Microsoft Office problem or infection?

jjlincoln · Dec 14, 2009

Hello. I stated in the software thread the other day that for some time now we've had an update shield pop up in the corner saying there are updates ready to install. This update is Service Pack 3 for Microsoft Office XP. When it tries to update, it says that I need to insert the disk. We don't have the disk because the program was on the computer when we bought it.

Someone chimed in and said they had the same problem awhile back and were infected with Malware. I just ran through the Read Me First Guide and Malware Removal guide. The shield still is popping up. Can someone please look at my attached logs and let me know if you see anything suspicious?

Thank you in advance for your help!

jjlincoln · Dec 17, 2009

I understand there are only a handful of volunteers on this site, but I just wanted to make sure my post was not forgotten. I'm 7 pages back now and haven't heard anything. I really hope this doesn't come across as me being impatient. I REALLY appreciate the help you all provide. I just wanted to see if someone can help me, or if my name was at least on a wait list.

Thank you for your help.

TimW · Dec 20, 2009

Your bump put you back at the end of the line. You are now back on page 7, which is were we are working form at this time.

However, I am not seeing any malware on your system. Have you gone to the MS update page and had it scan your computer for updates?

Although I think it would be unnecessary to do, I would like you to download and run ComboFIx ( from the Read and Run First Instructions --> it had been removed for a period but is back up now.)

Then attach the C:\ComboFix.txt.

jjlincoln · Dec 20, 2009

I have gone to the MS update page (multiple times) and tried to run the update. I've posted the screenshot of where I get with that. However, up until today, I always thought you had to pay MS a lot of dough to help you with their software. I found a link today where I could email them and they're supposed to help me out. We'll see where that gets me. In the meantime, I've posted the ComboFix log. When I went through the malware removal guide it was down as you stated.

Thanks for your help.

TimW · Dec 20, 2009

Your combo log is also clean. I suggest you return to the software forum for additional assistance.

Sinceyou are not having any malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore ato create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Microsoft Office problem or infection?

jjlincoln Private E-2

Attached Files:

SASlog.txt

mbam-log-2009-12-14 (20-04-58).txt

RRlog.txt

MGlogs.zip

jjlincoln Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jjlincoln Private E-2

Attached Files:

screen shot.jpg

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member