Malware possibility? [Solved]

I have received an email from "what appeared to be" my former real estate agent (Attachment Screen 1) and did something I shouldn't have - I tried to open it.  In order to open I had to use a password (777) contained in the body of the email.  Once I did use that password, I saw a file labelled: info_08.02 (Attachment - Screen 2).  I From that file I could see the route to the file in my computer: Dick Conant/App Data/Local/Microsoft/Windows/INetCache/Content.Outlook/SOKQ1XZZ/masiello.  So I attempted to drill down in my Explorer to get to the file, so I could delete it.  I could only get to the INetCache file (Screen 3) and no further.  The next file in the sequence (Content.Outlook) was not appearing.  So nothing has happened to my laptop yet, but I fear I've left some portal open for others to get it.  I've scanned with Malware bytes and with Avast and received the information that those programs found nothing.  I had downloaded Avast for this one time, then deleted the program so as not to conflict with Malwarebytes Premier.  Got any information on what to do next?

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Hello dconant1

My name is Satchfan. I'm afraid that Juliet is unable to reply at the moment so I'll be dealing with your problem.

I'm looking at your logs now and will reply shortly.

Satchfan

App Data/Local/Microsoft/Windows/INetCache/Content.Outlook/SOKQ1XZZ/masiello

The above in blue are quite normal. When you open a file attachment that you feel is 'safe', Outlook puts the attachment in Content.Outlook as a precaution. Each attachment is named as a randomly-generated sequence of letters and numbers; in your case, SOKQ1XZZ. Therefore this not suspect at all and perfectly normal.

================================================

Do you know who this is?

PTR LAPTOP

================================================

Uninstall programs

Uninstall the following program:

Driver Support

This programme uses false-positives to convince users that their Windows systems have problems.

You can read more here.

===================================================

There is no evidence of malware but a few things that need to be cleared up.

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate FRST64
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {0DF0DCAA-C2FE-4577-9D36-E9B8836729D0} - System32\Tasks\Driver Support-RTMScan => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {4F043E0A-C4C0-408B-B899-EB96B362DD7D} - System32\Tasks\Driver Support => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {B104A7E2-183A-4DB7-A19D-87A99FC3D40E} - System32\Tasks\Driver Support-RTMRules => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {E9366DD9-A6D2-4AE5-BCCA-EDC6545AF0CD} - System32\Tasks\Driver Support-RTMScanRunOnce => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {FF6A7C6D-27FC-4C43-A81A-8FDCE362B034} - System32\Tasks\Driver Support-RTMUpdater => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
CHR Extension: (IObit Surfing Protection & Ads Removal) - C:\Users\Dick Conant\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2019-03-26]
R2 DSAO; C:\Program Files (x86)\driver support\svc\DriverSupportAOsvc.exe [2033104 2016-10-22] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers HeadQuarters LP) <==== ATTENTION
S2 UIUService; %SystemRoot%\system32\UIUSrv.exe [X]
2019-08-04 06:12 - 2019-08-05 05:07 - 000000000 ____D C:\ProgramData\AVAST Software
2019-08-04 06:12 - 2019-08-04 06:12 - 000233080 _____ (AVAST Software) C:\Users\Dick Conant\Downloads\avast_free_antivirus_setup_online.exe
2019-07-24 22:32 - 2019-07-24 22:32 - 000000000 ____D C:\WINDOWS\System32\Tasks\McAfee
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
FirewallRules: [{2D1BAA72-8B78-460D-B766-C15624BFB8A4}] => (Allow) C:\Users\Dick Conant\AppData\Local\Temp\7zS5682\HPDiagnosticCoreUI.exe No File
FirewallRules: [{F87A12F3-DB88-429B-9494-2A6175E35A9C}] => (Allow) C:\Users\Dick Conant\AppData\Local\Temp\7zS5682\HPDiagnosticCoreUI.exe No File
FirewallRules: [{747995A2-378C-4D2E-8B04-6270FFE1A8F7}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe No File
FirewallRules: [{5066AAB3-102E-45FF-BCFF-1A45A76EA86C}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe No File
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

Fixlog.txt
New Frst.txt
New Addition.txt

Thanks

Satchfan

I don't know what PTR LAPTOP is referring to.  I have uninstalled 'Driver Support.'  I have cut FRST64 and pasted it on my Desktop.  So Farbar Recovery Scan Tool is now on my Desktop.  I've opened Notepad and pasted the items you had listed into the Notepad file.  Now I am having problems with attempting to save fixlist.txt in the FRST file.  I'm missing something and will need specific help in how best to do this step.  

Specifics about the 'not-saving-in-the-same-folder-as-FRST' problem:

(1) in Notepad when I click 'save as' I get a screen (see attachment) that has two options [A] save as a txt file - and within that listing of files, there is not FRST64 present to choose from or save as ALL FILES - then there is the option of choosing FRST64.  When I click on the FRST64 it says "file already exists" which lets me know that I'm duplicating and I don't want to do this.  So I cancel that operation and wonder how do I actually save the fixlist.txt in the same folder as the FRST64?  Do I get the two windows up and drag fixlist.txt to the FRST64 on the desktop?

In hopes that I've done this correctly, I'm posting again just to point out that I did save "fixlist.txt" to my desktop so that I have it right next to FRST64 (attachment).  Then I dragged fixlist.txt into the FRST64 file.  Is this correct?

It appears that TeamViewer and GoToMeeting are programmes that you use and there is a suggestion of sharing iTunes.

Can you give me some information about those as I can't decide what should/should not be present without clarification.

Satchfan

I have a guy that I use to help me with little stuff (ie. can't see my mouse cursor, etc).  He uses TEAM VIEWER.  It's a program he purchased which enables him to see my screen from his residence.  I have to be there at my screen open and click on the TEAM VIEWER icon, then he logs in and can see everything and can navigate through all my screens.  The GO-TO-MEETING isn't supposed to be on here.  I just uninstalled that program.  I'm not sure about why ITunes would be on my computer.  I don't use that program for anything.  It's not in my Uninstall list of programs.  I'm good with deleting that somehow.  

Thank you for the explanations.

================================================

Disable Team Viewer and LogMeIn

When set to run at startup, if another person has the password they can gain access to your machine. Although it’s not malware, it does have the potential for misuse depending on how the program is installed.

I think it is wise to disable Team Viewer and LogMeIn from starting at boot up, this way nothing can be captured and sent through remote connections.

• open TeamViewer and when the window opens, from the ‘Extras’ menu, choose Options
• remove the checkmark next to ‘Start TeamViewer with Windows’ and then click OK.

LogMeIn

• right-click on the ‘This PC’ icon on the Desktop and select Manage
• in the window that appears select Services > Services and Applications
• on the right hand side find ‘LogMeIn’
• right click and select Properties
• from ‘Startup Type’ select Manual and click OK.

================================================

You need to uninstall these extensions in FireFox:

Avast SafePrice
Avast Online Security

Apart from that, there seems to be no evidence of malware, so your computer’s fine.

Let me know if you’re happy with that and we’ll tidy up.

Satchfan

I removed the check-mark in the Team Viewer as you suggested (attachment).  I wasn't able to see any file named LogMein (attachment).  

OK, let’s do it this way:

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
Task: {003FF8C2-88EF-45DD-8904-677CE229A23D} - System32\Tasks\G2MUploadTask-S-1-5-21-2168277141-1069808667-1614027003-1001 => C:\Users\Dick Conant\AppData\Local\Citrix\GoToMeeting\7155\g2mupload.exe [32320 2019-03-05] (LogMeIn, Inc. -> Citrix Online, a division of Citrix Systems, Inc.)
Task: {A86B7F6C-C412-4677-97C1-9DC044162C0D} - System32\Tasks\G2MUpdateTask-S-1-5-21-2168277141-1069808667-1614027003-1001 => C:\Users\Dick Conant\AppData\Local\Citrix\GoToMeeting\7155\g2mupdate.exe [32320 2019-03-05] (LogMeIn, Inc. -> Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-2168277141-1069808667-1614027003-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Dick Conant\AppData\Local\Citrix\GoToMeeting\7155\G2MOutlookAddin64.dll (LogMeIn, Inc. -> Citrix Online, a division of Citrix Systems, Inc.)
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Thanks

Satchfan

I think your computer is fine and I've found no reason to think it's compromised so, if you're happy that there are no problems, let me know and I'll send instructions to tidy up the tools we've used.

Satchfan