MBAM Removed Conduit Search. Antivirus Still Won't Startup

[Mattlock]

I really need to get this thing back to it's owner. So if you could get someone to take over, that would be great. Thanks for all your help and enjoy your vacation.

[AdvancedSetup]

I've asked one of the other Helpers if they can take over this topic so hopefully they will reply by early tomorrow.

 

As soon as you can though please find out about Trend as I think it's probably corrupted and a clean removal and reinstall will probably fix it.

 

 

Cheers

[Mattlock]

I will do as you ask & uninstall it and run AVAST, when I get back in this evening.If she needs to reinstall a couple of things when I give it back to her, so be it. Better than having to reinstall everything, due to resetting to factory settings

[kevinf80]

Hello Matllock,

 

I`m kevinf80 one of the helpers, i`ll be taking over whilst Ron is on vacation. Can you give me an update on the current status of the system, make me aware of any remaining issues or concerns.

 

Not sure how advanced you are with the uninstall of TM and install of Avast, if possible still remove TM, they do have a removal tool available at the following link:

 

http://esupport.trendmicro.com/Pages/How-do-I-remove-old-or-new-versions-of-Trend-Micro-products-in-my-comp.aspx

 

If possible do not install Avast, for now use the resident security Windows Defender. As the OS is Windows 8; Windows Defender differs to other versions available for Windows 7, Vista etc, W8 version does have Anti-Virus components, I use it myself. If you`ve progressed and installed Avast that is OK...

 

Kevin..

[Mattlock]

Hello Kevin,

 

I have uninstalled TM and updated WD. I think we were close to being clean, but TM wouldn't start and I keep dropping my internet connection. Also, I still see a couple of items that were identified during some of the scans, that Ron had me run, in the add/remove programs list. I just want to make sure the system. She is computer savvy, but not security savvy. I don't want to going through this again after returning it to her. So, I'm willing to start from scratch and run any scan you want to insure the system is clean. My answer to fighting virus and malware is a restore to build date, so I won't go through this twice. When it's returned to her, I'll educate her on security, backing up important data and will have MBAM Pro installed. 

 

Thanks for your assistance and I await your instruction.

[Mattlock]

Also, the Citrix software that Ron had ask about was used at her old job and is no longer needed.

[Mattlock]

Scan with WD, nothing found.

[kevinf80]

The best start to make is remove/uninstall any software that is no longer used, such as Citrix. I see no reason to keep what is no longer needed.

 

When that action is completed run the following scan:

 

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save that zip file to your Desktop.

 

Double click zip file and extract to your  Desktop:

 

 

 

 

you will now have 3 versions of the tool on the Desktop:

 

 

 

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/]

 

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

 

 

 

 

Copy and paste the following script from the code box and paste into the field.

 

 

standardsearch;autoruns;autoclean;emptyclsid;emptyalltemp;installedprogs;

 

 

Select the "Run Script" tab. The following window will open:

 

 

 

 

 

 

Please be patient and do not use the PC when the scan is in progress.

 

When complete you maybe asked to re-boot your PC, if so please do

 

 

Post the produced log in your next reply, also give an update on any remaining issues or concerns....

 

I`m actually in the UK, my local time is 1:30 am, i`ll only be online maybe 30 mins then its sleepy time.... I will catch up later maybe 9:00 am my time...

 

Kevin....

[Mattlock]

No time this morning to complete this task, I'll be back home in about 14hrs will get it done then.

[kevinf80]

Ok will catch up later. Where are you based, I`m in the UK, be good to know what time difference is...

[Mattlock]

Running ZOEK now. I'm in the US, Eastern Standard Time. Leave for work at 5am get home between 5 & 7pm. Usually in bed between 9 & 10pm.

[kevinf80]

Thanks for the update, post the log whenever you`re ready. I must be about 5 hours ahead of you.

[Mattlock]

Log is too long to paste. When I opened IE it said an unknown program want to change by default search provider to Google. Also, after being on this site for a couple minutes I got this website has expired and had to reload.

zoek-results.txt

[kevinf80]

how is your system responding, are there any remaining issues or concerns. Zoek does reset IE to default, is that causing problems for you

[Mattlock]

To be honest, it's not my system so I only used it during this cleaning process. Seems to be okay, not dropping internet like it has been. I just need be 100% sure that it's clean before I return it to my sister.

[Mattlock]

Also, I can understand ZOEK resetting IE to default, but that doesn't explain what was trying to change it on the 1st run.

[kevinf80]

Can only assume some setting/plugin within IE attempts to go back to Google, I would assume that will not be anything Malicious....

 

Go to this link; http://support.microsoft.com/kb/923737 expand the plus + options and run a reset of IE, restart and see how it responds..

 

Next,

 

Run Malwarebytes, check for updates, run a quick scan. Post that log.

 

Next,

 

Download OTL from any of the following links and save to your desktop.

 

http://itxassociates.com/OT-Tools/OTL.com

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassociates.com/OT-Tools/OTL.scr

 

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)

 

• 
  

  When the window appears, underneath Output at the top, make sure Standard output is selected.
Select Scan all users
Change Drivers to All
Under the Extra Registry section, check Use SafeList
In the lower right corner, checkmark "LOP Check" and checkmark "Purity Check".
Click Run Scan and let the program run uninterrupted.
When the scan is complete, two text files will be created on your Desktop.
OTL.Txt <- this one will be opened
Extras.txt <- this one will be minimized

 

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of OTL.Txt and the Extras.txt in your next reply.

 

Post those logs, let me know if you have any remaining issues or concerns...

 

Kevin


 

[Mattlock]

ok. I should be home a little earlier tomorrow. Will run the scans at that time and post the results. Off to bed for now. Have a great night.

[kevinf80]

Early morning for me,,,, I`m at 02:30 am local time so will be calling time myself, catch up later......

[Mattlock]

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.01.10.09

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
PurpleKat :: PURPLEKATPC [administrator]

1/10/2014 6:02:31 PM
mbam-log-2014-01-10 (18-02-31).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 208829
Time elapsed: 5 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[Mattlock]

OK, post too long so I'm attaching the files. Internet is a bit slow.

OTL.Txt

Extras.Txt

[Mattlock]

internet is slow, but does seem to be staying connected now.

[kevinf80]

Those logs are clean, I see no malware or infection traces. What do you mean by slow internet, have you done a speed check...

[Mattlock]

Posting to this site on that PC is slow, but on my PC very snappy.

[kevinf80]

Websites can be very busy and affect your connection. I cannot see anything wrong with last logs, no malware/infection... Do have any remaining issues or concerns?