PC Infected Can't Download Malwarebytes

[rachelxiques]

I have a virus/malware on my laptop. PC Tech & Optimize Your PC have been installed/downloaded and TrendMicro did not catch it before they were installed.

Here's what is happening:  I have 3 tabs at the top of my google chrome the first one is Facebook then 2 Google tabs.The FB tab is working just fine, I can update FB, check status, etc. (which I think is weird)

If I select tab #2 Google, google comes up, I then type in a webpage, it pulls up the page listing all the sites, when I click on the link I want this is when I get the error "THIS WEBPAGE IS NOT AVAILABLE" RELOAD OR MORE". When I select more I see

Error code: ERR_CONNECTION_RESET. 

I was able to get to this forum by going to Malwarebytes Facebook page, someone then responded to my post and posted a link. Some how it let me select the link and I was able to setup an account and post to this forum. 

Someone then posted to my original post and they also had a link to "Available Assistance for Possibly Infected Computers" . 

when I tried to open that link I got the above error. So, I pulled it up on my ipad to get the instructions on what to do! 

 

How do I download malwarebytes onto my computer if I can't get a webpage to open so I can have access to download it? 

 

I have some computer knowledge but this kind of stuff is dumbfounding to me and makes me alittle nervous! Help! Aggravated! Thanks in advance!

[MrCharlie]

Welcome to the forum.

Do you have a good system restore point...if so try to restore the computer.

You can also try safe mode with network support.

If you have access to another computer and a usb flash drive..try this:

 

Download FRST to the flash drive and then plug it into the sick computer and run a scan as outlined:

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button. (make sure the Addition box is checked)
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

MrC

[rachelxiques]

Mr. C

 

Thank you for your response attached are the 2 files that FRST created.

 

Addition.txt

FRST.txt

[MrCharlie]

Please uninstall all of these from your add/remove programs:
Catalina Savings Printer
jZip
Groovorio
Zip Opener Packages
PC Fix Speed

------------------------------------

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.
Run FRST.exe/FRST64.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

MrC

[rachelxiques]

I am still working on Step 1; I have been able to uninstall everything EXCEPT Groovorio.

 

When trying to install it I continue to receive an error which I have attached. 

 

To my knowledge all browsers are closed, I check under Task Manager and the thing I saw was the explorer.exe

 

When I ended the explorer.exe my screen went to the windows flag with no options available, no tab, no icons, no folders no toolbars.

 

To correct this I had to do a force restart.

 

Any suggestions on what I need to do to uninstall this Groovorio file?

 

 

[MrCharlie]

You can try this program or just skip it for now:

 

Please download and install Revo Uninstaller Free
http://www.revouninstaller.com/start_freeware_download.html

Double click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
When the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
When prompted click on Yes and then on next.
Put a check on any folders that are found and select delete
When prompted select yes then on next
Once done click Finish.

MrC

[rachelxiques]

Ok that worked here are the new FRST reports

Addition.txt

FRST.txt

[MrCharlie]

You never completed the FRST step with the fixlist.txt:

https://forums.malwarebytes.org/index.php?/topic/154399-pc-infected-cant-download-malwarebytes/?p=862922

MrC

[rachelxiques]

Attached is the fixlog.txt

Fixlog.txt

[MrCharlie]

Are you able to get online now?????

If so.....

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

http://www.bleepingcomputer.com/download/combofix/dl/12/ <---ComboFix direct download

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

 

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[rachelxiques]

Sorry it has taken me a few days on this. 

 

Can I get online now? - Yes & No

I can access the internet by typing in a webpage example  - if I type in my bank, I can get to online banking, put in my pass word and access my account and everything is up to date and current I can browses the web page BUT I could NOT click on the link or get bleepingcomputer to allow me to connect that you attached on your last response I had to download ComboFix on another computer put it on a USB then run it on my computer.

Attached is the report it issued. 

ComboFix.txt

[MrCharlie]

bleepingcomputer was down for maintenance, it's back now.

If the browser you are using is Internet Explorer...please reset it, see if that fixes the issues:

http://malwaretips.com/blogs/reset-internet-explorer-settings/

MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[rachelxiques]

Mr. C

 

Thank you so much for all your help and patience! I believe it is fixed!

 

I was able to click on the link in your email and it to me to the site with out any problems. I have also been able to move around on other sites as well! 

 

Again, thank you! You can go ahead and close this ticket. 

 

Rachel 

[MrCharlie]

OK....

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter. (it may look like CF is re-installing but it's not)

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:

If you used FRST and can't delete the quarantine folder:

Download the fixlist.txt to the same folder as FRST.exe.

Run FRST.exe and click Fix only once and wait

That will delete the quarantine folder created by FRST.

The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!