iopman

I hate to admit defeat but i give up! That is to say, thank you for all your efforts, but we don't seem to be close to a solution. I have just spent the past few hours restoring the operating system from a 2 month old back up (my data is on a separate drive) - I am now doing all windows updates and other updates. A brute force solution but one that hopefully will work. Thanks for all the time you put into this project. If you have any other "theoretical" ideas on this particularly difficult to eradicate malware, please let me know. Again thanks. Paul

somehow some of our interchange has diasppered from this forum set of postings in any case here is the latest scan from malwarebytes and farbar test 3.txt Addition.txt Fixlog.txt

here are the latest Farbar logs still getting the popups Paul Addition.txt Fixlog.txt

got same popup message with extensions disable just now at 112 pm

ok i have disabled them all the pop up that we have been tracking occurs intermittently, essentially randomly, so it may take time until i can determine if it is still occuring Paul

here are my extensions again known items, nothing changed recently

only when firefox is opened i have attached a .jpg with the plug ins that i use nothing new none of them are likely cuprits

i have just done some research and I think i was able to add a blocking rule in NOrton to prevent inbound and outbound communication with that IP address but that would just be a workaround i want to rid myself of the malware that is causing firefox to try to go to that web / ip address any other suggestions?

you can see in the log that Detection, 3/6/2015 7:34:36 AM, SYSTEM, ALIENWARE, Protection, Malicious Website Protection, IP, 208.43.117.244, data.rtbfy.com, 57170, Outbound, C:\Program Files (x86)\Mozilla Firefox\firefox.exe, was detected numerous times

here is the latest protection log Malwarebytes detection log.txt

Unfortunately, problem still exists.While watching a Netfix movie using Firefox tonight about 8 05 pm EST, the same pop up from Malwarebytes Premium reared its ugly head the browser was blocked from data.rtbfy.com at IP address 208.43.117.244 any other thoughts i know some other malwarebytes users have posted same exact problem on this forum but i cannot figure out if and how the problem was solved

okay firefox was uninstalled and reinstalled took me some time as i had to also reinstall Roboform and synch firefox with android devices now all up and running let us see if i get the pop up box which is of course only intermittent thanks for all your help i will report back to you either way off to airport to pick up wife more later Paul

sure i will remove it and reinstall it thanks

Just ran FARBAR as you directed. Attached is the FIXLOG.TXT. I note thatthe pop-up box message I have been getting referred to FIREFOX - and that FARBAR seemed to be fixing CHROME as far as I can tell, which was not the browser with the problem. But of course i am not really sure what was fixed by FARBAR, so I am agian in your good hands. What's next kind sir? Paul S Fixlog.txt

I am not at home today until late this evening I will work on this tomorrow mid morning Friday thanks very much for your assistance Paul