Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently got infected with something where, in all browsers (IE9, FF, Cx), a 3.5" square popup appears on many sites in the lower left (or right) corners. It wants me to download something or watch videos or install plugins, or shows ads, etc. I'm looking at it right now on SuperUser.com. Doesn't show up on bing, google, ibm, facebook, etc. but get it here, stackoverflow.com, and triumph.com (for example).

  • Hosts file has 127.0.0.1 localhost and ::1 localhost.
  • Had browser DNS settings at 4.2.2.1-4 but restored to TWC.
  • Full scans in updated malwarebytes and MSE each returned 10 threats, which i've removed.
  • Kapersky TDSSKiller found one threat, and removed it.
  • Doesn't happen on another system, so probably not the router.

Must be something in my network config right? Where is this coming from and how can i kill it?

enter image description here

share|improve this question
    
A screenshot may help us understand the issue better. –  Ganesh R. Oct 5 '12 at 18:18
    
@GaneshR, sure, good point. I'll add one. –  bill weaver Oct 5 '12 at 18:34
    
Just a suggestion, can you download process explorer (Sysinternals) and using it find out if it is coming from the browser or a hidden application? –  Ganesh R. Oct 5 '12 at 18:43
    
Have you tried following the suggestions in this question? –  Indrek Oct 5 '12 at 19:18
    
@Indrek, yes, more or less. There are a few things in the answer to that question that might help. Per Aaron below, i ran ComboFix and it eventually bluescreened after the first reboot, and now bluescreens immediately. Odd. But the good news is i think the popup is gone now. Thanks for the reference--should help in the future. –  bill weaver Oct 5 '12 at 19:32
add comment

1 Answer

up vote 2 down vote accepted

Looks like malware to me; I've found ComboFix (http://www.bleepingcomputer.com/download/combofix/) to be extremely useful in such cases, especially with rootkits and other garbage that most virus/malware scanners can't see.

share|improve this answer
    
i'm accepting your answer because i did this and now the popup is gone. However, after working for a while then rebooting itself, Combofix bluescreened. And now bluescreens immediately upon execution. Which itself is worrying. But the popup is gone, so thank you. –  bill weaver Oct 5 '12 at 19:34
    
Glad to help! What exactly do you mean when you say it "bluescreened" -- BSoD? If so, please post the error code from the BSoD and I'll try to find out why it happened; if not, please post a screenshot or som more detail on the problem and I'll see what I can come up with from that. –  Aaron Miller Oct 5 '12 at 20:33
    
thanks. Yes, BSoD. But, ran again and it completed. Rebooted to finish and displayed the log. But then trying to run anything gave me "attempted operation on reg key marked for deletion" (or some such). So after yet another reboot it appears to be okay now. Very weird. –  bill weaver Oct 6 '12 at 20:15
    
The BSoD may have been unrelated. I've seen a couple since then but not when CF was running. Ugh. –  bill weaver Oct 7 '12 at 17:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.