BleepingComputer.com: I Win a $1000 Walmart Gift Card Every Day Popup

I have tried Lavasoft, Trend Micro Systems, Norton and Microsoft trial products in both SAFE and NORMAL modes WITHOUT SUCCESS in eliminating the problem. I tried System Restore to no avail. I am running Windows XP Home Edition.

In addition to ads for winning the Walmart Jackpot everyday and other fast home money making schemes, other manifestations include the following:

at the appearance of a fake ad, I usually hit control alt delete, and terminate the fake ad window. The system responds by closing all open internet explorer windows. Sometimes a relaunch of IE 8 will yield no response from the system, an hour glass turns into an arrow with no IE window. Same is true for other launched applications

frequently, I get no internet sound from the speakers for internet pages like CNN video reporting(though inexplicably music plays in Windows Media Player). I check the control panel sound panel. No audio speaker is selected. I follow the troubleshooting process to select an audio speaker and reboot as instructed. I get internet page sound -- the problem appears corrected. I get an offending unsolicited popup and the speaker sound is lost again.

When I google search, several of the referenced links although appearing legitmate do not link to the stated page -- I think this is called click jacking.

Help please.

Edit: Moved topic from XP to the more appropriate forum. ~ Animal

It is acoompanied frequently by a popup advertisement A $1000 Walmart Gift Card or some home money making scheme. My taskbar area sometimes turns gray and I lose sound.

This post has been edited by hamluis: 07 December 2010 - 06:56 PM
Reason for edit: Split from different thread, edited ~ Hamluis.

Can someone reply? I am having exactly the same issue. Walmart in on my nerves... I have used every Malware - Antivirus proceedure known to Internet forums.... I'm sure it is something simple.. Look forward to a reply.
Regards,

I too have the exact same problem. HP Pavilion zv5000 running XP Home, SP3. I've run rkill and malwarebytes. It found over 600 entries, mostly PUP.Whitesmoke malware. Removed all entries, but still have the problem. Shows no sound device now, toolbar goes from blue to gray after about 4-5 minutes online, and I still win a Walmart gift card every time I'm on.

that's funny cause I was forced to do a restore and lost all my data since it wasn't backed up.

I only used Explorer a few times. Everything was fine 4 or more weeks agao.

I went to Google Chrome and been using that. Yesterday I went to Explorer to check for micosoft updates.

Sure enough I got a 1000 dollar Walmart card. WTF? I don't even use Explorer anymore.

These instructions are for bmt77706.

Others with issues or problems they would like to discuss, please start your own topic. Doing that will help to avoid the confusion that often occurs when trying to help two or more members at the same time in the same thread. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.


Please download the TDSS Rootkit Removing Tool (TDSSKiller.zip) and save it to your Desktop. <-Important!!!
Be sure to print out and follow all instructions for performing a scan or refer to these instructions with screenshots.

• Extract (unzip) the file to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the Desktop. Vista/Windows 7 users refer to these instructions if you're unsure how to unzip a file.
  
• If you don't have an extracting program, you can download TDSSKiller.exe and use that instead.
  
• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.

• When the program opens, click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure is selected, then click Continue > Reboot now to finish the cleaning process.<- Important!!
  Note: If 'Suspicious' objects are detected, you will be given the option to Skip or Quarantine. Skip will be the default selection.
  
• A log file named TDSSKiller_version_date_time_log.txt will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

-- If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these instructions. In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer.

-- For any files detected as 'Suspicious' (except those identified as Forged to be cured after reboot) get a second opinion by submitting to Jotti's virusscan or VirusTotal. In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis.


Please download Norman Malware Cleaner and save to your desktop.
alternate download link
If you previously used Norman, delete that version and download it again as the tool is frequently updated!

• Be sure to read all the information Norman provides on that same page.
  
• Double-click on Norman_Malware_Cleaner.exe to start. Vista/Windows 7 users right-click and select Run As Administrator.
  The tool is very slow to load as it uses a special driver. This is normal so please be patient.
  
• Read the End User License Agreement and click the Accept button to open the scanning window.
  
• Click Start Scan to begin.
  
• In some cases Norman Malware Cleaner may require that you restart the computer to completely remove an infection. If prompted, reboot to ensure that all infections are removed.
  
• After the scan has finished, a log file a log file named NFix_date_time (i.e. NFix_2009-06-22_07-08-56.log) will be created on your desktop with the results.
  
• Copy and paste the contents of that file in your next reply.

-- Note: If you need to scan a usb flash drives or other removable drives not listed, use the Add button to browse to the drives location, click on the drive to highlight and choose Ok.

I think I have a similar problem. I keep getting a pop-up that talks about the "$1,000 Walmart giftcard"...and then other websites will appear. What is this considered? Adware or spyware? I was on Myspace the first time it popped up. I think something about Java was mentioned first, and then the Walmart pop-up came up. And every time I clicked on a website in Explorer, the website wouldn't appear except for the pop-up and some other sites. Earlier in the day I opened a plain-text e-mail on Yahoo which was supposedly from a friend but was really an ad for something -- I don't remember if it was for Walmart. Do you think this e-mail caused it? McAfee isn't finding anything. So is this adware or spyware and how do I remove it? And how do most people get this virus or whatever it is?? Thanks so much and please help!

This post has been edited by helphelpme: 10 December 2010 - 03:36 PM

Hello helphelpme

Please refer to these instructions in Post #6.

Quote

Hi!

I tried TDDSKILLER and Normal Malware.

But both can't find anything infected.


Any other idea?

Please refer to these instructions in Post #6.

Quote

I am a newbie and am also having this problem. The only help I can offer is that TrendMicro's RUBotted program picks up a HTTPS Malicious Certificate before I get that pop-up using Internet Explorer. Not to cause panic, but Yahoo forced me to reset my e-mail password because of suspicious activity on my account while I was out of town and I never accessed my account at that time. These events may not be related. I will follow the instructions on this topic and see how it goes.

Welcome to BC kmarion

If you have an issue or problem you would like to discuss, please start your own topic. Doing that will help to avoid the confusion that often occurs when trying to help two or more members at the same time in the same thread. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.

Thanks for your cooperation.
The BC Staff

FYI: Trend Micro’s RUBotted supposedly monitors your computer for bot related activity and suspicious behavior that are potentially harmful. The program works by regularly checking with an online service to identify behavior associated with Bots. Upon discovering a potential infection, RUBotted prompts you to scan and clean your computer. It has been reported that RUBotted is very difficult to remove as there is no separate program uninstall and are no specific removal instructions available from Trend that I can find. Further, the program's effectiveness is questionable so I don't recommend using it. Read this review of RUBotted and the user comments.

Also note that this program is a beta version. I seldom recommend using betas of any program as you never know what bugs and quirks you may encounter. These bugs may range in severity from minor features that don't work to problems that cause your computer to crash.