Still not sure of Malware removal with XP Pro

S14 · Feb 12, 2014

Hi Geeks!

I have been trying to resolve several issues which began with slow downloading and Google redirect issues in Firefox; Office 10.(XP Pro) Excel which returns "Microsoft Visual C++ Runtime Library runtime Error" C:\Program Files\Microsoft Office\Office 10\Excel.exe Among others.

I followed your extensive pages on Malware running all on the "Read and Run" page and logging as directed. I did follow the pages on Google Redirection removal, and i surmise that has solved that problem.

I am not sure that I have removed all the malware, as in some places you recommend that I NOT clean the malware, just send the logs....but figure I cannot repair the Excel or other problems without first being sure that I have removed the threats.

Will you please review the log files and / or direct me to the next steps?

I have used the Belarc advisor should you need that detail too.

Kind Regards

XP Pro w/MS updates

TimW · Feb 12, 2014

Please rerun MBAM and have it fix what it found.

Then rerun Hitman and have it remove all the:
Potential Unwanted Programs

Finally, rerun RogueKiller and have it remove:
Code:
[RUN][SUSP PATH] HKLM\[...]\Run : shicoxp (C:\WINDOWS\shicoxp.exe [-]) -> FOUND
Reboot and rerun both RogueKiller and Hitman and attach both those logs.

Let me know how things are runnning.

S14 · Feb 12, 2014

Hi;

I followed your proceedures and have the logs attached.

From the reading I, I believe that I must now toggle system restore; and delete any backups on my NAS, then create a new backup before continuing to solve my other problems?

Thank you!

TimW · Feb 13, 2014

Your RogueKiller log is clean but you did not remove the PUP's in Hitman.

S14 · Feb 13, 2014

Thanks for your prompt reply.

I believe I got the PuPs, but have no idea what the "Conduit" and "Rocketfuel" programs are.

Rocketfuel seems to be a part of "conduit" having to do with Facebook.

I don't do Facebook.

Conduit shows up in Program files as C:\program files\conduit\community alerts\alert.dll and also as shown in the log.

Rocketfuel? Not in Program files

I don't recall installing them.

I would prefer to delete them if they are not needed, but they do not show up in "add and remove programs".

Recommendations?

Thanks!

Kind Regards

TimW · Feb 14, 2014

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Now reboot and rescan with Hitman and attach the new log.

S14 · Feb 14, 2014

Done!

Thank you and Kind Regards,

S14

TimW · Feb 14, 2014

See if you can remove that one last PUP in Hitman.

S14 · Feb 15, 2014

I think I got it.

-Best

S14

TimW · Feb 15, 2014

You're welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

S14 · Apr 9, 2014

Hi Geeks;

I had to be away for a while, but finished the recommendations from your last post. When I went to copy some files to the CD (Sony CRX-145E)and DVD (Plextor PX-755SA)drives, I received the message / Error:

D:\ is not accessible. Incorrect function

The drives will read a disc with files on it, but not able to drop files into the open empty window nor write to a blank disc.

I remembered using Defogger and re-enabled via that program again to no avail.

I checked the device manager, both "working properly" in the General tab.
Plextor:
Driver date 7/1/2001. Ver: 5.1.2535.0 (Microsoft)

Sony:
Driver date 7/1/2001. Ver: 5.1.2535.0 (Microsoft)

But didn't venture beyond that as I didn't want to mess up anything that Defogger may have done.

Suggestions?

Kind Regards,

S14

TimW · Apr 10, 2014

The issues you are having are not malware, so I suggest you post in the software forum for further assistance.

Log in or Sign up

Still not sure of Malware removal with XP Pro

S14 Private E-2

Attached Files:

MBAM-log-2014-02-11 (14-43-05).txt

RKreport[0]_S_02112014_101513.txt

MGlogs.zip

TDS Killer scan 2-11-2014.txt

HitmanPro_20140211_1724.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

S14 Private E-2

Attached Files:

HitmanPro_20140212_1604.log

RKreport[0]_S_02122014_154715.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

S14 Private E-2

Attached Files:

HitmanPro_20140213_1415.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

S14 Private E-2

Attached Files:

JRT.txt

HitmanPro_20140214_1055.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

S14 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

S14 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member