Need help with possible Malware!

[clifford_cooley]

My father has had a few things happen to his PC. I've been trying to wrap my head around what might be taking place.

• Windows Aero has been turning itself off.
• Browser highjacker.

He has been infected in the past but now MSE and Malwarebytes scans are clean.
His infections were probably from downloading new wallpaper for desktop.

Newest development:

• CCleaner give an update button which is when he says all hell broke loose.
• Windows Aero has been turned back off.
• MS Office ribbon interface replaced with "If you like this click here to like this Facebook page."
• He did a system restore before I was notified and recovered his Office Ribbon interface and CCleaner is working properly again.
• I did have to enable Windows Aero again.
• MSE and Malwarebytes still report the PC as clean.

I did a search for Malware replacing ribbon interface or CCleaner infections but have come up empty handed.

Has anyone heard of such Malware?

 

[bassfisher6522]

It could be a rootkit, try running TDSSKiler. Have you run all the malware software in safemode?

http://support.kaspersky.com/faq/?qid=208283363

 

[Shintaro]

I would suggest, if possible, an offline Windows Defender scan.
http://windows.microsoft.com/en-AU/windows/what-is-windows-defender-offline

Also a scan using Malwarebyte in Windows Safe Mode.

Hope this helps.

 

[clifford_cooley]

Just finished a scan in Safe Mode with MSE. I'm scanning with Malwarebytes now. For some reason I was presented with a message stating the definitions were corrupt or missing. I had no choice but to download a new set of definitions for Malwarebytes before I started the scan.

I will scan with TDSSKiler next and report back. Thanks for all the suggestions, hopefully we find something to ease my paranoia.

 

[clifford_cooley]

Malwarebytes and TDSSKiller reported clean on scans.

Any other suggestions or should I assume the PC is clean?

I feel better about the PC but if you think it's necessary to scan with another app, I'm open to suggestions.

 

[TrainableMan]

The boot DVD is best idea. Also, in safe mode b4 you run scans you should run RKill too, TDSSKiller is for root kits but RKill is for memory-resident hiders