Is "US Tech Support Framework" Malware?

EscapeCat · Jan 9, 2013

I'm taking care of my mom while she is going through a diagnosis of cancer, and will begin treatments soon. I want to be sure her computer is working well during this time, as she has been telling me for ages that she has had problems with it.

For a long, long time, when attempting to run McAfee scans, it freezes. I live in California, and she lives in Missouri.

When looking at her control panel, I am seeing called, "US Tech Support Framework." I am unfamiliar with it, and its rating on the WOT (Web of Trust) site is very poor. However, when I google it, I cannot tell for sure if it's bad or how to remove it. Being I know mom doesn't need it, I attempted to remove it from the Control Panel. A pop-up happens asking me to allow the "Unknown" program to run or not. It says it's an "update" when I click on DETAILS, and it asks if I trust it or not. This happens when I'm trying to REMOVE it, not update it. I don't want to click the wrong thing, so I always cancel that, and then it stops the procedure. If this is malware, I will go through the malware READ ME AND RUN ME FIRST steps. Please let me know if that is what I should do for this or not. (Though I am considering doing it anyway since her PC has been running so poorly.)

Thanks in advance.

Her specs:
Windows Vista Home Premium, SP 2
32-Bit Operating System
RAM 3.00

Kestrel13! · Jan 10, 2013

Yes I think it's undesirable. Follow the instructions for the R&R. READ & RUN ME FIRST. Malware Removal Guide

EscapeCat · Jan 11, 2013

Okay, I have run all the proper scans and the "US Tech Support Framework" remains on the system. I am attaching my logs to this post. I couldn't find the LOGS folder in MBAM, so I saved the log as a .txt in the document folder. I hope that doesn't mess things up. The only folders I saw in MBAM were Chameleon and Languages, no LOG folder??? :confused

Should I run McAfee again and see if it freezes as usual? Before these scans (last year, actually) she was having this problem, and I had tried uninstalling and reinstalling the program to see if it solved the problem, and it did not.

Also, this computer has a tendency to go into a sleep, or hibernation type mode during inactivity or scans, and won't "wake up" by pressing the power button. All I can do is hold the power button down (it's a laptop) and "kill" the laptop, then reboot Windows normally. Is that malware related? Or is that a different issue altogether that I should request help for elsewhere in this forum?

Anyway, thanks again, Kestrel, for looking into this matter. You helped me a couple years ago with my own laptop. (Sorry for all my questions. I will try to be less wordy with my next post.)

Thanks!

Kestrel13! · Jan 11, 2013

US Tech Support Framework <--- uninstall this.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - MRI_DISABLED - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O23 - Service: A - Unknown owner - C:\Users\Owner\AppData\Local\Temp\A.exe (file missing)

O23 - Service: AWLH - Unknown owner - C:\Users\Owner\AppData\Local\Temp\AWLH.exe (file missing)

O23 - Service: BLWVY - Unknown owner - C:\Users\Owner\AppData\Local\Temp\BLWVY.exe (file missing)

After clicking Fix exit HJT.

Delete these files if they show:

C:\Users\Owner\AppData\Local\Temp\A.exe

C:\Users\Owner\AppData\Local\Temp\AWLH.exe

C:\Users\Owner\AppData\Local\Temp\BLWVY.exe

Delete these folders if they exist:

C:\Users\Owner\AppData\Roaming\USTechSupport

C:\ProgramData\USTechSupport

C:\Program Files\USTechSupport

C:\Program Files\Common Files\USTechSupport

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

EscapeCat · Jan 11, 2013

Thank you for your reply.

I have followed your instructions. Some of the folders did not exist, but some did (most of the US Tech Support folders existed even after I uninstalled the program, but the other ones did not). I am attaching the new MGlogs.zip file to this post for your review.

Her computer is working, but is still sluggish/slow at times. I tried running her McAfee anti-virus (full scan) and it froze at 22% again, while scanning the Quick Time folders. The "quick scan" was able to scan to completion. I had nothing else running at the time the computer froze.

Thanks again for your assistance!

EscapeCat · Jan 11, 2013

Sorry for the double post, but I'm not able to EDIT my post at this point. I've been doing a few more things on mom's computer, and have been trying to update her Quicktime as she was on a website that needed it and it requested that she update it. We tried, and the computer froze again. I had to turn it off again and reboot. I went to apple's website and tried to update it again...but it froze again. I tried opening the task manager, and then was given a black screen with a white box in it that read:

"Logon process has failed to create the security options dialog.

Failure - Security Options

OK"

I was forced to click ok (and still have been unable to update Quicktime), and then had to "kill" the laptop yet again (as in I was unable to shut it down properly). I have never seen this error message before tonight. *sigh* I hope we can fix this soon for her, as I leave next Friday and I want her laptop working.

Thanks again.

Kestrel13! · Jan 13, 2013

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O23 - Service: FCTCDO - Unknown owner - C:\Users\Owner\AppData\Local\Temp\FCTCDO.exe (file missing)

After clicking Fix exit HJT.

Find this file and delete it. Any other files in this "Temp" folder can all be deleted too please.

C:\Users\Owner\AppData\Local\Temp\FCTCDO.exe

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

EscapeCat · Jan 14, 2013

Let me know what to do next, if I should try running the McAfee scan again, AND if I can try updating QuickTime again, too.

Also, when deleting all the files listed under:
C:\User\Owner\AppData\Local\Temp

I got the attached error message. But when I clicked TRY AGAIN, it said it couldn't be found and it appeared to me that all the contents I was deleting were, in fact, deleted. Just thought I should let you know about that, too.

Thanks again for your help!

Kestrel13! · Jan 14, 2013

The logs look good. I would suggest to you that you uninstall Mcafee > run Ccleaner to be rid of temp files (if you have it installed) and then reinstall mcafee. THEN see how it runs.

EscapeCat · Jan 14, 2013

Thanks. I did what you asked and McAfee still freezes about 23% through the full system scan. I noticed that it froze while scanning QuickTime stuff. And since I had issues updating QuickTime, I thought maybe I should uninstall QuickTime and try the scan again. Well, I go to uninstall it via the Control Panel, and as it's trying to uninstall, it freezes the PC about 1/4 of the way through the progress bar. I don't know what else to do, or how to fix this??? Any thoughts?

Kestrel13! · Jan 16, 2013

Yes, you can post about it in the software forum as it's non malware related.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Press and hold the Windows key and then press the letter R on your keyboard. This opens the Run dialog box.

Copy and paste the below into the Run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

EscapeCat · Jan 16, 2013

Thank you so much, Kestrel. I've followed the instructions, and her PC should be clean now. (Though my brother just went in and created a separate account for her - limited user account - and now everything is slow again. Argh. ) Anyway, I really appreciate your help, and have posted about my QuickTime issues in the Software Subforum. Thanks so much!

Kestrel13! · Jan 17, 2013

You're very welcome. Safe surfing!

Log in or Sign up

Is "US Tech Support Framework" Malware?

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Attached Files:

RKreport[1]_S_01102013_02d2257.txt

mbam-log-2011-02-13 (23-06-49).txt

TDSSKiller.2.8.15.0_11.01.2013_02.10.38_log.txt

HitmanPro_20130111_0219.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Attached Files:

MGlogs.zip

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Attached Files:

MGlogs.zip

Error Message.jpg

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Is "US Tech Support Framework" Malware?

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Attached Files:

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

EscapeCat Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches