Possible virus or malware?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by fuzzydi, Mar 16, 2015.

  1. fuzzydi

    fuzzydi Private E-2

    Started having weird stuff happen on a work computer last week. Some icons were gone from the desktop and many programs wouldn't open - Adobe Acrobat, Google Chrome, Internet Explorer, to name a few. When I tried to reinstall Acrobat, I got a message "Error 1719 Windows Installer service could not be accessed". Other errors appeared like "the parameter is incorrect" or "nlaapi.dll is either not designed to run on Windows or it contains an error". I also got an error - "gdiplus.dll is either not designed to run on Windows or it contains an error. Try reinstalling the program again..." (this was when I tried to open Carbonite).

    This computer is used with a large format plotter and it looks like the plotter is ready, but nothing ever prints. There is some kind of error on the pc itself (when looking under 'Printers and Devices'). There's an exclamation point and when I allow Windows to try and fix the error, it says something about a problem with the driver for Teredo Tunneling Pseudo-Interface, but it doesn't fix it. I tried using System Restore to an earlier point when things were working right, but it didn't help. I thought perhaps the problem was caused by a Windows Update. After a restore didn't work, I re-applied all the Windows updates and ran your scans. I already have the paid, corporate version of Malwarebytes, so my interface was slightly different than the READ ME instructions. I did a full scan and will attach that log. Most everything is reinstalled now and seems to be working, but a tech that was trying to help me with the plotter suspects a virus or malware....hence my visit to majorgeeks. A few items were suspect by Hitman Pro, but I'm not sure they are truly a problem. I run Malwarebytes and Panda Cloud Antivirus. Do you see anything suspicious? System is running Windows 7 Pro, 64bit, Intel Zeon processor, 20GB ram.

    Thanks in advance for any help/advice you can give!

    Diane
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Based on your logs it does not appear to be malware. However your log from MGtools is extremely incomplete. Did you have a problem running it? Did you have your protection disabled and did you have UAC disabled?

    There was a little junkware visible so let's take care of it.

    Please download AdwCleaner by Xplode and save to your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
      Vista/Windows 7/8 users right-click and select Run As Administrator
    • Click on the Scan button.
    • AdwCleaner will begin...be patient as the scan may take some time to complete.
    • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
    • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
    • Attach the logfile to your next next reply.
    • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
     
  3. fuzzydi

    fuzzydi Private E-2

    You know, the first time i tried to run MGTools, it stopped early in the process and would not move forward. I had my antivirus off, but I had forgotten about Malwarebytes. So I closed MGtools, then closed MWB, then ran MGTools again. It ran completely, so not sure why the report was so incomplete. I ran it again this morning and have attached the zip file.

    I also ran the AdWCleaner. There were a few things in its report. I have attached the log file, but I didn't want to delete/remove anything until I hear from you.

    Thanks!
    D
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Run AdwCleaner again and locate the below items and select them. Allow AdwCleaner to fix them.

    ***** [ Registry ] *****
    Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
    Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}


    Then reboot your PC. After reboot, run a new scan with AdwCleaner and attach the new log.
     
  5. fuzzydi

    fuzzydi Private E-2

    Sorry this took so long...I wasn't in the office yesterday. :) I have attached a new AdwCleaner log.

    Diane
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay that looks better. Are you still having any problems?
     
  7. fuzzydi

    fuzzydi Private E-2

    No. Things seem to be working fine now. I think my initial issues stemmed from a buggy windows update. My system restore helped for a while, until they must have issued a fixed update. Thank you so much for helping me clear things off the system. I'm keeping the downloaded software and running it on occasion :)

    Diane
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Your logs are clean. Please complete all of the below final instructions before running any other scans to avoid false detections of things we have already quarantine or left overs from system restore.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore
      • For Windows 8 and 8.1 system restore see this link: Win 8 System Restore - How to enable/disable
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds