Problem with Virus and/or spyware : please help

[MNMAN]

After downloading the program from the new link and clicking the exe file , a message popped up informing me that the license key is expired and I can download the latest free version of the program from their web site, in any case I had no options but to proceed and download Dr.Web CureIt latest version from DR.WEB  web site. After running scan a report was created, the report is very very long. It's not possible to copy past it, so I uploaded it to 4shared :

http://www.4shared.com/file/ttHZEweQ/cureit.html

P.S. : 33 threats were detected and neutralized, however after restart the popup issue still persist :


And also to make it easy here are the first and last few lines from the report:


=============================================================================
Dr.Web Scanner SE for Windows v8.2.0.07100
(c) Doctor Web, Ltd., 1992-2013
Scan session started 2013/11/19 23:57:28
Module location : C:\Users\TOSHIBA\AppData\Local\Temp\D370FD3B-FC09E658-E8408E88-B5E0DB14\
=============================================================================
OPTION [Automatic Apply Actions] NO
OPTION [Turn Off Computer After Scan] NO
OPTION [Use Sound Alerts] NO
OPTION [Block Network] NO
OPTION [Protect Process] NO
OPTION [Protect Raw Disk] NO
Using language: "English"
Available instances: 6
Instances used: 6
Platform: Windows 7 Professional x86 (Build 7601), Service Pack 1
API Version: 2.2
Scanning Engine version: 8.1.0.7100
Virus Finding Engine version: 7.0.5.6250
Total 147 virus bases are loaded from C:\Users\TOSHIBA\AppData\Local\Temp\D370FD3B-FC09E658-E8408E88-B5E0DB14
6f08f53w 7.0 55598bcbc4f04f5eb354b118d7ca765f41ddaf5 4 2013/11/19 21:10:42 349 records - OK
qde8z28l 7.0 d07fc5cc240588c772457e7df580f3cec20d922 2 2011/07/25 16:20:03 2 records - OK
yp3wa1qf 7.0 53dc5069230b45079bce66c919ab9f17659511b b 2013/11/19 21:03:50 5586 records - OK
mj8gv3bp 7.0 8e677cc8b19dc0ad82c4b71202c0acd9e2e2582 7 2013/11/18 05:08:42 32245 records - OK
jffi01x8 7.0 bc2662842e39ed5dc010a39140fd82d7ad1b600 6 2013/11/11 05:09:43 33084 records - OK
u3zdya0q 7.0 8900859cec3affe1e5bbb086bdb2299d125acf7 c 2013/11/04 05:09:28 30356 records - OK
ku2uxr1s 7.0 0e9ca4f15f289ae826d213e6a1d672470a127b5 1 2013/10/28 05:09:43 18457 records - OK
dzzie9y3 7.0 eba0efa3e9d70063908fb5e41a704579c255ea3 3 2013/10/21 05:09:49 19594 records - OK
oeu8svqr 7.0 0f5e49d3e5b4c931d1f2de5e7b3551b3290cae2 6 2013/10/14 05:07:20 22924 records - OK
r65p2rv0 7.0 11c09a3ae7c80058711dd699aeb1ca4f5ba0f5a 5 2013/10/07 05:07:56 24694 records - OK
mcn23nt2 7.0 27f46d939a14e1a0605b9762db1de5a2aca20a5 8 2013/09/30 05:08:23 24253 records - OK
zk6ngi2q 7.0 e679853ff1af1082b1982cf226785128a26e109 9 2013/09/23 05:07:56 18453 records - OK
-
-
-
-
-
-
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe\{app}\About.rtf - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe\{app}\About.rtf - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe\{app}\About.rtf - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe\{app}\About.rtf - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe\{app}\About.rtf - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe\{app}\About.rtf - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe - Ok
C:\Users\TOSHIBA\Documents\My Downloads\AVSDVDCopy.exe - container

Total 41945208014 bytes in 159555 files scanned (343594 objects)
Total 159371 files (343406 objects) are clean
Total 33 files are infected
Total 99 files are raised error condition
Scan time is 01:49:47.743

-----------------------------------------------------------------------------
Start curing
-----------------------------------------------------------------------------
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paauxstb.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pabrmon.exe.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\padatact.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pabrstub.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\padlghk.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\padyn.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pahighin.exe.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pafeedmg.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pahkstub.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pabprtct.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paieovr.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paidle.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pahttpct.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paimpipe.exe.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pahtmlmu.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pamedint.exe.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pamlbtn.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pamsg.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paradio.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paregfft.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paregiet.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pareghk.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pascript.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paskin.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paSrcAs.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paskplay.exe.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pasknlcr.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\paSrchMn.exe.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\T8EXTEX.DLL.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\T8EXTPEX.DLL.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\pauabtn.dll.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\T8TICKER.DLL.vir - quarantined
C:\AdwCleaner\Quarantine\C\Program Files\FilmFanatic\bar\1.bin\T8HTML.DLL.vir - quarantined

Total 41945208014 bytes in 159555 files scanned (343594 objects)
Total 159371 files (343406 objects) are clean
Total 33 files are infected
Total 33 files are neutralized
Total 99 files are raised error condition
Scan time is 01:49:47.743

[SuperDave]

Let's try cleaning out the temp files.

Click Start> Computer> right click the C Drive and choose Properties> enter
Click Disk Cleanup from there.



Click OK on the Disk Cleanup Screen.
Click Yes on the Confirmation screen.



This runs the Disk Cleanup utility along with other selections if you have chosen any. (if you had a lot System Restore points, you will see a significant change in the free space in C drive)

[MNMAN]

After Performing disk clean the problem still there!!!!!     

[SuperDave]

Did you try blocking that site?

[MNMAN]

Did you try blocking that site?

I blocked the two sites I believe the popup belongs too:
http://newbase.sytes.net
http://newbase.sytes.net.ipaddress.com/

However the popup still coming, I believe the catch is that the popup is not coming on as a website address it's a file location C:\Users\TOSHIBA\AppData\Local\Microsoft\Windows\Temporary Internet Files\web.html

[SuperDave]

I believe the catch is that the popup is not coming on as a website address it's a file location C:\Users\TOSHIBA\AppData\Local\Microsoft\Windows\Temporary Internet Files\web.html

I'm not sure I understand this statement. Could you please elaborate?

[MNMAN]

If you go to page 1 and see the two screen prints I posted for the popup, you will see on the top left instead of usual web site address a file location.

for example when you go to google you would see on the top left of the browser the web site address as https://www.google.com , in case of the popup I have it shows a file location C:\Users\TOSHIBA\AppData\Local\Microsoft\Windows\Temporary Internet Files\web.html

[SuperDave]

Please try this and let me know what you find. Open your browser,go to Tools, internet options and tell me what your home page address is.

[MNMAN]

tell me what your home page address is

https://www.google.co.za/

[SuperDave]

Please try changing your home page just to see what happens.

[MNMAN]

Please try changing your home page just to see what happens.

The popup still comes up.

[SuperDave]

Does it pop up in Safe Mode?

[MNMAN]

Does it pop up in Safe Mode?

I connect to the internet by USB modem , in the safe mode the PC does not detect the USB modem, it always shows "device modem not detected, please connect device modem".
So, I couldn't find out if the popup will continue in safe mode or not.

[SuperDave]

We'll I'm stumped.

[MNMAN]

NO solution to my problem