Windows "not genuine" but can't run legitcheck.hta - HELP!

[Supportacus]

OK I've quarantined those 5 PUP things.
How can I be sure that I've not got any other 'unwanted' stuff?
What else should I run?

Noting what you already posted...
I recommend that you use Adwcleaner....Not everyone online knows that 1 MB installer are Spyware.
You might have tried to download something and ended up installing an ad ware.
The weird thing is that your MBAM didn't warn you...(Or you ignored it).

Adwcleaner
JRT
Rkill.exe
(Pssst! Hitman pro never misses a driver or a system file...Use it with caution if you want it..Because it includes AMD drivers in syswow64 and sys32 in the detection list)

 

[ship691]

Thanks people - lots of useful tips.

Btw, I just spotted that the system clock time was an hour ahead. I don't know when that happened, but I'm 98% sure it wasn't wrong before. Is that the footprint of malware of some sort?

 

[Supportacus]

Thanks people - lots of useful tips.

Btw, I just spotted that the system clock time was an hour ahead. I don't know when that happened, but I'm 98% sure it wasn't wrong before. Is that the footprint of malware of some sort?

Did you use Rkill.exe?
No use of just hearing about it -.-
It is like for all malwares.
Why sometimes your clock screws up

 

[Layback Bear]

Check to make sure your time zone is set properly.

 

[ship691]

Please can someone direct me to the official site for rkill?
I cant find it. There is a lot of stuff on bleepingcomputer but I dont know if I can trust that.

 

[NoelDP]

BleepingComputer pretty much IS the official source
RKill Download

 

[ship691]

Check to make sure your time zone is set properly.

The bizarre thing is that the timezone already WAS set correctly. It's just that the actual time was out by 1 hour.

 

[ship691]

Yikes - BitDefender Rescue CD has found "12 threats in 92 items" that were not found by AVG Cloudcare, JRT, AdwareCleaner, MalwareBytes AntiMalware, even though I ran all of the above after running rkiller in a windows safe mode boot.

BitDefender has found:

Exploit.Iframe.Vulnerability
Gen:Variant.Kazy.385912
I-Worm.Hybris.B
Joke.Funny.A
Trojan.Agent.BZIY
Trojan.Agent.BIFH
Trojan.Generic.KD.2318653
Trojan.Upatre.AT
W97M.Dowloader.Kl
W97M.Dowloader.KV
W97M.Dowloader.Kl
W97M.Melissa.BQ@mm

Should I "disinfect" or "delete"?
If I don't hear from anyone shortly I shall disinfect.

J


EDIT
Fwiw, a number of them seem to be in old email archives.

EDIT02
Some wouldnt "disinfect" do I tried to "delete" them. They are the "Exploit.Iframe.Vulnerability" threats. They seem to be in an old Outlook .PST archive file.
HELP! Bitdefender Rescue CD doesnt seem be able to Delete them either! After I select delete them and click "Fix issues" it lists each one with a status of "Deleted" (in green) however it still says "1 threat in 37 items still present on your system" near the top of the window and Resolved Issues is still at "0".

And after about 4 attempts after I click finish, on the final screen it says "37 infected items have been ignored. Your computer is not virus free!"

 

[NoelDP]

Delete them, would be my advice.
I'm not at all surprised about that - although any that were in emails would probably have been caught if you'd tried to open the email concerned. Many scanners avoid attempting to open emails to scan them - relying on catchng the bad ones when someone attempts to open them. (I always switch email scanning off on any machine I use, as I've historically found that it can cause prblems)

 

[ship691]

What do I do about the ones that won't delete? Should I re-scan or try another application?

Wait - are you saying that email scanning is a BAD idea?

 

[NoelDP]

There are basically two ways to scan email - as it's downloaded, and as it's opened.
Scanning while downloading often causes problems - resulting in hung mail clients and error messages.
Whenever you open an email, the AV gets another crack at it at that point anyhow - and this may be the best point, as the AV may have been updated to deal with the 'bad' content since the email was downloaded (and you don't often open many emails at the same time!).
When you say 'won't delete' - what error message do you get? Is this from the Rescue AV?

 

[RolandJS]

Some mentioned Hitman Pro, I found it best to set default to "Ignore," then I can go down the Quick Scan or Default Scan and change any particulars to "Delete." If ever using Early Warning System, definitely recommend default as "Ignore."

 

[ship691]

When you say 'won't delete' - what error message do you get? Is this from the Rescue AV?

I'm using Bitdefender's Rescue CD.
Strangle there is no error message as such. It claims to have changed the status for each threat to "Deleted" except it doesnt actually do it!

The resolved counter stays at "0" and the Results summary still talks about that threat "Exploit.Iframe.Vulnerability".

I would quite like to delete rid of viruses that I *know* I have them. My email archives are too fat as it is to be storing junk. I wonder if I could spam filter it after it has arrived?

Does Hitman Pro read old emails?

EDIT01
I ran Hitman Pro (from Safe Mode) but it didnt find anything.

 

[NoelDP]

Try running a FULL (custom) scan of MBAM from all User accounts - see if that catches them (what email client are you using?)

 

[ship691]

My PC has started "going to sleep" when unattended. I have discovered something called "Simplitech Power Suite" which I do not recognise and which I suspect is malware. How can I get rid of it?
(I can't find it on Control Panel ==> Programs and Features => Uninstall or change a program )

EDIT
It turns out that Simplitec Power Suite may be something to do with the software Xara Designer Pro that I bought. If so I still want it out but there is no obvious way of getting rid of it!

Btw, I have learnt my lesson about not installing software/drivers that isnt from a completely credible source. But are there any (free) utilities for helping us install software and/or clean up/speedup one's Windows Registry. I am happy to pay a very small amount for this, but only after several weeks of successful use.

 

[ship691]

Try running a FULL (custom) scan of MBAM from all User accounts - see if that catches them (what email client are you using?)

OK running MBAM now. I'm not 100% sure how to make sure how to get the custom scan to scan all user accounts. It seems to be doing the entire C: drive... but I may be missing something (??)

 

[NoelDP]

You need to run a custom scan of all drive c: from your main account. Then you need to run quick scans from each of the others accounts. This gives mbam a chance to check each user's registry.

 

[ship691]

You need to run a custom scan of all drive c: from your main account. Then you need to run quick scans from each of the others accounts. This gives mbam a chance to check each user's registry.

Oh wait are you saying I need to log into Windows as each user on my PC in turn?

Is there no way to check all accounts on the PC in one go?

 

[NoelDP]

There isnt really any way to check one user's registry from another.
Yes you need to log into each account and run the quick scan from there...Mbam willstill demand elevation but will have full access to the user's registry.

 

[torchwood]

folder removal

You could remove the folder relating to the power settings by going into
mycomp/c/programfilesx86/Xara/simplitech.

Roy