Potential malware

mekkers · Feb 9, 2015

I'm trying to help my wife with her work computer and think there's malware on it. The first issue, which I already resolved, was her mouse not being able to click on the taskbar/startmenu. There was an installshield package in the msconfig startup that was blocking it. Now, I'm noticing svchost.exe consume a large amount of memory. RogueScanner seemed to pickup some windows processes that are infected.

Can you please take a look at my logs and let me know if she has a problem?

Kestrel13! · Feb 9, 2015

Re run Hitman and have it remove all that it finds. Then rescan again and attach new log.

There's nothing installed relating to this from what I can see so what is this folder for? Are you using any remote control software?

C:\Program Files (x86)\PJ Technologies

Re run RogueKiller too but don't let it fix anything, just a scan and attach log.

mekkers · Feb 21, 2015

I re-ran Hitman and it didn't find anything. It also appears that Hitman is no longer free because I ran it with the settings that Majorgeeks says and it wants me to pay for the software.

I've attached the RougeKiller log.

The PJ Technologies might be installed by the school district she works for. I tried to disable the service and had the same issue with the mouse. I changed from the wireless mouse that didn't work to a corded mouse and now the corded mouse is working but the wireless still isn't. Strange!

Kestrel13! · Feb 21, 2015

Not malware related. You should post about the mouse issues in softwrae forum.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Potential malware

mekkers Private E-2

Attached Files:

MGlogs.zip

RKreport_SCN_02082015_231657.log

TDSS.txt

HitmanPro_20150208_2311.log

malwarebytes.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mekkers Private E-2

Attached Files:

RKreport_SCN_02212015_151036.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member