No internet access & abengine.dll problem after Malwarebytes scan

[wooody]

Have had persistent problem with adware and pop-ups so ran scan with malwarebytes (also running Microsoft Security Essentials).  Found large number of threats which I deleted. After completing the scan I kept getting a Malwarebytes pop-up window detailing a problem with abengine.dll.

 

Since doing this I have had no internet access.  Tried troubleshooting internet connection: no problem found.  Tried system restore back 5 days: still no internet.

 

On restarting computer I get an error message: 'Main message window: NvBackend.exe - Bad image.  C:\Windows\system32\abengine.dll is either not designed to run on Windows or it contains an error.   Try installing the program again using the original installation media or contact your system administrator or the software vendor for support'

 

Any help please?

[wooody]

Sorry, hadn't read the sticky with instructions to add logs from Farbar.  Here they are:

 

FRST.txtAddition.txt

 

[MrCharlie]

Make sure you have created a restore point and.....
Download Delfix from Here and save it to your desktop.

• Place a check mark in front of .......
• Create registry backup <---only!
• Uncheck the rest!
• Click the Run button.
  
  Close the tool out when it's done....we'll use it later.
  
  ============================
  
  Please uninstall these if possible form your add/remove programs:
  
  buyfaSt
  Coupoon version 1.0
  Facebook Chat Meme Codes
  lowpricEs
  offerrdeAl
  offersalle
  quiccKshOOpa
  RelayDouble saaleoffer
  salePrizesi Software Version Updater
  The Idle-Crawler Updater
  TrimModule
  VIS
  
  =============================
  
  Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.
  Run FRST.exe/FRST64.exe and click Fix only once and wait
  The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.
  
  ==========================
  
  Lets check for any adware/spyware now:
  
  Please download AdwCleaner from HERE or HERE to your desktop.
  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program that may have been targeted by mistake.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are either adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
  Next..................
  
  Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
  Next.........
  
  Please Update and run a Threat Scan (Malwarebytes)
  Click on settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware
  Same for PUM (Potentially Unwanted Modifications)
  Quarantine All that's found
  
  MrC
  
  
  
   

fixlist.txt

[wooody]

Thankyou for your help MrC: I see light at the end of the tunnel :-)

 

Done all that, used Revo to remove those programs.  

 

Malwarebytes just finishing off..

 

 

Fixlog.txt

JRT.txt

AdwCleanerS0.txt

[wooody]

Off to bed: past midnight here in UK.  Many thanks so far, internet working again     

 

BTW have turned Microsoft Security Essentials back on.

[MrCharlie]

Great!  That's Good News!!!

Please re-scan with FRST and Make sure the Addition Box is checked.

http://www.fixitpc.pl/picasso/images/malware/tools/frst/frst_win05.png

Post or attach the 2 logs FRST.txt and Addition.txt

MrC

[wooody]

No abengine.dll error message on start-up now. 

 

But getting pop-up ads in Chrome, I looked in extensions and there are 'earnsale' and '?Smshare SMS and Social Media Share' which I've unchecked so they are not enabled.

 

Logs attached:

 

Addition.txt

 

FRST.txt

[MrCharlie]

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.
Run FRST.exe/FRST64.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

================================

CHR dev: Chrome dev build detected! <======= ATTENTION

Chrome has to be re-installed, it's be compromised by the malware:

https://support.google.com/chrome/answer/95319?hl=en<---re-install chrome
https://support.google.com/chrome/answer/95346?hl=en<---download

================================

Let me know how it is, MrC

fixlist.txt

[wooody]

OK all done without a hitch. Feeling bathed in that light from the end of the tunnel now... 

 

Here's the log:

 

Fixlog.txt

[MrCharlie]

Good...if there's no other problems;

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• If you can't post it, attach it

MrC

[wooody]

Here you go:

 

 Results of screen317's Security Check version 1.003  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

Microsoft Security Essentials   

 Antivirus up to date!  

`````````Anti-malware/Other Utilities Check:````````` 

 Java 7 Update 55  

 Java version 32-bit out of Date! 

 Adobe Flash Player 17.0.0.169  

 Mozilla Firefox (3.6.15) Firefox out of Date!  

 Google Chrome (43.0.2357.81) 

````````Process Check: objlist.exe by Laurent````````  

 Microsoft Security Essentials MSMpEng.exe 

 Microsoft Security Essentials msseces.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Malwarebytes Anti-Malware mbamscheduler.exe   

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 2% 

````````````````````End of Log`````````````````````` 

[MrCharlie]

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

==================================

Java 7 Update 55 <-------Download and install the latest version (Java™ 8 Update 45) from Here. Uncheck the box to install the Ask toolbar!!!, McAfee Security Scan Plus or any other free "stuff".

=======================

Mozilla Firefox (3.6.15) Firefox out of Date! <----please check for an update if available.

======================

A little clean up to do....

Please Uninstall ComboFix: (------->if you used it<-------)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter. (it may look like CF is re-installing but it's not)

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!