Suspect Malware

enathe3 · Oct 9, 2015

I have read all information on the read first pages and downloaded all scanners. I have run all the scans and this is my first time posting. Computer started a month ago with the Task manager not displaying Explorer. Everything seemed fime but high memory usage. Computer began slowing with a number of Internet Explorer and Mozilla crashes. Some crashes while running program files, delayed openings. After three seperate System restores MG suggested a tool, AVIRA. I eliminated Bullgaurd and ran AVIRA with it finding "TR/Spy.2951336" and "TR/Crypt.XPACK.Gen7" and quarenteend them. I disabled that program and followed all your instructions.

Kestrel13! · Oct 10, 2015

Hi there

Still need to see the log from Hitman Pro and the MGlogs.zip from running MGTools.exe please.

enathe3 · Oct 11, 2015

Hello and thanks!
I put the Hitmanpro in the wrong spot. I made a number of mistakes when first running Hitmanpro, I hope this is the right information this time. I never got any windows identifying a virus. I just screwed up the last MGtools log. It is running again. I will send again but now its out of sequence. Sorry:confused

enathe3 · Oct 11, 2015

Hello again,
I reread the instructions on MGTools and I am attempting to send it again. Tell me if I screw it up again.

Kestrel13! · Oct 12, 2015

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode. Any other mode is primarily used for troubleshooting and diagnostic purposes. You should look into some third party software to control start up's.

Is there anything you wish to keep that Hitman is finding? (Coupons and Yahoo toolbar)

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{1DC01662-EE3E-4009-9958-A398B3515D65}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1DC01662-EE3E-4009-9958-A398B3515D65}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AFA0049B-043E-43CD-8055-521A8D0AA662}]
Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know about what Hitman is finding....

enathe3 · Oct 12, 2015

Good day.
Once I double click I get a warning window about proceeding with caution but when I say go ahead I get this Error Msg. " Cannot import C:\users\Mom n Dad\Desktop\fixME.reg. The specified file is not a registry script. You can only import binary registry files from within registry editor."
Did I do something wrong? I copied to notebook saved as fixME.reg, all files and desktop. Tried second time and included *REGEDIT4 but got the same result.

Kestrel13! · Oct 12, 2015

Just continue on with the other instructions

enathe3 · Oct 12, 2015

Attached two items. I couldn' remember how to do MG files.

Kestrel13! · Oct 13, 2015

I told you how to run MGTools. I'd like to see a FRESH MGLogs.zip please.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
Click to expand...

enathe3 · Oct 13, 2015

OK. Got it this time. My desk top had three zip files so I looked for the one just created. this should be it. I will watch for your repliy. I thank you very much for all the time you have given me.

Kestrel13! · Oct 13, 2015

You need to let me know about what Hitman Pro is finding when you scan with it. Is there anything you want to keep?

enathe3 · Oct 13, 2015

No there is nothing I want to keep that Hitman Pro has found. (coupons and yahoo tool bar) Definitely no. Nothing.:-D

Kestrel13! · Oct 13, 2015

Uninstall Coupon Printer for Windows and Yahoo Toolbar then re run Hitman Pro again and attach log.

enathe3 · Oct 13, 2015

Done. No entries. Clean scan I think. I had to use a third party uninstaller to remove the coupon printer (revo uninstaller).

Kestrel13! · Oct 14, 2015

Excellent. How are things running now?

enathe3 · Oct 14, 2015

Things have been running much better. The computer starts faster, not so sluggish. I havent received any errors. Everything seems to run smoother. Again, Thanks. Whats next?

Kestrel13! · Oct 14, 2015

You're most welcome

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

enathe3 · Oct 14, 2015

Malwarebytes Anti-Malware, I will keep. What about an antivirus recommendation. I loaded Avira before contacting you. It keeps loading ad's, if there is an equivelant or better one I would switch. Though I liked some features its not a shoe in. Meantime I will go to work on your latest.
Note* FYI even though I am fixed income and my family relies heavily on the computer for school, you can bet I will continue to support MG. And I tell everyone. I don't trust anyone else out there for advice and tested software/advice.

Kestrel13! · Oct 14, 2015

What about an antivirus recommendation.
Click to expand...

I would go with Comodo free version.

Note* FYI even though I am fixed income and my family relies heavily on the computer for school, you can bet I will continue to support MG. And I tell everyone. I don't trust anyone else out there for advice and tested software/advice.
Click to expand...

Thankyou for the compliment on our website

Log in or Sign up

Suspect Malware

enathe3 Private E-2

Attached Files:

RKreport[1].txt from RogueKiller.txt

malware scanning log file report.txt

TDSSKiller.3.1.0.5_08.10.2015_22.04.57_log.txt

hijackthis.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Attached Files:

HitmanPro_20151009_0917.log

enathe3 Private E-2

Attached Files:

MGlogsR.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Attached Files:

JRT.txt

MGlogsR.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Attached Files:

HitmanPro_20151013_1436.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

enathe3 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member