BleepingComputer.com: $1,000 Walmart giftcard popup HELP!!

I keep getting a pop-up that talks about the "$1,000 Walmart giftcard"...and then other website popups will appear. What is this considered? Adware or spyware? I was on Myspace the first time it popped up. I think something about Java was mentioned first, and then the Walmart pop-up came up. And every time I clicked on a website in Explorer, the website wouldn't appear except for the pop-up and some other sites. Earlier in the day I opened a plain-text e-mail on Yahoo which was supposedly from a friend but was really an ad for something -- I don't remember if it was for Walmart. Do you think this e-mail caused it? McAfee isn't finding anything. So is this adware or spyware and how do I remove it? And how do most people get this virus or whatever it is?? Thanks so much and please help!

Hello,it looks like spyware. We should run these next.
Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1
Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware

Thanks for getting back! I actually rebooted my computer so I don't know if those steps would've worked. I'm just curious to know why you think it was spyware? Are you sure it was not adware? A few hours went by from the time I opened the email and got the first popup. In between that time I signed onto accounts with passwords. Do you think they could've been stolen? Also, the email had no visible attachments, just text. Have you heard of this kind of thing before, the Walmart giftcard thing? Thanks.

I look at it this way. The pop ups come from sites you or family have been to in the past. A cookie is set and then you get more and more pop ups, it's called spyware. Did you run those 2 apps and het logs?

I see. Would you consider this a strong spyware then? Do you think it would track down passwords and steal other kinds of information? I never got to run the two apps cuz I rebooted my computer before I had a chance. I'm just curious to know what kind of spyware you think I had. Thanks.

This post has been edited by helphelpme: 11 December 2010 - 01:42 AM

This one ,No.. it is a softer type only delivering adware. Did you run the oyher tools this will reveal any security risk.

Thank you! You are very helpful! I'd run the other tools but I rebooted my computer. But you don't think it had like a keylogger or anything like that? Thanks again!

You're welcome. I don't think so from what I see. Running the tools in post 2 will let me know for sure.

I've got the exact same problem and also got it from MySpace (which I never normally visit but a friend sent a link to it and BAM, got the Java message, got the Walmart $1,000 gift card, got the iexplorer in the background speaking to me, got the redirect on any link (now have to either key in direct ot copy/paste links to go anywhere on the internet)

The pop-ups are not coming from any sites I've ever visited (no one else uses the computer) and are often somewhat related to the link I'm trying for, but sometimes appear to be quite random. I've deleted all history/links and cookies and it still persists.

I've run Malware Bytes and SpyBot Search and Destroy and the latest MaAfee scan and none of these are helping.

I ran the steps as directed and the logs and such are posted under my name in the new topics thread.

HELP.....

Arthur

This post has been edited by adoucette: 13 December 2010 - 04:59 PM

@ ArthurNow that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Sorry, I just wanted to clear up that issue about the pop-ups being from sites previously visited. It's clear that is not the case.

I'm not trying to jump the line and I'm not doing anything more to my computer and I've posted the logs and I am waiting patiently, I was just pointing out that if you are working on his problem, that I've got the exact same one and already posted all the data you asked for, so using that you could possibly get two birds with one stone.....

This post has been edited by adoucette: 13 December 2010 - 05:28 PM

Adoucette, I was thinking that since you posted here you have already followed these steps to no avail. hence the ned for a DDS log.

Correct.
I started out by running Spybot search and destroy, found and fixed a number of things, but no change.
I ran my companies McAfee system and it found one thing and deleted it, but no change
So I found this site and followed the instructions.
I downloaded and ran Malware Bytes, no change.
So I did steps 6 through 9 as instructed and posted DDS Txt, Attach Txt and Ark Txt in a new topic in the apporpriate forum.

Arthur

I am a newbie and am also having this problem. The only help I can offer is that TrendMicro's RUBotted program picks up a HTTPS Malicious Certificate before I get that pop-up using Internet Explorer. Not to cause panic, but Yahoo forced me to reset my e-mail password because of suspicious activity on my account while I was out of town and I never accessed my account at that time. These events may not be related. I will follow the instructions on this topic and see how it goes.

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.