[ndskykng]

Hmm.  I tried rebooting and restarting Crypto.

 

Now it asked me about Windows Sidebar, etc.  

 

I clicked yes like you said.

 

Weird it asked on the second start of the program and not on the initial install.  Oh well.

 

Hey thanks for your patience on all this, I know this has taken several hours and I appreciate your expertise on this.  I love how fast Chrome is again.

 

Working on earlier posts while waiting.  Regarding crypto protection, not sure if its big deal, but it seemed to skip steps 6 and 7

 

 

• You will then be prompted to apply all default protections. Answer Yes.
• You may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.

 

Just went from asking about automatic updates/purchasing key to the program opening.  I think I'm protected now, but just letting you know I never got those steps.

[Advertisements]

Hey, on that note, I'm about to lose power here (planned blackout due to a breaker issue).  We can continue this tomorrow.  But things are much better with the browser thank you.

[ndskykng]

Hey, on that note, I'm about to lose power here (planned blackout due to a breaker issue).  We can continue this tomorrow.  But things are much better with the browser thank you.

[BrianDrab]

No problem at all. Let's try this. I need to check something real quick.

 

1. Right-click on your Start button and select Command Prompt (Admin)

2. Copy and Paste the following into your command prompt window. You will have to right-click your mouse in the command-prompt window and choose paste to paste it in.

    reg query HKCU\Software\Microsoft\Office\15.0\FirstRun

3. Hit enter and you will have an output in the window like the following. Let me know if the last digit is a zero or a one.

 

BootedRTM     REG_DWORD    0x1

 

[BrianDrab]

OK, talk to you tomorrow.

[ndskykng]

Thanks.  Last digit is a 1

[BrianDrab]

Let's try the following.

 

1. Make the issue happen again where "Welcome to Outlook 2013" comes up. Don't close the screen however. Leave this up.

2. Download Procexp.exe and save to your desktop.

3. Right-click on Procexp.exe and select Run as administrator. Note: It's important to do this step exactly this way.

4. Select the View menu and choose Select Columns.

5. Check Command Line, Autostart Location and Image Path and click OK.

6. Hit the Save button on the toolbar and save the text file to your desktop.

7. Please post the contents of this text file.

 

Thank you.

[ndskykng]

I can't seem to make the error occur.  Maybe I need internet for Outlook 2013 to come up on startup.  I'm at work again.  I'll try it at home.

 

Meanwhile, I had a question before declaring my system clean.

 

I have about 3 or so USB external drives that I use for important documents, spreadsheets, old photos, etc.

 

But I know Ive also used it to download occasional TV episodes and movies when I was using P2P and Bittorrent.

 

Is it possible for viruses/malware to "hide" out in USB drives?

 

And if so, should I run any scans and send them to you so it doesn't cause issues when I plug it in?

[BrianDrab]

I can't seem to make the error occur.  Maybe I need internet for Outlook 2013 to come up on startup.  I'm at work again.  I'll try it at home.

 

OK.

 

Is it possible for viruses/malware to "hide" out in USB drives?

 

And if so, should I run any scans and send them to you so it doesn't cause issues when I plug it in?

 

 

Absolutely. What I would suggest is to install the following program on your computer. Then when you plug in a USB drive it will be scanned before you can access it.

 

 

 

Step#1 - Prevent Spread of Infection via USB Drive
1. Download MCShield to the desktop of your clean computer and install. Accept all the defaults.
2. The MCShield Control Center will open at the end of the install after clicking Run.
3. Click on the scanner tab and tick Always unhide items on flash drives and click on the Apply button to save the changes.

4. Plug in your USB drive and McShield will start a scan.
5. Once the scan is complete, click the Logs tab and scroll down to the bottom of the log. If it says anything other than "The drive is clean" then please copy the log and paste it in your next reply. Other than that it's likely clean.

[ndskykng]

Two drives, both with log files.  The third one was clean.

 

Do I need to do any rescans of the computer itself to ensure it's still clean?

 

 

 

MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

 

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 8.1 <<<

 

 

2/13/2015 9:03:37 AM > Drive H: - scan started (Seagate Backup Plus Drive ~932 GB, NTFS HDD )...

 

>>> H:\autorun.inf > Suspicious > Renamed. (MD5: 8dea303ee9370ea48d29e780eb5c41f0)

 

 

=> Suspicious files  : 1/1 renamed.

 

____________________________________________

 

::::: Scan duration: 1sec ::::::::::::::::::

____________________________________________

 

 

 

 

MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

 

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 8.1 <<<

 

 

2/13/2015 9:05:00 AM > Drive E: - scan started (FreeAgent Drive ~233 GB, NTFS HDD )...

 

 

>>> E:\desktop.ini - Malware > Deleted. (15.02.13. 09.05 desktop.ini.818005; MD5: 83e1fa3c1667c809c4b699386e8e8aeb)

 

 

=> Malicious files   : 1/1 deleted.

 

____________________________________________

 

::::: Scan duration: 1sec ::::::::::::::::::

____________________________________________

 

[BrianDrab]

Nice Thinking! The software cleaned two of the three drives. So they are clean now. I would delete all the files off the USB drives that you don't need.

 

Do I need to do any rescans of the computer itself to ensure it's still clean?

 

 

If you plugged in your infected USB drives into your computer before we installed MCShield then it wouldn't hurt to run a Malwarebytes scan to see if it finds anything but I doubt it.

[ndskykng]

Sounds good.  I'll run a Malware right now.

 

I guess my concern is that even when I was infected, I would run Malwarebytes once or twice a month and it never found anything.  It wasn't until I ran some of the other programs you had suggested that Chrome started working again. 

 

But you're probably right, its likely clean, as I didn't plug in the infected USB while we were doing this.  I was however, plugging in my phone used as a USB back and forth between my work computer and laptop yesterday when I had no internet on the laptop.  MCShield doesn't seem to recognize it as a drive though so it doesn't scan it....

[BrianDrab]

I would run Malwarebytes once or twice a month and it never found anything.

 

No Antimalware/Antivirus program finds everything and there are specialty tools written to target certain infections. Even then we have to resort to manual cleanup to get everything which is what we did here. It's a tricky business for sure.

 

I didn't plug in the infected USB while we were doing this.

 

You wouldn't have been re-infected then so I feel you are clean. We just need to get that mysterious Outlook issue resolved.

[ndskykng]

Okay... so its not happening at home either?? 

 

Maybe one of the programs you had me install (MCShield, etc) is blocking it from going up at startup?

 

But yeah, this is confusing.  I did the full shutdown and boot up and everything.

 

 

I would run Malwarebytes once or twice a month and it never found anything.

 

No Antimalware/Antivirus program finds everything and there are specialty tools written to target certain infections. Even then we have to resort to manual cleanup to get everything which is what we did here. It's a tricky business for sure.

 

I didn't plug in the infected USB while we were doing this.

 

You wouldn't have been re-infected then so I feel you are clean. We just need to get that mysterious Outlook issue resolved.

 

[BrianDrab]

Okay... so its not happening at home either?? 

 

Maybe one of the programs you had me install (MCShield, etc) is blocking it from going up at startup?

 

But yeah, this is confusing.  I did the full shutdown and boot up and everything.

 

 

Anything is possible. If it ever happens again feel free to open up an inquiry in the Software forum where they are more knowledgeable on such things. My primary skillset is malware removal but I do best effort on other issues.

 

You can remove autoruns.exe and any other text files that we saved to the desktop. Is there anything else I can do for you on the malware front? Are you satisfied?

 

 

[ndskykng]

Yeah for sure.  You're good at what you do.  Thanks.