Solved PC is infected with NeixTCoup files, how to remove please.

[StanTheMan]

Hi. My laptop is infected with NeixTCoup files. They're showing on temp files when running Firefox and computer running slowly. I had Google Chrome installed but uninstalled it and installed Firefox but the problem is still there. I've tried Malwarebytes but it didn't find anything. Any help you can offer would be really appreciated, thank you.

 

[TwinHeadedEagle]

Hello,



They call me TwinHeadedEagle around here, and I'll be working with you.



Before we start please read and note the following:

• At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
• Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  
• All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
• If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
• I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
  
• Please attach all report using
  
  button below. Doing this, you make it easier for me to analyze and fix your problem.
  
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyalltemp;
  ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[StanTheMan]

Hi TwinHeadedEagle, thanks for replying. I've done the scan and attached the results.

 

[TwinHeadedEagle]

Let's run one more tool:

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[StanTheMan]

Thank you. Here are the files:

 

[TwinHeadedEagle]

Good. Reinstall Chrome and tell me how is the situation now?

 

[StanTheMan]

I'm using Firefox at the minute, do you want me to uninstall Firefox and install Chrome instead?

 

[TwinHeadedEagle]

No, I thought you're using Chrome. How is your PC now?

 

[StanTheMan]

PC seems ok but I still have NeixtCoop files showing when I run %temp% . Should I reboot and see if they're gone?

 

[StanTheMan]

(continued from last message)..... I also still have 920 NeixtCoup items in the following location:
C:\Users\Stan\AppData\Local\Mozilla\Firefox\Profiles\lf6wt0m9.default\cache2\entries

 

[TwinHeadedEagle]

This is just cache. Read here how to empty it:


Clear the cache

1. Click the menu button
   
   and choose Options
   
   
2. Select the Advanced panel.
3. Click on the Network tab.
4. In the Cached Web Content section, click Clear Now.
   
   
5. Click OK to close the Options window

 

[StanTheMan]

Thanks. I've cleared the cache but there's no difference. I still have NeixTCoup files showing in App Data/Local/Tewp and there's now 94 files in the location C:\Users\Stan\AppData\Local\Mozilla\Firefox\Profiles\lf6wt0m9.default\cache2\entries
I seem to have got lots of left-over NeixTCoup files and some sort of rootkit which keeps creating these files every time I open Firefox. When I use CCleaner to clear space it takes a long time clearing these Firefox extensions, it never used to do that. I've also got a problem with Windows Updates, it tells me Windows is unable to update and when I try the recommended lines of help and fixes, nothing changes, still the same, browser running slowly and all these NeixTCoup files everywhere. What can I try now please? Thank you. Stan.

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

 

[StanTheMan]

Ok, I've just done that and here are the files.

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[StanTheMan]

Ok, I've done that and attached the file. Firefox won't open now, I'm getting a message saying 'Your Firefox profile cannot be loaded. It may be missing or inaccessible.' so I'm using Internet Explorer to send this. Thanks. Stan.

 

[TwinHeadedEagle]

Starting the Profile Manager
Important: Before you can start the Profile Manager, Firefox must be completely closed.

1. Click the menu button
   
   and then click Exit
   
   
   
   
2. Press
   
   + R (click the Windows Start button and select Run... on Windows XP).
3. In the Run dialog box, type in:
   firefox.exe -p
4. Click OK.

Note: If the Profile Manager window does not appear, you may need to specify the full path of the Firefox program, enclosed in quotes; for example:

• On 32-bit Windows: "C:\Program Files\Mozilla Firefox\firefox.exe" -p
• On 64-bit Windows: "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -p

If the Profile Manager window does not open, Firefox may have been running in the background, even though it was not visible. Close all instances of Firefox or restart the computer and then try again.

Creating a profile

1. To start the Create Profile Wizard, click Create Profile... in the Profile Manager.
2. Click Next and enter the name of the profile. Use a profile name that is descriptive, such as your personal name. This name is not exposed on the Internet.
   
   
   
3. You can also choose where to store the profile on your computer. To choose its storage location, click Choose Folder....
   Warning: If you choose your own folder location for the profile, select a new or empty folder. If you choose a folder that isn't empty and you later remove the profile and choose the "Delete Files" option, everything inside that folder will be deleted.
4. To create the new profile, click Finish.

 

[StanTheMan]

Ok, I've done all that and now Firefox works ok. There are still NeixtCoup files showing when I run %temp% and there's a new folder there now called 'mozilla-temp-files' which contains a NeixTCoup file called 'mozilla-temp-29303'. Firefox does seem to be running a bit faster now but is it right to keep finding these NeixTCoup files which I can't delete while Firefox is running? I've still got the same problem with Windows Updates not working (I'm not really sure if this problem exists because of these NeixtCoup files but it started happening around the same time). Thanks, Stan.

 

[StanTheMan]

I've also just noticed that the new Firefox profile folder that I created has a folder called 'cache2' which contains two folders, one called 'doomed' and the other called 'entries'. There are 169 NeixTCoup items in this folder.

 

[TwinHeadedEagle]

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your Desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait until the database is updated.
• Accept the Terms of use and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.