Possible word.doc macro virus

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2095233237-4097543476-729406263-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-2095233237-4097543476-729406263-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
FF Plugin HKU\S-1-5-21-2095233237-4097543476-729406263-1001: @tools.google.com/Google Update;version=3 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.17\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-2095233237-4097543476-729406263-1001: @tools.google.com/Google Update;version=9 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.17\npGoogleUpdate3.dll [No File]
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{91A41FCC-BC02-42D8-A36E-0D27FF9BFFC8}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.17\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2095233237-4097543476-729406263-1001_Classes\CLSID\{EA724FD3-844D-43A9-A8C9-A5BC35FC20E4}\InprocServer32 -> C:\Users\saral\AppData\Local\Google\Update\1.3.33.17\psuser_64.dll => No File
ContextMenuHandlers1-x32: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll -> No File
ContextMenuHandlers4: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers6: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll -> No File
Task: {D8AC6FF1-6101-4691-8320-2C89C377FD11} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\saral\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Keep - notes and lists.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory=Default –app-id=hmjkmjkepdijhoojdojkdfohbdgmmhki
ShortcutWithArgument: C:\Users\saral\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Play Music.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory=Default –app-id=fahmaaghhglfmonjliepjlchgpgfmobi
C:\Windows\Temp\*.*
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[external image: zcMPezJ.png]AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[external image: RQKuhw1.png]RogueKiller

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply

created by Aura

Please post these 3 logs when finished.

Question, do you have any idea if this file could have infest an android smartphone?  Like and idiot I tried opening the file first on my phone.  It seems to be working just fine and two different scans (trendmicro and avast) found nothing but just the same I thought I would ask.

I'm going to go out on a limb here and give an opinion:
It might be possible If you had the phone connected to the computer by usb cord/whatever they call it, my opinion is things can be transferred from Laptop to Phone.
It might be possible If you downloaded something to the phone to transfer over to the laptop/computer, same thing.

In the news lately, things are being designed specifically to go after phones. Google is full of articles and to tell the truth, in the back of my mind I knew one day malware writers/hackers would.
 
I've learned not to be a very trustful person….LOL
 
~~~~~~~~~~~~~~~~~~~~~~

Let's check for remnants

Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Here

• Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
• Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
• After the installation IS complete let it update if it asks.
• Under SETTINGS…..APPLICATIONS leave everything at default
• Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on.
• Then go to the Dashboard and click on SCAN NOW
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  Upon completion of the scan (or after the reboot), click the Reports tab.
  Double-click the Scan Log.
  At the bottom click Export and choose Text file.
  
  Save the file to your desktop and include its content in your next reply.
  
  You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
• Then click on POST
• Exit Malwarebytes

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

Please post these 2 logs when finished.

Also, tell me how the computer is now.

Thank Juliet,

 

I don't blame you for being not very trustful, I'd probably call that smart.  My phone wasn't connected to anything when I executed the file on it, I'll cross my fingers that nothing bad is there since nothing seems to be getting caught on any scans and it is working fine, ugh.

 

Any how my systems seems to be working OK now.  The two scan results you wanted are below.  Hopefully I got this and no damage was done…

 

Let me know if there are any other steps to take but thanks again for your assistance!

 

I think your on good shape now.

Let's remove tools and quarantine folders.

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• – This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

*************

Thank for all of your help with this Juliet.  Have a very Merry Christmas and all the best for 2019!

Your welcome.

Glad we could help. [external image: SakDYGv.gif]
Since this issue appears resolved … this Topic is closed.