No Internet/can't right click to run as admin

Discussion in 'Malware Help (A Specialist Will Reply)' started by moximus, May 18, 2014.

  1. moximus

    moximus Private E-2

    First off, this is my sister's laptop. It is running Windows 8 (I'm not very familiar with it). She was complaining that Outlook has stopped working and she couldn't use the Shutterfly website anymore. I updated Windows as far as I could, but then the internet stopped working...I could connect to the network but no internet access. Tried several different networks.

    I followed all the instructions in Read & and Run Me first. The internet seems to work now if I restart the computer but stops again shortly there after. I did disable the UAC but I am unable to right-click on any of the programs to run as admin. When I try it just closes the window.

    I've attached the logs and will await further instructions.

    Thanks so much in advance!
    Mox
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Uninstall the below using Revo Uninstaller.

    • MapsGalaxy Internet Explorer Toolbar
    • ShopAtHome.com Helper



    http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:

    • [RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : ShopAtHomeWatcher (C:\Users\Paula\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe [7]) -> FOUND
    • [RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : ShopAtHomeUpdater (C:\Users\Paula\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe [7]) -> FOUND

    Place a checkmark next to each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.




    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    • O2 - BHO: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\PROGRA~2\MAPSGA~2\bar\1.bin\39bar.dll
    • O2 - BHO: Search Assistant BHO - {9b9dcae3-be34-424c-8d73-75e305a9e091} - C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcSrcAs.dll
    • O2 - BHO: Toolbar BHO - {dc9051c2-8f55-479a-97a4-747980d9047f} - C:\PROGRA~2\WEATHE~2\bar\1.bin\gcbar.dll
    • O3 - Toolbar: WeatherBlink - {f20de5e0-2a6e-4c54-985f-1cf59551ce39} - C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcbar.dll
    • O4 - HKLM\..\Run: [WeatherBlink EPM Support] "C:\PROGRA~2\WEATHE~2\bar\1.bin\gcmedint.exe" T8EPMSUP.DLL,S
    • O4 - HKLM\..\Run: [WeatherBlink Browser Plugin Loader 64] C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcbrmon64.exe
    After clicking Fix exit HJT.





    Download and run OTM.

    Download OTM by Old Timer and save it to your Desktop.


    Code:
    :Files
    C:\Users\Paula\AppData\Roaming\ShopAtHome
    C:\PROGRA~2\MAPSGA~2
    C:\Program Files (x86)\WeatherBlink
    
    :reg
    [-HKU\S-1-5-21-3553271185-3370969851-1795781720-1001\Software\Microsoft\Internet Explorer\SearchScopes\{26AEFAD3-AB68-4C95-A75F-9858146C71A7}]
    [-HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}]
    [-HKU\S-1-5-21-3553271185-3370969851-1795781720-1001\Software\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}]
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\Run]
    "MapsGalaxy EPM Support"=-
    "MapsGalaxy_39 Browser Plugin Loader 64"=-
    "WeatherBlink EPM Support"=-
    "WeatherBlink Browser Plugin Loader 64"=-
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{26AEFAD3-AB68-4C95-A75F-9858146C71A7}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}]
    
    :Commands
    [emptytemp]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it into a text file to ATTACH into your next reply.

    NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.



    http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.



    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
  3. moximus

    moximus Private E-2

    Ran Revo Uninstaller and deleted MapsGalaxy Internet Explorer Toolbar but ShopAtHome.com Helper was not listed there?

    Ran RogueKiller.exe but neither of the items you listed were there so I took no action.

    Ran C:\MGtools\analyse.exe got this error:



    "For some reason your system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may NOT be able to fix this.

    If that happens, you need edit the file yourself. To do this, click Start, Run and type:

    notepad C:\WINDOWS\System32\drivers\etc\hosts

    and press Enter. Find the line(s) HijackThis reports and delete them. Save the file as 'hosts.' (with quotes), and reboot.

    For Vista and above: simply, exit HIjackThis, right click on the HijackThis icon, choose 'Run as administrator'.



    MGTools continued - Fixed everything you listed except "O2 - BHO: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\PROGRA~2\MAPSGA~2\bar\1.bin\39bar.dll" because it wasn't there.

    Ran OTM - no issues

    Ran JRT - no issues

    Other than the issues mentioned above I still have no internet and when I right-click to "Run as Administrator" nothing happens so I wasn't able to run any of those programs as admin.

    Thanks,
    Mox
     

    Attached Files:

  4. moximus

    moximus Private E-2

    Sorry I posted my reply twice...I was too slow reading the text about it not appearing until a moderator approved it the first time around so I posted it again.

    Mox
     
    Last edited: May 18, 2014
  5. moximus

    moximus Private E-2

    Sorry I thought I posted this before but it did not appear.

    Ran Revo and uninstalled MapsGalaxy but ShopAtHome.com Helper was not listed

    Ran RogueKiller but neither line you listed was there so I took no action.

    Ran MGTools and got this error:

    For some reason your system denied write access to the Hosts file. If any hujacked domains are in this file, HijackThis may NOT be able to fix this.

    If that happens, you need edit the file yourself. To do this, click Start, Run and type:

    notepad C:\WINDOWS\System32\drivers\etc\hosts

    and press Enter. Find the line(s) HijackThis reports and delete them. Save the file as 'hosts.' (with quotes), and reboot.

    For Vista and above: simply, exit HIjackThis, right click on the HijackThis icon, choose 'Run as administrator'.


    Fixed everything except the first item you listed "O2 - BHO: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\PROGRA~2\MAPSGA~2\bar\1.bin\39bar.dll" because it was not there.

    Ran OTM - no issues

    Ran JRT - no issues

    Besides the issues listed above I am still unable to right-click and "Run as Administrator" so I had to run all those programs by double left-clicking. The internet is still not working either.

    Thanks,
    Mox
     

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Not seeing alot left to do in this forum. You will most likely have to post about your remaining issues in the software forum.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds