Infected from "Office Toolkit 2.5.4"

[chugbug]

Hello All,

 

I have an infected pc that I need some help with.  I have a BRAND NEW HP Envy notebook that JUST purchased and my SON messed it up already!!!  While I was at work, he thought he'd surprise me by installing Office 2013 (at least that's the story I'm getting).  But he tried to install a program called Office Toolkit 2.5.4 to install Office, but when he stated installing the toolkit, it started installing a bunch of other stuff.

 

I disabled all the new stuff I could find in Startup so it would start up again, then ran through a group of scanners that he said should clean it up.  They seem to clean up all the installed programs, but not entirely resolve all the problems-- I seem to still have two major issues:

 

             a) I can't re-enable Windows Defender.
            b)  when I look in my folders, I find many of the important folders are shown as SHORTCUTS, and when I try to open them, I can't access them.

[chugbug]

Sorry, I hit the wrong button before I was finished (still getting use to the new keyboard).

 

I tried the following to clean my system:  

1. cleared my TEMP folder.

2. Ran TDSS KIller.

3.  RKill.

4.  MBAM.

5. HitMan Pro.

6. Adware Cleaner.

7. Rogue Killer.

8. Emissoft.

 

After running the various scanners I ran the FarBar scanner (but didn't run the FIX).  If you let me know how to post them, I can send the two txt files (First & Additional).  I can also supply snapshots of the folders with the shortcuts if they would be helpful.

 

Thanks...JEB

Any help you could offer would be appreciated.

[TwinHeadedEagle]

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

• We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• I volunteer to help you, so please, do not ask for help for your company/business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  Rules and policies

 

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

---

Please attach both FRST reports.

---

[chugbug]

Hi TwinHeadedEagle-- Thanks for replying to my inquiry.  I didn't see how to attached the files the first time, but found how to now, so they should be attached to this post.

 

I read over your "UA" and understand you may only be able to help to a point.  Based on the various scanners I've run (before running BarFar scanner) I don't think I'm infected anymore unless there's something really hidden deep that they can't get to.  I think the only issue remaining is getting my Windows Defender turned back on, and and fixing the the folder permissions.  So if you find you can't help, I'll understand.  Since the PC was new, I figured as a last resort, I could just reinstall everything again-- but I was hoping to avoid that since I finally got all the Windows updates installed.  But I want to upgrade it to Windows 10, so I need to make sure it's clean.

 

As far as any ill-legit stuff, as far as I know there isn't anything (except maybe anything the virus may have installed-- but if it is, I'd like to know that too).

 

About the folder permissions (In case it might be helpful)... I noticed in the folders that I can't access anymore that they all have a SECOND "everyone" user added to them with DENY access.

 

Thanks again for your assistance.  I look forward to hearing from you...JEB

JEB_FarBar_FRST.txt

JEB_FarBar_Addition.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.

  (XP users click run after receipt of Windows Security Warning - Open File).

• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

---

Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and let this process run uninterrupted.
• This scan can take a while, depending on your System specs.
• Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.

Do not forget to re-enable your previously switched off protection software!

Please also manually reboot your machine after this procedure.

fixlist.txt

[chugbug]

Hello,  Thanks again for the assistance!

 

Sorry for the delay in replying.  I had to go out of town on business unexpectedly.

 

When I returned booted my notebook back up today, Windows started installing a bunch more updates including the latest MSRT (it took over an hour before finally booting back into windows again).   So is it still OK to run fixlist?  Will it hurt to run it if MSRT made any changes?

 

Thanks again...JEB

[TwinHeadedEagle]

Yes, you can run FRST fix without problems.

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!