Scheduler does not seem to be working - AdvancedSetup requested

[roraww]

I have scheduled tasks within Malwarebytes to check for updates, run threat scans, and run custom scans but the tasks do not occur until I log into the server and run them manually.

 

This instance of Malwarebytes is running on Windows 8.1 64 bit Operating System running as a virtual machine (in VMWare).

 

Support recommended re-installation:

I ran mbam-clean, re-installed and activated. The same scheduler issues occur.

 

Support is claiming that my machine is entering Sleep/Hibernation mode.

I have no events in the Windows Event Log that indicate the device ever enters Sleep mode.

 

I haven't had any luck with Support responding recently so I thought I would reach out to the community forum.  I have attached the original screenshots to the case.  Notice the Scheduler will run a scan if a new task is added but the "Next Scheduled Scan" date remains in the past.  The CheckResults logs are also from the original case, I can provide updated logs files/screenshots if necessary. Can someone assist with my issue?

 

Thanks in advance!

 

 

 

Not really sure what's going on here yet but if you want me to take a look at it further then I'll need you to create a new topic in the malware removal forum as we cannot run many things in this forum. Over there I can give you one-on-one assistance.

Please start a new topic in this forum section and specifically say that I asked you to

 

[AdvancedSetup]

Let's make sure there is not something there blocking our tool.  Please go ahead and run through the following steps and post back the logs when ready.
 
STEP 04
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

STEP 06
Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkits, Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. Remove any threats found
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.


STEP 07


Please go here to run the online antivirus scannner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked
• Click on Advanced Settings and ensure these options are ticked:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Click Scan
• Wait for the scan to finish
• If any threats were found, click the 'List of found threats' , then click Export to text file....
• Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 08
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
• If you've ran the tool before then you'll need to manually place a check mark in the ADDITIONS.TXT check box to get that log

 

 

 

[roraww]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.1 (12.28.2014:1)

OS: Windows 8.1 Pro x64

Ran by Rorik on Tue 01/13/2015 at 20:06:42.70

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Tue 01/13/2015 at 20:10:47.66

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[roraww]

# AdwCleaner v4.107 - Report created 13/01/2015 at 20:13:50

# Updated 07/01/2015 by Xplode

# Database : 2015-01-13.2 [Live]

# Operating System : Windows 8.1 Pro  (64 bits)

# Username : Rorik - WIN8_VM

# Running from : C:\Users\Rorik\Downloads\AdwCleaner.exe

# Option : Scan

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17416

 

 

-\\ Google Chrome v39.0.2171.95

 

[C:\Users\Leslie\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\Leslie\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://www.ask.com/web?q={searchTerms}

 

*************************

 

AdwCleaner[R0].txt - [878 octets] - [13/01/2015 20:13:50]

 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [937 octets] ##########

[roraww]

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 1/13/2015

Scan Time: 8:19:55 PM

Logfile: MBAM_Threat_Scan.txt

Administrator: Yes

 

Version: 2.00.4.1028

Malware Database: v2015.01.13.19

Rootkit Database: v2015.01.07.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Enabled

 

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Rorik

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 363893

Time Elapsed: 6 min, 57 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[roraww]

Attached the output of ESET as a screenshot.

 

No threats found.

[roraww]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015

Ran by Rorik at 2015-01-13 21:12:50

Running from C:\Users\Rorik\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

iSEEK AnswerWorks English Runtime (HKLM-x32\...\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: 010.000.0101 - Vantage Linguistics)

Malwarebytes Anti-Exploit version 1.05.1.1016 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.05.1.1016 - Malwarebytes)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft Office Professional Plus 2013 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Project Professional 2013 - en-us (HKLM\...\ProjectProRetail - en-us) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Quicken 2013 (HKLM-x32\...\{034DD4BB-F0D6-4ECF-B064-8E39E3EF7076}) (Version: 22.1.12.7 - Intuit)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

 

==================== Restore Points  =========================

 

27-12-2014 04:17:29 Scheduled Checkpoint

05-01-2015 06:46:43 Scheduled Checkpoint

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {05B86013-28C8-4A87-884A-7BD4D354D229} - System32\Tasks\Malwarebytes Task => C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [2014-11-21] (Malwarebytes Corporation)

Task: {0E71B6D0-99E4-4181-800C-CD6897A1445B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {237A5110-CB2C-4430-A604-C9F05492E494} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-04] (Google Inc.)

Task: {38594FD3-47E2-4F8C-AFE9-992E1EB34AC2} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

Task: {80BAED39-3DCA-41F4-B995-AC534B8D61A6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-04] (Google Inc.)

Task: {A8777235-6666-4DBC-AF36-E24007C969D2} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-10] (Microsoft Corporation)

Task: {DF3B5864-7158-4CE3-9154-07C34FF2F2C6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2014-03-23 05:30 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2014-08-29 02:58 - 2014-09-23 08:36 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-08-29 02:58 - 2014-09-23 06:43 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2014-12-12 13:45 - 2014-12-05 20:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll

2014-12-12 13:45 - 2014-12-05 20:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll

2014-12-12 13:45 - 2014-12-05 20:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll

2014-12-12 13:45 - 2014-12-05 20:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-1908581369-813752509-1929277788-500 - Administrator - Disabled)

Guest (S-1-5-21-1908581369-813752509-1929277788-501 - Limited - Disabled)

Leslie (S-1-5-21-1908581369-813752509-1929277788-1002 - Administrator - Enabled) => C:\Users\Leslie

Rorik (S-1-5-21-1908581369-813752509-1929277788-1001 - Administrator - Enabled) => C:\Users\Rorik

 

==================== Faulty Device Manager Devices =============

 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (01/13/2015 08:31:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

 

 

System errors:

=============

Error: (01/13/2015 08:17:59 PM) (Source: DCOM) (EventID: 10010) (User: Win8_VM)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (01/13/2015 08:17:32 PM) (Source: DCOM) (EventID: 10010) (User: Win8_VM)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (01/13/2015 08:17:02 PM) (Source: DCOM) (EventID: 10010) (User: Win8_VM)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (01/13/2015 08:14:52 PM) (Source: DCOM) (EventID: 10010) (User: Win8_VM)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (01/13/2015 08:14:22 PM) (Source: DCOM) (EventID: 10010) (User: Win8_VM)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (01/13/2015 08:13:52 PM) (Source: DCOM) (EventID: 10010) (User: Win8_VM)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

 

Microsoft Office Sessions:

=========================

Error: (01/13/2015 08:31:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Rorik\AppData\Local\Temp\IDC2.tmp\ESETSmartInstaller.exe

 

 

CodeIntegrity Errors:

===================================

  Date: 2015-01-13 21:12:41.403

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-13 20:31:51.390

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-13 20:16:08.517

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-13 20:05:29.172

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-10 10:39:41.844

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-09 19:47:01.021

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-09 19:39:06.126

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-09 17:33:58.535

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-05 13:29:11.402

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-01-05 13:21:59.422

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core i7-3770 CPU @ 3.40GHz

Percentage of memory in use: 30%

Total physical RAM: 4095.49 MB

Available physical RAM: 2858.77 MB

Total Pagefile: 8191.49 MB

Available Pagefile: 6542.19 MB

Total Virtual: 131072 MB

Available Virtual: 131071.83 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:60 GB) (Free:34.1 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 60 GB) (Disk ID: 2E61C908)

Partition 1: (Active) - (Size=60 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

[roraww]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015

Ran by Rorik (administrator) on WIN8_VM on 13-01-2015 21:12:27

Running from C:\Users\Rorik\Desktop

Loaded Profile: Rorik (Available profiles: Rorik & Leslie)

Platform: Windows 8.1 Pro (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: "https://webaots.gcsc.att.com/tools/password/", "https://webaots.gcsc.att.com/threat/", "https://threat.gcsc.att.com/"

CHR Profile: C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-23]

CHR Extension: (Google Drive) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-23]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-31]

CHR Extension: (YouTube) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-23]

CHR Extension: (Google Search) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-23]

CHR Extension: (AdBlock) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-31]

CHR Extension: (Cargo Bridge: Armor Games Edition) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlpiaibleklmjieibbnmkignbggodmmj [2014-10-31]

CHR Extension: (Green Farm) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbgdenhobifcbckaiohandoodkepleif [2014-10-31]

CHR Extension: (Google Wallet) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-01]

CHR Extension: (Gmail) - C:\Users\Rorik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-23]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)

R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [555320 2014-12-10] (Malwarebytes Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2014-12-10] ()

R2 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

U4 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-13] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)

S3 vmusbmouse; C:\Windows\System32\drivers\vmusbmouse.sys [15512 2012-10-31] (VMware, Inc.)

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

S3 vmci; \SystemRoot\System32\drivers\vmci.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-13 21:12 - 2015-01-13 21:12 - 00009163 _____ () C:\Users\Rorik\Desktop\FRST.txt

2015-01-13 20:31 - 2015-01-13 20:31 - 00000000 __SHD () C:\Users\Rorik\AppData\Local\EmieBrowserModeList

2015-01-13 20:31 - 2015-01-13 20:31 - 00000000 ____D () C:\Program Files (x86)\ESET

2015-01-13 20:27 - 2015-01-13 20:27 - 00001054 _____ () C:\Users\Rorik\Desktop\MBAM_Threat_Scan.txt

2015-01-13 20:13 - 2015-01-13 20:14 - 00000000 ____D () C:\AdwCleaner

2015-01-13 20:13 - 2015-01-13 20:13 - 02191360 _____ () C:\Users\Rorik\Downloads\AdwCleaner.exe

2015-01-13 20:10 - 2015-01-13 20:10 - 00000626 _____ () C:\Users\Rorik\Desktop\JRT.txt

2015-01-13 20:06 - 2015-01-13 20:06 - 00000000 ____D () C:\WINDOWS\ERUNT

2015-01-13 20:05 - 2015-01-13 20:05 - 01707939 _____ (Thisisu) C:\Users\Rorik\Downloads\JRT.exe

2015-01-09 19:40 - 2015-01-13 21:12 - 00000000 ____D () C:\FRST

2015-01-09 19:39 - 2015-01-09 19:39 - 02124288 _____ (Farbar) C:\Users\Rorik\Desktop\FRST64.exe

2015-01-09 17:36 - 2015-01-09 17:39 - 00003292 _____ () C:\WINDOWS\System32\Tasks\Malwarebytes Task

2014-12-23 08:07 - 2015-01-13 21:08 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-12-23 08:07 - 2014-12-23 08:07 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-23 08:07 - 2014-12-23 08:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-23 08:07 - 2014-12-23 08:07 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-23 08:07 - 2014-12-23 08:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-23 08:07 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2014-12-23 08:07 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2014-12-23 08:07 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2014-12-23 08:05 - 2014-12-23 08:06 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Rorik\Downloads\mbam-setup-2.0.4.1028.exe

2014-12-23 08:00 - 2014-12-23 08:00 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Rorik\Downloads\mbam-clean-2.1.1.1001.exe

2014-12-20 10:24 - 2014-12-20 10:25 - 01682416 _____ (Malwarebytes Corporation) C:\Users\Rorik\Downloads\mbam-check-2.1.1.1001.exe

2014-12-19 13:55 - 2014-10-30 17:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2014-12-19 13:55 - 2014-10-30 17:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2014-12-19 10:01 - 2014-12-19 10:01 - 00000000 ____D () C:\WINDOWS\system32\appmgmt

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-13 21:01 - 2013-01-13 11:12 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1908581369-813752509-1929277788-1001

2015-01-13 21:00 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-01-13 20:45 - 2013-02-04 21:43 - 00000922 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-13 20:29 - 2013-02-04 21:43 - 00000918 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-13 20:25 - 2014-10-31 10:08 - 00003922 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{B0106D21-EE2E-4BEF-A773-678B8104E76C}

2015-01-13 20:19 - 2013-08-22 09:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-01-13 20:18 - 2014-10-30 23:10 - 01676444 _____ () C:\WINDOWS\WindowsUpdate.log

2015-01-13 20:18 - 2013-08-22 08:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2015-01-13 20:16 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-01-13 20:05 - 2014-10-31 10:16 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit

2015-01-13 17:57 - 2014-12-11 08:13 - 00003926 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{75A72E8E-5B7E-496B-9F65-12F165932AF5}

2015-01-10 10:40 - 2013-01-13 11:21 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1908581369-813752509-1929277788-1002

2015-01-02 19:19 - 2014-10-30 22:48 - 00000000 ____D () C:\Users\Leslie

2015-01-02 19:00 - 2014-09-24 02:03 - 00025376 _____ () C:\WINDOWS\PFRO.log

2014-12-31 06:14 - 2013-01-15 03:23 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2014-12-23 17:38 - 2013-02-02 14:52 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-12-20 21:30 - 2014-10-30 22:48 - 00000000 ____D () C:\Users\Rorik

2014-12-20 15:55 - 2012-07-26 02:59 - 00000000 ____D () C:\WINDOWS\CbsTemp

2014-12-20 15:29 - 2013-03-05 12:33 - 00000000 ____D () C:\Users\Leslie\Desktop\Investments

2014-12-19 10:07 - 2014-09-24 02:17 - 00818732 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-12-19 10:01 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\Registration

2014-12-19 09:53 - 2013-08-22 09:46 - 00356091 _____ () C:\WINDOWS\setupact.log

2014-12-18 20:27 - 2014-10-31 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit

2014-12-18 20:27 - 2014-10-31 10:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Exploit

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-01-13 21:01

 

==================== End Of Log ============================

[roraww]

mbam-check result log version:     2.1.1.1001

========================================

 

User Account type:                 Administrator

OS:                                Windows 8.1  64 bit Operating System

Current Version and Build:         6.3.9200.0 

Malwarebytes Anti-Malware:         2.0.4.1028

Installed On:                      2014/12/23

Malware Database:                  0000.00.00.00

Rootkit Database:                  0000.00.00.00

Remediation Database:              0000.00.00.00

IP Database:                       0000.00.00.00

Domain Database:                   0000.00.00.00

License:                           Premium

Malware Protection:                4 (The service is running.)

Malicious Website Protection:      4 (The service is running.)

Chameleon:                         4 (The service is running.)

Log Created:                       2015/01/13 21:18:37

Compatibility Flag Settings:

=================================

 

This log just for re-check, databases are still all zero'd out.  Full CheckResults attached.

[roraww]

mbam-check result log version:     2.1.1.1001

========================================

 

User Account type:                 Administrator

OS:                                Windows 8.1  64 bit Operating System

Current Version and Build:         6.3.9200.0 

Malwarebytes Anti-Malware:         2.0.4.1028

Installed On:                      2014/12/23

Malware Database:                  0000.00.00.00

Rootkit Database:                  0000.00.00.00

Remediation Database:              0000.00.00.00

IP Database:                       0000.00.00.00

Domain Database:                   0000.00.00.00

License:                           Premium

Malware Protection:                4 (The service is running.)

Malicious Website Protection:      4 (The service is running.)

Chameleon:                         4 (The service is running.)

Log Created:                       2015/01/13 21:18:37

Compatibility Flag Settings:

=================================

 

This log just for re-check, databases are still all zero'd out.  The full CheckResults is attached for review.

CheckResults_1-13-2015.txt

CheckResults_1-13-2015.txt

[AdvancedSetup]

Please run the following.

SFC /SCANNOW Command

http://www.eightforums.com/tutorials/3047-sfc-scannow-command-run-windows-8-a.html

Please use option one To Run SFC /SCANNOW Command at Boot

If it finds a lot of errors then you'll need to run this

http://www.eightforums.com/tutorials/26512-dism-fixing-component-store-corruption-windows-8-a.html

Let me know how that goes please

[roraww]

I ran sfc /scannow a few times.  For whatever reason F8 doesn't seem to send when the virtual machine is booting so I'm not sure if sfc during boot is going to work.

 

CBS.log is attached.

 

C:\>sfc /scannow

 

Beginning system scan.  This process will take some time.

 

Beginning verification phase of system scan.

Verification 100% complete.

 

Windows Resource Protection found corrupt files but was unable to fix some

of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For

example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not

supported in offline servicing scenarios.

 

 

C:\WINDOWS\system32>sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

 

The arguments passed to sfc are invalid.  The offline windows directory

specified points to the online system.

 

C:\WINDOWS\system32>sfc /scannow /offbootdir=C:\ /offwindir=C:\windows

 

The arguments passed to sfc are invalid.  The offline windows directory

specified points to the online system.

 

 

CBS.log

[AdvancedSetup]

Are you using VMware Workstation

In order to access the F8 repair on VMware you'll probably need to edit your "vmware computer name.vmx" file to add something like this which will delay it from starting for 5 seconds. Once done here though and the computer is working well you really should look at using SnapShots which you can use to go back in time.

bios.bootDelay ="5000"


Accessing the BIOS when the POST screen clears too quickly (1004129)
http://kb.vmware.com/selfservice/search.do?cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=1004129


Booting a Windows guest operating system into Safe Mode (1004011)
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004011



From there you should be able to use the F8 Repair method.

[roraww]

I have been unable to boot into safe mode using F8.  I can F2 and F12 but not F8 (that skips right past POST and goes to the normal login screen).

 

I will try a few more times tomorrow.

[AdvancedSetup]

Are you using VMware?

Did you edit the file as requested?

[roraww]

I am using VMWare Player so I can't use snapshots.

 

I did edit the .vmx file and can send F2 and F12 during boot but F8 sends me directly to the normal login screen.  I haven't had time to fiddle yet today but will attempt again this afternoon.

[roraww]

For what it's worth, I have symptoms with the scheduler very similar to https://forums.malwarebytes.org/index.php?/topic/163681-scheduled-scans-problems/as well.

[AdvancedSetup]

I did not check but maybe I need to see if that user is also using VMware player. May I ask where, why you use this instead of a real Workstation or a real OS ? Was this pushed out for use by your IT Department?

I'll report this to QA but beyond that if we can't get into Recovery Console to fix the OS files we may be at a stand still and you may have to get a new instance of your vmplayer

[AdvancedSetup]

Well the good news is that QA was able to reproduce this issue. The bad news is that it we will not be able to correct this until the next program update. This is hopefully expected in March. There will be a new beta before then so if possible I'd suggest you monitor the site and participate in the beta and let us know if that corrects the issue for you or not.

As for infections the computer appears to be clean from infections at this time.


At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.


If there are any other left over Folders, Files, Logs then you can delete them on your own.

Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP


As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.

• How Malware Spreads - How did I get infected
• Best Practices for Safe Computing - Prevention of Malware Infection
• Avoiding those unwanted free applications
• A close look at how Oracle installs deceptive software with Java updates
• IAC / Ask.com toolbars
• Malwarebytes Unpacked Blog

If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.

[roraww]

Hi Ron,

 

Thanks for the update and apologies for the late reply. With regard to VMPlayer I had to consolidate the amount of metal I had in the house (no IT department involved, just me).

 

I did install a trial version of ESET just to see if another program had the same issue however scan logs indicate that all scheduled tasks for ESET occur.

 

I can run the scans and update Malwarebytes manually until the new release and will research and participate in Beta access, I'm a huge fan of Malwarebytes (I have it installed and working successfully on several other laptops and desktops).

 

Thank you for your assistance on this issue.

 

Best Regards,

Rorik

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!