Infected: Cannot install Malwarebytes, Error 183

callandor21 · February 12, 2014

On a co-worker's home PC, I noticed difficulties installing programs and tried to run Malwarebytes with no success. It was in the Task Manager but the GUI wouldn't come up. I then uninstalled the program and tried to reinstall it but ran into admin privileges on the Malwarebytes folder. The security settings had changed on the folder but I was able to delete it and attempted another reinstall. I then encountered the following error in the middle of install:

Error 183: Cannot create a new file when that file exists

This occurred on multiple files MBAM was trying to install like rules.ref and config.conf

I have tried running the MBAM Clean Remover, Combofix (without guidance), RKill, and JRT. I tried to run ADWCleaner but it didn't run properly (it was running in Task Manager but nothing happened).

I have attached the DDS logs to this post. Thank you for any help you can provide.

attach.txt

dds.txt

kevinf80 · February 12, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin

callandor21 · February 13, 2014

I have run the program and attached the requested files. Thanks.

FRST.txt

Addition.txt

kevinf80 · February 13, 2014

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Next,

Download Malwarebytes from the following link and save it to your desktop.:

http://www.malwarebytes.org/mbam.php

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Kevin

fixlist.txt

callandor21 · February 13, 2014

I ran FRST with the Fix file in the same desktop and have attached the fixlog.txt.

When I downloaded and tried to install mbam-setup-1.75.0.1300.exe, I ran into the same Error 183 as before on the rules.ref folder. I was unable to complete the install to do a scan. Thanks.

Fixlog.txt

kevinf80 · February 13, 2014

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from the following link :-

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Ensure that Combofix is saved directly to the Desktop <--- Very important
Disable all security programs as they will have a negative effect on Combofix, instructions available here http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.
Close any open browsers and any other programs you might have running
Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here http://thespykiller.co.uk/index.php?page=20 why disabling autoruns is recommended.

*EXTRA NOTES*

    If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
    If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
    If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin

callandor21 · February 13, 2014

I have attached the log file from Combofix. The program didn't reboot the PC after it finished running.

log.txt

kevinf80 · February 13, 2014

I see you`ve ran Combofix previously, can I see the two following files:

C:\Qoobox\ComboFix-quarantined-files.txt
C:\Qoobox\ComboFix2.txt

Next,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the Codebox below into it:

ClearJavaCache::Registry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]Folder::c:\program files (x86)\Hotspot ShieldFile::c:\windows\system32\drivers\aswSnx.sysc:\windows\system32\drivers\aswSP.sysc:\windows\system32\drivers\aswMonFlt.sysDriver::aswRvrtaswVmmaswSnxaswSPaswMonFlt

Save this as CFScript.txt, and as Type: All Files (*.*) in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Next,

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that we may have missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

Run Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

If threats were found

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

close program

copy and paste the report in next reply

Let me see those logs...

Kevin

callandor21 · February 13, 2014

I have attached the two Combofix files. I created the Script file and dragged it onto Combofix but I encountered an error:

Windows cannot find C:\Users\G\Desktop\Combofix.exe'

I tried redownloading Combofix onto the desktop but encountered the error again. I don't know if my co-worker and his family used this PC overnight and if it effected anything new. Thanks.

ComboFix-quarantined-files.txt

ComboFix2.txt

callandor21 · February 13, 2014

I tried renaming Combofix.exe to test.exe and it was able to run when I dragged the script onto it. Will update once completed.

callandor21 · February 13, 2014

I complted Combofix and have attached the log as well as tne new quarantine log.

I was unable to run eset online scanner in IE. IE is not functional as I cannot get to any websites. The only working browser I have is Chrome, and maybe Firefox. I tried downloading the Eset Online Scanner through Chrome and ran the app but it doesn't look like the Scanner is downloading its components.

ComboFix-quarantined-files.txt

combofix.txt

callandor21 · February 13, 2014

I had another quick update. The ESET Online Scanner finally started downloading the components and finished that. I am downloading virus signature database right now and hopefully I will be able to complete the scan. Thanks.

callandor21 · February 13, 2014

Here is the results of the ESET SCAN:

C:\FRST\Quarantine\Load.exe.exe12-02-2014_17-05-43   a variant of MSIL/Kryptik.QY trojan
C:\FRST\Quarantine\Load.exe.exe12-02-2014_17-05-44   a variant of MSIL/Kryptik.QY trojan
C:\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit\ConduitInstaller.exe   Win32/Toolbar.Conduit potentially unwanted application
C:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\tbNCH_.dll   a variant of Win32/Toolbar.Conduit.B potentially unwanted application
C:\Users\G\.frostwire5\updates\frostwire-5.6.2.windows.exe   Win32/OpenCandy potentially unsafe application
C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\miner.dll   probably a variant of Win32/BitCoinMiner.H potentially unsafe application
C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\Svchost.exe   Win32/BitCoinMiner.AV potentially unsafe application
C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\Windll.exe   Win32/BitCoinMiner.AV potentially unsafe application
C:\Users\G\Downloads\7zip_installer_d161680.exe   a variant of Win32/InstallIQ.A potentially unwanted application
C:\Users\G\Downloads\Babylon10_setup.exe   a variant of Win32/Toolbar.Babylon.A potentially unwanted application
C:\Users\G\Downloads\debutsetup.exe   a variant of Win32/Toolbar.Conduit.H potentially unwanted application
C:\Users\G\Downloads\dfsetup217 (1).exe   Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\G\Downloads\frostwire-5.4.0.windows.exe   a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application
C:\Users\G\Downloads\GameNutt_UnlockGames (1).exe   a variant of Win32/OpenInstall potentially unwanted application
C:\Users\G\Downloads\GameNutt_UnlockGames (2).exe   a variant of Win32/OpenInstall potentially unwanted application
C:\Users\G\Downloads\GameNutt_UnlockGames (3).exe   a variant of Win32/OpenInstall potentially unwanted application
C:\Users\G\Downloads\GameNutt_UnlockGames (4).exe   a variant of Win32/OpenInstall potentially unwanted application
C:\Users\G\Downloads\GameNutt_UnlockGames.exe   a variant of Win32/OpenInstall potentially unwanted application
C:\Users\G\Downloads\MyTopFreeGames_UnlockGames_2.exe   a variant of Win32/OpenInstall potentially unwanted application
C:\Users\G\Downloads\penality-kicks-shooter (1).exe   a variant of Win32/InstallCore.AL potentially unwanted application
C:\Users\G\Downloads\penality-kicks-shooter.exe   a variant of Win32/InstallCore.AL potentially unwanted application
C:\Users\G\Downloads\super-mario (1).exe   a variant of Win32/InstallCore.AL potentially unwanted application
C:\Users\G\Downloads\super-mario.exe   a variant of Win32/InstallCore.AL potentially unwanted application
C:\Users\Guest\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\Users\Guest\AppData\LocalLow\NCH_EN\tbNCH_.dll   a variant of Win32/Toolbar.Conduit.B potentially unwanted application
C:\Users\Healthypets\AppData\Local\temp\Load.exe.exe   a variant of MSIL/Kryptik.QY trojan
C:\Users\Ritu\Downloads\SoftonicDownloader_for_hamachi.exe   Win32/SoftonicDownloader.E potentially unwanted application
C:\Windows\Installer\MSIDC41.tmp   a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application
C:\Windows\System32\{$2561-4610-8719-4781-2568$}\7685264.exe   MSIL/Agent.OQZ trojan
C:\Windows\System32\{$2561-4610-8719-4781-2568$}\appsvc.exe   MSIL/Agent.OQZ trojan
C:\Windows\System32\{$2561-4610-8719-4781-2568$}\chrome.exe   a variant of MSIL/Injector.CMY trojan
C:\Windows\System32\{$8451-5299-6190-7208-6025$}\8549064.exe   a variant of MSIL/Kryptik.QY trojan
C:\Windows\System32\{$8451-5299-6190-7208-6025$}\appsvc.exe   a variant of MSIL/Kryptik.QY trojan
C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\7685264.exe   MSIL/Agent.OQZ trojan
C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\appsvc.exe   MSIL/Agent.OQZ trojan
C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\chrome.exe   a variant of MSIL/Injector.CMY trojan
C:\Windows\SysWOW64\{$8451-5299-6190-7208-6025$}\8549064.exe   a variant of MSIL/Kryptik.QY trojan
C:\Windows\SysWOW64\{$8451-5299-6190-7208-6025$}\appsvc.exe   a variant of MSIL/Kryptik.QY trojan

I had another quick update. The ESET Online Scanner finally started downloading the components and finished that. I am downloading virus signature database right now and hopefully I will be able to complete the scan. Thanks.

kevinf80 · February 14, 2014

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

http://oldtimer.geekstogo.com/OTM.exe.
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Reg :Reg

:Reg[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]:ServicesaswRvrtaswVmmaswSnxaswSPaswMonFlt:FilesC:\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit\ConduitInstaller.exeC:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\ldrtbNCH_.dllC:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\tbNCH_.dll    C:\Users\G\.frostwire5\updates\frostwire-5.6.2.windows.exe   C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\miner.dll    C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\Svchost.exe    C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\Windll.exe    C:\Users\G\Downloads\7zip_installer_d161680.exe    C:\Users\G\Downloads\Babylon10_setup.exe    C:\Users\G\Downloads\debutsetup.exe    C:\Users\G\Downloads\dfsetup217 (1).exe  C:\Users\G\Downloads\frostwire-5.4.0.windows.exe    C:\Users\Guest\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll    C:\Users\Guest\AppData\LocalLow\NCH_EN\tbNCH_.dll    C:\Users\Healthypets\AppData\Local\temp\Load.exe.exe    C:\Users\Ritu\Downloads\SoftonicDownloader_for_hamachi.exe    C:\Windows\Installer\MSIDC41.tmp    C:\Windows\System32\{$2561-4610-8719-4781-2568$}\7685264.exe    C:\Windows\System32\{$2561-4610-8719-4781-2568$}\appsvc.exe   C:\Windows\System32\{$2561-4610-8719-4781-2568$}\chrome.exe    C:\Windows\System32\{$8451-5299-6190-7208-6025$}\8549064.exe    C:\Windows\System32\{$8451-5299-6190-7208-6025$}\appsvc.exe   C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\7685264.exe  C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\appsvc.exe   C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\chrome.exe    C:\Windows\SysWOW64\{$8451-5299-6190-7208-6025$}\8549064.exe   C:\Windows\SysWOW64\{$8451-5299-6190-7208-6025$}\appsvc.exe   c:\program files (x86)\Hotspot Shieldc:\windows\system32\drivers\aswSnx.sysc:\windows\system32\drivers\aswSP.sysc:\windows\system32\drivers\aswMonFlt.sys:Commands[EmptyTemp]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

Post log in next reply..

Next,

Does Malwarebytes install/run?

callandor21 · February 14, 2014

While running OTM, I encountered an error:

The program can't start because usft_ext.dll is missing from your computer. Try reinstalling the program to fix this problem.

I hit Okay and continued to run the program until it finished and asked to reboot the PC. I have cut and paste the log below.

I tried installing MBAM from the Desktop and still encountered the Error 183 on the rules.ref file. I am trying to install to the default directory of programdata\malwarebytes.

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}\ not found.
========== SERVICES/DRIVERS ==========
Service aswRvrt stopped successfully!
Service aswRvrt deleted successfully!
Service aswVmm stopped successfully!
Service aswVmm deleted successfully!
Service aswSnx stopped successfully!
Service aswSnx deleted successfully!
Service aswSP stopped successfully!
Service aswSP deleted successfully!
Service aswMonFlt stopped successfully!
Service aswMonFlt deleted successfully!
========== FILES ==========
C:\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit\ConduitInstaller.exe moved successfully.
DllUnregisterServer procedure not found in C:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll
C:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll moved successfully.
DllUnregisterServer procedure not found in C:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\tbNCH_.dll
C:\Users\devin.OfficePC\AppData\LocalLow\NCH_EN\tbNCH_.dll moved successfully.
C:\Users\G\.frostwire5\updates\frostwire-5.6.2.windows.exe moved successfully.
LoadLibrary failed for C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\miner.dll
C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\miner.dll moved successfully.
C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\Svchost.exe moved successfully.
C:\Users\G\AppData\Roaming\Microsoft\Windows\Dll\Windll.exe moved successfully.
C:\Users\G\Downloads\7zip_installer_d161680.exe moved successfully.
C:\Users\G\Downloads\Babylon10_setup.exe moved successfully.
C:\Users\G\Downloads\debutsetup.exe moved successfully.
C:\Users\G\Downloads\dfsetup217 (1).exe moved successfully.
C:\Users\G\Downloads\frostwire-5.4.0.windows.exe moved successfully.
DllUnregisterServer procedure not found in C:\Users\Guest\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll
C:\Users\Guest\AppData\LocalLow\NCH_EN\ldrtbNCH_.dll moved successfully.
DllUnregisterServer procedure not found in C:\Users\Guest\AppData\LocalLow\NCH_EN\tbNCH_.dll
C:\Users\Guest\AppData\LocalLow\NCH_EN\tbNCH_.dll moved successfully.
C:\Users\Healthypets\AppData\Local\temp\Load.exe.exe moved successfully.
C:\Users\Ritu\Downloads\SoftonicDownloader_for_hamachi.exe moved successfully.
C:\Windows\Installer\MSIDC41.tmp moved successfully.
C:\Windows\System32\{$2561-4610-8719-4781-2568$}\7685264.exe moved successfully.
C:\Windows\System32\{$2561-4610-8719-4781-2568$}\appsvc.exe moved successfully.
C:\Windows\System32\{$2561-4610-8719-4781-2568$}\chrome.exe moved successfully.
C:\Windows\System32\{$8451-5299-6190-7208-6025$}\8549064.exe moved successfully.
C:\Windows\System32\{$8451-5299-6190-7208-6025$}\appsvc.exe moved successfully.
File/Folder C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\7685264.exe not found.
File/Folder C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\appsvc.exe not found.
File/Folder C:\Windows\SysWOW64\{$2561-4610-8719-4781-2568$}\chrome.exe not found.
File/Folder C:\Windows\SysWOW64\{$8451-5299-6190-7208-6025$}\8549064.exe not found.
File/Folder C:\Windows\SysWOW64\{$8451-5299-6190-7208-6025$}\appsvc.exe not found.
File/Folder c:\program files (x86)\Hotspot Shield not found.
File/Folder c:\windows\system32\drivers\aswSnx.sys not found.
File/Folder c:\windows\system32\drivers\aswSP.sys not found.
File/Folder c:\windows\system32\drivers\aswMonFlt.sys not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56478 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Devin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 4776136 bytes
->Flash cache emptied: 456 bytes

User: devin.OfficePC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 50961539 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 32659713 bytes
->Flash cache emptied: 58175 bytes

User: Devin.OfficePC.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 39337 bytes
->Flash cache emptied: 56478 bytes

User: G
->Temp folder emptied: 3935741 bytes
->Temporary Internet Files folder emptied: 331025731 bytes
->Java cache emptied: 66536493 bytes
->FireFox cache emptied: 1163567718 bytes
->Google Chrome cache emptied: 404960799 bytes
->Flash cache emptied: 89110 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 8680641 bytes
->FireFox cache emptied: 123443481 bytes
->Flash cache emptied: 57297 bytes

User: Healthypets
->Temp folder emptied: 32675 bytes
->Temporary Internet Files folder emptied: 16851766 bytes
->FireFox cache emptied: 22415316 bytes
->Flash cache emptied: 57080 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Ritu
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 10009694 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 9486888 bytes
->Google Chrome cache emptied: 353258437 bytes
->Flash cache emptied: 4256 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 63326331 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42358387 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2,583.00 mb

OTM by OldTimer - Version 3.1.21.0 log created on 02132014_165319

Files moved on Reboot...
C:\Users\G\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\G\AppData\Local\Temp\JavaDeployReg.log moved successfully.
C:\Users\G\AppData\Local\Temp\TimeInfo.txt moved successfully.
C:\Users\G\AppData\Local\Temp\TrcInfo.txt moved successfully.
C:\Users\G\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

Registry entries deleted on Reboot...

kevinf80 · February 14, 2014

What is the current status, will Malwarebytes install/run?

callandor21 · February 14, 2014

I was finally able to install the program after deleting the MalwareBytes folder in the ProgramData folder. The security settings seemed to have been changed, preventing me from changing files required during install.

However, after starting up the program, I don't see the GUI running.

callandor21 · February 14, 2014

Sorry, I guess I'm impatient. The update finally ran after a bit and the GUI finally came up. Running a Quick scan right now.

I was finally able to install the program after deleting the MalwareBytes folder in the ProgramData folder. The security settings seemed to have been changed, preventing me from changing files required during install.

However, after starting up the program, I don't see the GUI running.

callandor21 · February 14, 2014

I completed the quick scan. Here is the log file:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.14.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
G :: OFFICEPC [administrator]

2/14/2014 9:41:59 AM
mbam-log-2014-02-14 (09-41-59).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 354231
Time elapsed: 3 minute(s), 55 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 6
C:\Users\G\Downloads\GameNutt_UnlockGames (1).exe (PUP.BundleInstaller.OI) -> Quarantined and deleted successfully.
C:\Users\G\Downloads\GameNutt_UnlockGames (2).exe (PUP.BundleInstaller.OI) -> Quarantined and deleted successfully.
C:\Users\G\Downloads\GameNutt_UnlockGames (3).exe (PUP.BundleInstaller.OI) -> Quarantined and deleted successfully.
C:\Users\G\Downloads\GameNutt_UnlockGames (4).exe (PUP.BundleInstaller.OI) -> Quarantined and deleted successfully.
C:\Users\G\Downloads\GameNutt_UnlockGames.exe (PUP.BundleInstaller.OI) -> Quarantined and deleted successfully.
C:\Users\G\Downloads\MyTopFreeGames_UnlockGames_2.exe (PUP.BundleInstaller.OI) -> Quarantined and deleted successfully.

(end)

kevinf80 · February 14, 2014

What is the status of your system, any remaining issues or concerns...

callandor21 · February 14, 2014

Thanks again for your help. I have been able to do things now that I wasn't able to before like install a new antivirus, Avast, and run Adwrcleaner. Nothing is noticeably wrong at the moment. Hopefully things are all good now. Just running an antivirus scan and full scan with Malwarebytes. Thanks.

kevinf80 · February 14, 2014

Ok we clean up, as follows please:

Remove Combofix now that we're done with it

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
Please follow the prompts to uninstall Combofix.
You will then receive a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

Next,

We need to remove FRST, first it is very important to deal with its own Quarantine folder by using FRST itself..

OK, we continue:

Delete any fixlist.txt file previously used, continue:

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). That will confirm the removal action, delete if successful.

Next,

Delete FRST.exe from your Desktop or the folder it was saved to, navigate to and delete its folder C:\FRST

Next,

Download "Delfix by Xplode" and save it to your desktop.

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

Remove disinfection tools
Purge System Restore

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Let me know if those steps complete ok, also if any remaining issues or concerns.....

Kevin..

fixlist.txt

callandor21 · February 14, 2014

I was able to delete FRST and run Delfix. However, Windows was unable to locate Combofix through the Run menu.

Also, the only problem I have noticed is with Internet Explorer. It isn't working at all. After I run it, a browser window opens up. But when I type something into the URL window and try to visit the site, the program locks up. Chrome works just fine, as does Firefox.

kevinf80 · February 14, 2014

Run the following will remove any remnants of Combofix...

Download OTC by OldTimer from here http://oldtimer.geekstogo.com/OTC.exe or here http://www.itxassociates.com/OT-Tools/OTC.exe and save to your Desktop.
Double click icon to start the program.
If you are using Vista or Windows 7 accept UAC
Then Click the big button.
You will get a prompt saying "Begining Cleanup Process". Please select Yes.
Restart your computer when prompted.
This will remove tools we have used and itself.

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

Any tools/logs remaining on the Desktop or downloads folder can be deleted.

Next,

Go here: http://support.microsoft.com/kb/923737 follow instructions and reset IE to default settings. Does now work ok...

callandor21 · February 15, 2014

Thank you again for your help. I was able to get IE working properly and everything looks in order. Everything looks in working order.

Infected: Cannot install Malwarebytes, Error 183

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information