Virus in the form of a pop-up! (http://quizfinddomain.com)

[Matthew_84]

Hey all,

First off, I'd like to correct my title. The virus isn't a pop-up, it appears in a new tab in Firefox, just to be specific.

My mom used her computer and was on eBay. When she went to pay for something, a new tab opened from the address "quizfinddomain.com". This site claimed that she was the Ontario (our province) winner for that day's date. We use Firefox to browse the net and pop-ups or new tabs never ever come up for no reason. She thought it was a prize from eBay, so she clicked on the link and even put in her cell phone number when prompted.

When I got on the computer hours later it clearly had a virus. It was running very sluggishly and at random times, even when doing nothing, the blue screen of death would come up followed by a crash dump. Since then I have been going nuts. I found out that this happened on 09/09/2011 at about 12:20pm, because there were a whole bunch of new files (like begar2x.exe, efeh.log, and mousedriver.bat) that were installed at that time and were since added to windows start-up files, performances, and the registry. I went through all of them and got rid of every file that looked suspicious. The computer seemed to be a bit better.

But last night the pop-up from "quizfinddomain.com" still came up. I've noticed something else, this pop-up only appears when you are signing in to a site, or entering your e-mail address, or any personal information. Obviously I got very worried. A minute or two later, the Blue Screen appeared again. I dropped the computer off today to a computer tech who claimed to have fixed it. After I went through stuff and checked out what he did, without making any changes, I went to register for a file sharing site that asked for my address and things like this, the pop-up came up again.

The only file that remains that is a concern to me is this:

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\InternetExplorer\MSIMGSIZ.DAT

Now I've read up on this file and everyone says that it is a normal file and was there all along. The thing is that when I click on the properties, it says that the file was created at the precise time that the other virus's were installed (09/09/2011 12:24:11 PM) and has not been modified since. This file apparently stores something to do with Internet Explorer. None of us have used Internet Explorer in years, and when I go into and look at any dates modified, nothing was modified on the same day as the MSIMGSIZ.DAT file. I am unable to delete this file, and I know it is causing some of the issues as it was downloaded at the same time as the virus was.

Also, I'm very curious as to why the site "quizfinddomain.com" only comes up when I'm entering personal data, even on new websites I've never been to before. It really seems like there's something on my computer that allows it to know that I am entering information and then it pops up.

I have installed the add-ons for WebOfTrust, NoScript, and now BlockSite: WOT, says "quizfinddomain.com" is not safe, I have the site listed as Untrusted in NoScript, but it still came up so now I added it to the blacklist of BlockSite. I have not seen it pop-up yet and I've tried logging into various sites to try it out, but I think I may just be masking the problem.

I will call the tech again tomorrow, but I think I need some more opinions.

I had Avast! Home Edition installed as well as SpyBot Seek & Destroy, but the tech uninstalled them and installed Symantec Endpoint Protection today. He certainly did clean up the computer as it's faster now then it's been in a while.

Sorry for the long post, and thanks for taking your time to read it... Any opinions would be hugely appreciated!

Thanks,

Matt

 

[KSoD]

The only thing I can suggest is to go through Spyware Asylum with the full guide for the OS in use. After that post up the logs of the scans and I will review them.

 

[Matthew_84]

Thanks KSoD for your quick response,

I'd like to point out something that I should have mentioned. The "quizfinddomain.com" is the main site that is causing me concern as it's the most frequent and seems to come up when inputting information, but another one came up last night on eBay when my mom simply clicked on an item to view it, and that site was "electricmustache.com".

When I clicked on the link that you provided, just now, the pop-up for "electricmustache.com" popped up as well, again. Obviously, I'm apprehensive about continuing to download this program.

But I still am thankful for your help.

 

[Matthew_84]

Sorry KSoD,

I do appreciate that you would review the scan log to see if there's anything that catches your eye. I just don't feel safe using that site. The window that opened up when I went there makes me believe the site is not completely secure, and running a virus scan of my computer through that site does not seem safe to me. Is there any other program you can recommend? Or any other ideas to suggest?

Thank you,

Matt

BTW: Forgot to mention, my OS is Windows Vista

 

[KSoD]

Well the choice is yours. I know the site is safe, I helped build it. I know everything it contains. There is absolutely no virus, spyware or anything on that site. Why would I redirect people to that site for removal if it is just going to infect them? That makes no sense at all. You want to be paranoid and not try anything to remove the infection yourself, I cant stop you. Anything will require you to download software. all of which is going to take you right back to this very same loop. Take it to a shop since you don't trust anyone enough to try and assist you.

 

[Acadien116]

Hi Matthew,

I had the same problem as you with that annoying pop-up (except I was the Quebec winner of the day...).

Here's what I did to remove it:

1. I used the link provided by KSoD and did the Combo Fix process

2. I did a rootkit scan with AVG anti-virus. It founds two rootkits : Rootkit.TDSS.TDL4 and IRP hook/Driver... etc.

3. I used TDSSKiller.exe. You can find it here: How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

4.After a reboot I did an AVG rootkit scan again, the two rootkits were gone.

Now my computer run at a much faster pace and there's no more annoying pop-up. If you don't want to have it again, I suggest you block third-party cookies in your Firefox and Explorer Internet options. You can only do that once you got rid of the rootkit because one of it features is to constantly change your Internet settings.