PC Optimizer Pro remnants prevent Malwarebytes install

[kevinf80]

The OS has only service pack one installed, probably a good idea to install Service Pack 2 (SP2) When complete try Mlwarebytes again....

 

Service packs available here: http://windows.microsoft.com/en-GB/windows/service-packs-download#sptabs=vista

[brownbummer]

I'm very sorry to say that installing the service pack didnt work either, I get the same damned prompt. I thought I'd run the Clean Tool again, reboot and try installation from Chamelen. I started this last night but only had time to get through 5 steps.

 

I will try this again this morning.

 

Apart from this I can see that the install of IE on this laptop is is "infected" with something that gives false results for Google searches and attempts to send to wrong locations. Would it make sense to just uninstall IE and install Firefox or would the issues likely remain?

[brownbummer]

I've gone thru Chameleon setup again and still get the same error message. Any further ideas on this?

[kevinf80]

 

Apart from this I can see that the install of IE on this laptop is is "infected" with something that gives false results for Google searches and attempts to send to wrong locations.

 

I was not aware there was a redirection issue with this system, run the following please and post the produced logs....

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

 

• 
  

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Post back the report which should be located on your desktop.

 

Next,

 

Download TDSSKiller and save it to your Desktop.

 

Make sure TDSSKiller.exe  is on the Desktop itself, not within a folder on the desktop.

 

Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

 

"%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt

 

If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.

If Malicious objects are found, do NOT select Delete or Cure. Change the action to Skip, When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

 

Kevin

[brownbummer]

Here are the logs from RogueKiller and TDSS

RKreport_SCN_06252014_175131.log

TDSSKiller.txt

[kevinf80]

1.Download Malwarebytes Anti-Rootkit from this link:

 

 http://www.malwarebytes.org/products/mbar/

 

2. Unzip the File to a convenient location. (Recommend the Desktop)

3. Open the folder where the contents were unzipped to run mbar.exe

 

 

4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:

 

 

5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

 

6. The following image opens, select Next.

 

 

7. The following image opens, select Update

 

 

8. When the update completes select Next.

 

 

9. In the following window ensure "Targets" are ticked. Then select "Scan"

 

 

10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed.

 

 

11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process.

12. If no threats were found you will see the following image, Select Exit:

 

 

13. Verify that your system is now running normally, making sure that the following items are functional:

 

• 
       
• Internet access
       
• Windows Update
       
• Windows Firewall
  

 

14.  If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder.

 

15. Select "Y" from your Keyboard, tap Enter.

 

16. The fix will be applied, select any key to Exit.

 

17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder:

 

System - log

Mbar - log   Date and time of scan will also be shown

 

Thanks,

 

Kevin...

[brownbummer]

I ran MB Anti Rootkit 4 times. Nothing was found. The logs are below. I also ran the fix damage option.

My remaining concern is that something is not allowing Windows Defender to turn on or Malwarebytes to install. After the first scan I got  screen A when trying to turn on WD. After running the fixdamage option in MB Anti RootKit I git screenshot B. Also after the fixdamage ,I launched IE which had updated to IE9. The owner of this laptop had installed Google Toolbar (I uninstalled it). I could go to the Google page but I got unexpected popovers ,one which asked me to install "Rapidload Stream Accelorator". which I suspect is just more malware.

The point is I cant tell which junk is just associated with that crappy toolbar and which is still showing up via lingering access from remnants of PC Optimizer.

At this point am I better off

a- redoing all of the virus dectectors you've had me try BUT actually deleting the issues

b - deleting IE9 and installing Firefox

c - Backing up as much as possible ,reformatting and installing Win 8

I just want to give this laptop back will Malwarebytes iinstalled  My firnd is not a tech person and she will need active protection

Thanks
 

mbar-log-2014-06-26 (18-28-11).txt

system-log.txt

[kevinf80]

Go here: http://support.microsoft.com/kb/931849 scroll to and run the "Fixit" tool..

 

Next,

 

Farbar scanner, for use when connection or redirect issues:

 

Download Farbar Service Scanner from here: http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and run it on the computer with the issue.

Make sure the following options are checked:

 

• 
  

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender

 

• 
  

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

 

Let me see the log from FSS in next reply..

 

Kevin

[brownbummer]

At the MS Support link ,I chose the do it yourself option as the Fixit button lead me to 1.a Java download,2 a dummy MS help desk. When doing it myself,I found that Windows Defender was already set to load automatically. It still wont turn on.

 

Here is the FSS log

[kevinf80]

I dont see the log from FSS?

[brownbummer]

Sorry

FSS.txt

[kevinf80]

Windows Defender is turned off because you have Microsoft Security Essentials installed, MSE has all of WD`s definitions included, hence it is turned off in the registry as indicated in FSS log

 

 

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

 

Next,

 

Boot into safe mode with networking, see if Malwarebytes will install in that mode...

 

Kevin

[brownbummer]

I get the same error

[kevinf80]

download Portable Windows Repair (all in one) from one of the following:

 

http://www.tweaking.com/content/page/windows_repair_all_in_one.html

http://www.majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html

http://www.bleepingcomputer.com/download/windows-repair-all-in-one-portable/

 

Unzip the contents into a newly created folder on your desktop.

 

Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"

 

 

 

 

From the main GUI do the following:

 

 

Select Tab 2 and allow it to run Disk check

 

 

 

 

Select Tab 3 and allow it to run SFC

 

 

 

 

Select Tab 4 and Create System Restore Point

 

 

 

 

Select Repairs tab => Click the Start

 

 

 

 

The repairs window will open, Check the boxes as indicated, also the "Restart" options, the select Start...

 

 

 

 

DON'T use the computer while each scan is in progress.

 

Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log

 

Next,

 

Run the mbam-clean.exe one more time, see if Malwarebytes will now install...

[brownbummer]

YEAAAAAHHHHHH !!!!!!!!!!

 

Finally, MB installed. I cant say enough about your tenacity on this. My hand was shaking when I hit the MB install as I didnt think it would work yet again. I ran MB ,here is the MB Scan log also.

 

Thanks again for all the help . I'll insist that she buy a copy of MB and make a contribution to you guys also

 

Do you think I should install Firefox at this point. IE has upgraded to IE9 and looks okay as far as redirects. I'm guessing that having had the Google Toolbar means that any searches using IE will always revert to targeted ads as the first results. Doesnt seem to be a big deal just annoying. For example I just searched for the site Who Sampled Who and the first result was the site , as expected. However a second later the results switched to targeted ads , the first one was still the Who Sampled Who site.Like I said ,so far just annoying

_Windows_Repair_Log.txt

MB 1st scan.txt

[kevinf80]

Download and run this:

 

http://download.bleepingcomputer.com/sUBs/CF_UNINST.EXE

 

That will remove Combofix and associated folders...

 

Next,

 

Download "Delfix by Xplode" and save it to your desktop.

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

 

•  

     

• Activate UAC

   

     

• Remove disinfection tools

   

     

• Create registry backup

   

     

• Purge System Restore

   

     

• Reset system settings

   

   

 

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

 

Next,

 

This is my security set up for Windows 7, Vista will be the same....

 

Windows own Firewall, Microsoft Security Essentials and Malwarebytes Pro. Windows FW and MSE are free, MB does also have a free version, however I prefer the pro version as it provides auto updates and realtime protection.

 

As an extra layer I also use WinPatrol, the free version is adeqaute for general home use. Available here: http://www.winpatrol.com/download.html

 

For my browser I use Firefox with these addons: Web of Trust, Adblock Plus, Flash Block, NoScipt, Ghostery. When Firefox is open select these keys together :- Ctrl - Shift - A that will access Addons manger, this gives access to find addons, use, start, stop or disable those features etc....

Before using NoScript read from this link http://noscript.net/ makes it easy to understand....

 

Understanding Windows 7 Firewall - http://windows.microsoft.com/en-GB/windows7/Understanding-Windows-Firewall-settings

 

Understanding Microsoft Security Essentials - http://www.microsoft.com/en-gb/security/pc-security/mse.aspx

 

Understanding Malwarebytes, how to create an exclusion in MSE - http://forums.malwarebytes.org/index.php?showtopic=10138&st=0&p=162100entry162100

 

Understanding WinPatrol - http://www.winpatrol.com/features.html

 

I also use the Professional version of Sandboxie, I believe there is also free version available. Visit this link http://www.sandboxie.com/ for access to d/l, also make sure to use the "Help and FAQ" option to understand its uses, specifically how to run your browser sandboxed!.

 

I have also just started using CryptoGuard by Hitman Pro, once installed it will protect all Browsers against crypto ransomware infections, is also free. Go to following link for instructions, it will work with the set up I describe above..

 

http://www.surfright.nl/en/alert/cryptoguard'>http://www.surfright.nl/en/alert/cryptoguard

 

Let me know if any remaining issues or concerns.....

 

Kevin....

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!