Messages

1

RogueKiller / Re: IAT hook user32.dll!TrackPopupMenuEx module unknown

« on: December 17, 2015, 09:06:33 PM »

Hello, sorry for delay in responding to your kind offer to help. I ran RogueKiller again, using the old version I had when the issue was detected, and it did not reappear. Then I opened Outlook and closed it and re-ran the scan, it was not detected. So finally, I opened Outlook and kept it open while I ran RogueKiller a third time; no IAT detected, even though the reminder box was running. I surmise that the previous item was actually a remnant of the malware I had removed and RK successfully deleted it.  I had used a professional to run various programs to clean the computer. RK was the final scan we ran, since it was the scan that I had first run which indicated the malware.

Hope this helps you in your ongoing excellent work. Thank you so much for offering your time.

2

RogueKiller / IAT hook user32.dll!TrackPopupMenuEx module unknown

« on: December 11, 2015, 04:43:28 PM »

Hello, I got this and some other malware which I successfully removed. This remains (comes back after reboot). It is described on the microsoft developer network website as a Visual Studio item, CMenu, floating popup menu...etc. Also, the index looks ok.

But, it has never appeared before and i did have a number of other malware, which I believe came from an outlook email for AmericanGreetingsCard that I should't have clicked on. I would like to get rid of this.

I did download updates to outlook yesterday, that is the only legitamate change that i made. I doubt this is associated with it, although I do get a message box asking me to log into the cloud when i am in outlook.

It is identified by RogueKiller as:  Detection
IAT:Inl hook.(IEAT); Index iexplore.exe[4544] @msctf.dll; Name user32.dll!TrackPopupMenuEx; Module unknown; Path unknown; Address 0x772397170

Thank you.

Also, I read that the msctf.dll is a module to extend the functionalities of the Microsoft Windows Text Services for text input, etc.  So maybe this is the little log-on box that now appears with Outlook cloud version.  However, it has not shown up in a RogueKiller scan before, and I had that cloud function before the updates that I installed yesterday.