il4.exe) was. It was like hidden files (thanks andrew129260 )
but every time i delete it, it continue re-appearing 5 seconds later, so i opened windows task manager and notice that this "cashpartners.exe" (????) was at the top of the memory usage just when the musiccode.exe reborn...
so, i found this cashpartners.exe location and delete.
now i'll run my army of cleaners (thanks cottonball )in safe mode to be sure

 

[andrew129260]

You are quite welcome. Please also continue with anything else cottonball advises. I applaud you for hitting no on UAC. Most people just click yes without reading.

The infection keeps bringing itself around. You could delete contents of the temp folder under internet options (in control panel) and click delete. Select everything except passwords and click delete again.
This will clear everything out. If the threat appears again, its just going to keep readding itself. Running in safe mode with the army of cleaners is wise. You could try deleting it again in safe mode, thus it should prevent the process that's re-adding it from allowing itself to be re-addded. Since the process shouldn't run in safe mode. Although it is possible.

Also see these sites for reference:

http://www.shouldiremoveit.com/Software-Version-Updater-9841-program.aspx

http://www.sophos.com/en-us/threat-...are-and-puas/Amonetize/detailed-analysis.aspx

http://malwaretips.com/blogs/pup-optional-amonetize-virus/

 

[cottonball]

proaalsol,

Let us know how it goes after you run the programs suggested in Post #2

With them and the suggestions provided by andrew129260, you should be good.

 

[proaalsol]

Some days have passed and no notice of this program, after run AdwCleaner, and Malwarebytes Anti-Malware i got rid of several bugs
Thank you very much guys, this forum RULES!!!!!!!!!!!!!!!!

 

[cottonball]

Glad you got the issue resolved.

Good luck!

 

[andrew129260]

Awesome! Glad you got it solved. Let us know if you need any more assistance