Malwarebytes and McAfee won't run.

mlamphier · April 16, 2013

Symptoms are as follows:

(1) On some pages, Internet Explorer quickly refreshes to “This page can’t be displayed”, apparently because it cannot connect to https://fls.doubleclick.net, http://googleads.g.doubleclick.net, etc.

(2) Neither McAfee or Malwarebytes is running or appear as tray icons

(3) When I attempt to start either McAfee or Malwarebytes manually I get the message "This program is blocked by group policy. For more information, contact your system administrator."

I search the archives and found a similar problem that was responded to by Maurice Naggar.

http://forums.malwarebytes.org/index.php?showtopic=122559

Maurice suggested first running Rkill, which I did. I found what appear to be a number of issues. As Maurice said that the solution depended on the particular issues, I have not proceeded further. Please see Rkill report below. Any advice on how to solve would be appreciated.

Thanks,

Marc

*********************************************************

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Marc [Admin rights]

Mode : Scan -- Date : 04/16/2013 09:55:43

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 16 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : wneehh (regsvr32.exe /s "C:\ProgramData\wneehh.dat") [-] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1614919336-1411973032-2412637700-1001[...]\Run : wneehh (regsvr32.exe /s "C:\ProgramData\wneehh.dat") [-] -> FOUND

[TASK][sUSP PATH] Carbonite Upgrade Check : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent [x] -> FOUND

[TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent $(Arg0) [x] -> FOUND

[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 activate.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 ereg.wip3.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 adobe.activate.com

127.0.0.1 adobeereg.com

127.0.0.1 www.adobeereg.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 125.252.224.90

127.0.0.1 125.252.224.91

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD754JJ +++++

--- User ---

[MBR] 86c015542609df5c3cbb0256b4c18bc7

[bSP] b70017239a24bcc9c4980ea39ca71343 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 9342 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19214336 | Size: 706021 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: WDC WD1001FALS-00E8B0 +++++

--- User ---

[MBR] 57230bd3f8163fb2e03144a25d6cecc0

[bSP] a634db8eae3eef68e3013819e30954c4 : Windows XP MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953867 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_04162013_02d0955.txt >>

RKreport[1]_S_04162013_02d0955.txt

Maurice Naggar · April 16, 2013

I have moved your thread to the Malware Removal help forum. Please only follow my guidance.

Maurice Naggar · April 16, 2013

Disable your anti-virus program, How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs
Please disconnect any USB or external drives from the computer before you run this scan!
Right-Click RogueKiller and select Run as Administrator.
Wait until Prescan finishes.
On the RogueKiller console, click the Registry tab.
We only want to check-mark just these 10 items !!!
Put a check next to all of these and uncheck the rest: (if found)
[RUN][sUSP PATH] HKCU\[...]\Run : wneehh (regsvr32.exe /s "C:\ProgramData\wneehh.dat") [-] -> FOUND
[RUN][sUSP PATH] HKUS\S-1-5-21-1614919336-1411973032-2412637700-1001[...]\Run : wneehh (regsvr32.exe /s "C:\ProgramData\wneehh.dat") [-] -> FOUND
[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND
Then click on Delete on the right hand column under Options.
When done, logoff & Restart the system.
The log will be found as RKreport
Copy & Paste the contents into next reply.

Download aswMBR.exe ( 511KB ) to your desktop.

On Windows 7 / 8 or Vista, RIGHT click on aswMBR.exe and select Run As Administrator to start.

On Windows XP, double click the exe to start.

IF prompted to update Avast definitions, answer NO.

On the following screen:

uncheck trace disk IO calls at the bottom left :excl:

Now, Click the "Scan" button to start scan.

Have patience as it scans.

On completion of the scan (Note if the Fix button is enabled (not the FixMBR button) and tell me)

Now click save log, save it to your desktop and Copy & Paste in your next reply.

Do NOT click any Fix button.

EXIT the tool.

mlamphier · April 16, 2013

Thanks, I ran these programs as you advised.

The Fix button was not enabled in asbMBR.

Below is the report for Rkill

******************************************

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Marc [Admin rights]

Mode : Remove -- Date : 04/16/2013 11:11:39

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 12 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : wneehh (regsvr32.exe /s "C:\ProgramData\wneehh.dat") [-] -> DELETED

[RUN][ROGUE ST] HKLM\[...]\Wow6432Node\RunOnce : 1 (C:\Users\Marc\Desktop\cham\mbam-chameleon-1.62.1.1000\mbam-chameleon.exe /r /p) -> NOT SELECTED

[TASK][sUSP PATH] Carbonite Upgrade Check : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent [x] -> NOT SELECTED

[TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent $(Arg0) [x] -> NOT SELECTED

[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> DELETED

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)

[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NOT SELECTED

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NOT SELECTED

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NOT SELECTED

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NOT SELECTED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 activate.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 ereg.wip3.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 adobe.activate.com

127.0.0.1 adobeereg.com

127.0.0.1 www.adobeereg.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 125.252.224.90

127.0.0.1 125.252.224.91

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD754JJ +++++

--- User ---

[MBR] 86c015542609df5c3cbb0256b4c18bc7

[bSP] b70017239a24bcc9c4980ea39ca71343 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 9342 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19214336 | Size: 706021 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: WDC WD1001FALS-00E8B0 +++++

--- User ---

[MBR] 57230bd3f8163fb2e03144a25d6cecc0

[bSP] a634db8eae3eef68e3013819e30954c4 : Windows XP MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953867 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[3]_D_04162013_02d1111.txt >>

RKreport[1]_S_04162013_02d0955.txt ; RKreport[2]_S_04162013_02d1105.txt ; RKreport[3]_D_04162013_02d1111.txt

mlamphier · April 16, 2013

Here is report from aswMBR

*******************************

Run date: 2013-04-16 11:16:06

-----------------------------

11:16:06.912 OS Version: Windows x64 6.1.7601 Service Pack 1

11:16:06.912 Number of processors: 8 586 0x1A05

11:16:06.912 ComputerName: MARC-PC UserName: Marc

11:16:07.567 Initialize success

11:16:26.755 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

11:16:26.755 Disk 0 Vendor: SAMSUNG_ 1AJ1 Size: 715404MB BusType: 3

11:16:26.755 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2

11:16:26.755 Disk 1 Vendor: WDC_WD10 05.0 Size: 953869MB BusType: 3

11:16:26.833 Disk 0 MBR read successfully

11:16:26.849 Disk 0 MBR scan

11:16:26.849 Disk 0 Windows VISTA default MBR code

11:16:26.849 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63

11:16:26.849 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 9342 MB offset 81920

11:16:26.864 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 706021 MB offset 19214336

11:16:26.880 Disk 0 scanning C:\Windows\system32\drivers

11:16:32.730 Service scanning

11:16:46.194 Modules scanning

11:16:46.209 Scan finished successfully

11:17:00.327 Disk 0 MBR has been saved successfully to "C:\Users\Marc\Desktop\cham\MBR.dat"

11:17:00.327 The log file has been saved successfully to "C:\Users\Marc\Desktop\cham\aswMBR.txt"

mlamphier · April 16, 2013

Upon restarting my computer and running RKill again, I found that 2 of the registry items had re=appeared. I will try deleting again.

***************************************

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Marc [Admin rights]

Mode : Scan -- Date : 04/16/2013 11:35:01

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤