Windows 7 / Phantom windows, phishing app?

When activating my laptop PC from "sleep" mode, a false warning window popped up saying "web browser" was running a script that seemed to be slowing it down and asking if I wanted to stop the script. I wasn't really paying attention, and the warning echoed real alerts I've received, so I clicked yes as I read it, then realized what was up, and frantically hit escape over and over to stop whatever it was. Then I tried to identify the process w/task manager but was unable to ID it. I had previously experienced "phantom windows" -- like the top bars of a basic Windows 7 window, but much smaller, in that old windows blue, with no window and no "x" button. I don't know if these are related. I have also experienced some lag and lots of freezing in browser windows, which I've blamed on the fact it's an older PC and I need to create some space on the hard drive. I run Avira. I ran scans with MalwareBytes and SuperAntiSpyware, but got nothing.

Any help to figure this out would be appreciated!

Hello blues71,

Welcome to the forum!

I am pgmigg and I'll be helping you with any malware problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.

1. The instructions being given are for YOUR computer and system only!
   Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
2. You must have Administrator rights, permissions for this computer.
3. DO NOT run any other fix or removal tools unless instructed to do so!
4. DO NOT install any other software (or hardware) during the cleaning process until we are done as well as
   DO NOT Remove, or Scan with anything on your system unless I ask. This adds more items to be researched.
   Extra Additions and Removals of files make the analysis more difficult.
5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
8. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!"
   Absence of symptoms does not mean that everything is clear.

I am currently reviewing your logs and will return, as soon as possible, with additional instructions. In the meantime...

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.

Please read all instructions carefully before executing and perform the steps, in the order given.
lf you have any questions or problems executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start


Failure to post replies within 72 hours will result in this thread being closed

Understood. Thanks!

Hello blues71,

Step 1.
Create a Backup With Tweaking.com Registry Backup (TCRB)
There is also a tutorial with pictures available HERE.

1. Please download TCRB from HERE and save it to your Desktop.
2. Double-click on tweaking.com_registry_backup_setup.exe and follow the prompts to install TCRB.
3. Launch TCRB.
4. Click the Backup Registry tab and make sure all the boxes are checked.
5. Click on Backup Now.
6. Once the backup is finished you can now exit the program.

< STOP > Do not proceed any further if you were not able to create a registry backup. Post back with what happened so we can determine why it was unsuccessful.

Step 2.
Run CKScanner

1. Please download CKScanner from here
2. Important: - Save it to your Desktop.
3. Double-click CKScanner.exe and click Search For Files.
4. After a very short time, when the cursor hourglass disappears, click Save List To File.
5. A message box will verify the file saved.
6. Double-click the CKFiles.txt icon on your Desktop and copy/paste the contents in your next reply.

Step 3.
TSG - SysInfo utility

1. Please download SysInfo.exe and save it to your Desktop.
2. Right click SysInfo.exe and select "Run As Administrator" to run it... if UAC prompts, please allow it.
3. The small square window will be opened with already highlighted text - please right click on it, select Copy and then paste it in your next post.

Then:
Please tell me is this computer used for business or educational purposes and connected to a business or educational networks?
I need to know it - so I can provide the proper instructions.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of CKFiles.txt log file
3. Contents of TSG - SysInfo utility
4. Answers to my question related to type of using of your computer

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

I was able to complete the instructions without a problem.
I use this computer for business, but I am an independent contractor. I work alone. It is the only computer on my home wifi network, along with other devices.

Here's the info:

CKScanner 2.5 - Additional Security Risks - These are not necessarily bad
c:\program files (x86)\cyberlink\powerdvd9\navfilter\kmsvc.exe
c:\program files (x86)\gimp-2.0\share\gimp\2.0\patterns\cracked.pat
scanner sequence 3.AA.11.MKAPOZ
----- EOF -----

Tech Support Guy System Info Utility version 1.0.0.4
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz, Intel64 Family 6 Model 42 Stepping 7
Processor Count: 4
RAM: 4011 Mb
Graphics Card: Intel(R) HD Graphics 3000, 1813 Mb
Hard Drives: C: 454 GB (36 GB Free);
Motherboard: Sony Corporation, VAIO
Antivirus: Avira Antivirus, Enabled and Updated

Business Use / Illegal software
It appears you are using your computer for business purposes and/or you used illegal software.

May I draw your attention to the topic: ALL USERS OF THIS FORUM MUST READ THIS FIRST, which you should have read before posting for help.

The section here explains why we do not offer help for such computers. Thank you for your understanding.


This topic is now closed.