Kiyah Posted October 16, 2015 ID:995993 Share Posted October 16, 2015 Hello,I first noticed that my computer was infected when Opera always failed to update whenever I attempted to. I tried reinstalling Opera but then the installation failed. I currently have Webroot SecureAnywhere and Iobit Malware Fighter installed but they came up with nothing when I scanned for malware. I also had Malwarebytes installed before but it had failed to open so I tried reinstalling this too; it completed but gave me this error and also failed to open still: Internal error: Expression error 'Runtime Error (at 59:89): External exception E06D7363.' So then I tried to open it with Malwarebytes Chameleon but it said Malwarebytes still terminated and failed to scan even in safe mode. I ran Rkill.exe but this didn't work either. Help is appreciated! Thanks.Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 16, 2015 ID:995994 Share Posted October 16, 2015 Hello, They call me TwinHeadedEagle around here, and I'll try to help your with your issue. Before we start please read and note the following:We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.Note that we may live in totally different time zones, what may cause some delays between answers.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! Rules and policies We won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding! Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Scan with ZOEKPlease download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)Temporary disable your AntiVirus and AntiSpyware protection - instructions here.createsrpoint;autoclean;emptyclsid;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";bRight-click on icon and select Run as Administrator to start the tool.Wait patiently until the main console will appear, it may take a minute or two.In the main box please paste in the following script:Make sure that Scan All Users option is checked.Push Run Script and wait patiently. The scan may take a couple of minutes.When the scan completes, a zoek-results logfile should open in notepad.If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)Post its content into your next reply. Link to post Share on other sites More sharing options...
Kiyah Posted October 16, 2015 Author ID:996018 Share Posted October 16, 2015 Thank you for your reply TwinHeadedEagle, I attached the zoek log.zoek-results.log Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 16, 2015 ID:996067 Share Posted October 16, 2015 Good. How is the situation now? Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File).Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content into your next reply. Link to post Share on other sites More sharing options...
Kiyah Posted October 17, 2015 Author ID:996080 Share Posted October 17, 2015 Malwarebytes still won't open after the scan but I'm not sure if this is due to the internal error I recieved when I installed it. I looked at Process Hacker and saw that mbam.exe was created but soon disappeared after a few seconds.Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 17, 2015 ID:996157 Share Posted October 17, 2015 I do not recommend usage of IOBIT products, they have bad reputation, and are prone to create problems. That is why I suggest to uninstall: - Advanced SystemCare 8 - Driver Booster - Game Booster - IObit Malware Fighter - IObit Uninstaller - Smart Defrag 2 - Surfing Protection When you see a word "Booster", "Optimizer", "TuneUp" or similar it is often some kind of silly application. You cannot "boost" you system more than it actually is. Microsoft optimized Windows perfectly and they are constantly working on improvements, so these tools are just selling you nothing but "fog". Only way to actually boost your system is to upgrade your hardware by adding SSD, more processor power or more ram memory. Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please upload it to your reply. Uninstall outdated Malwarebytes' Anti-Malware Please download MBAM-clean and save it to your desktop.Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.It will ask you to reboot the machine - please do so.After that follow my next instructions to download & install the newset MBAM version. Scan with Malwarebytes' Anti-Malware Please download Malwarebytes Anti-Malware and save it to your desktop.Install the progam and select update.Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.Click the Scan tab, choose Threat Scan is checked and click Scan Now.If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.Upon completion of the scan (or after the reboot), click the History tab.Click Application Logs and double-click the Scan Log.At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply.fixlist.txt Link to post Share on other sites More sharing options...
Kiyah Posted October 17, 2015 Author ID:996236 Share Posted October 17, 2015 I uninstalled the programs and ran the fix for farbar. I used the mbam-clean but when I installed Malewarebytes it gave me this error: Internal error: Expression error 'Runtime Error (at 63:137): External exception E06D7363.' I couldn't do the scan with Malwarebytes as it still failed to open. Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 17, 2015 ID:996237 Share Posted October 17, 2015 Did you download latest MalwareBytes build: 2.2.0.1024? Link to post Share on other sites More sharing options...
Kiyah Posted October 17, 2015 Author ID:996241 Share Posted October 17, 2015 Yes Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 17, 2015 ID:996265 Share Posted October 17, 2015 Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File).Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content into your next reply. Link to post Share on other sites More sharing options...
Kiyah Posted October 17, 2015 Author ID:996284 Share Posted October 17, 2015 I ran the scan and attached the logs.Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 17, 2015 ID:996287 Share Posted October 17, 2015 Can you perform MalwareBytes uninstall again, using the mbam-clean tool? Link to post Share on other sites More sharing options...
Kiyah Posted October 17, 2015 Author ID:996291 Share Posted October 17, 2015 Ok, I uninstalled it it using mbam-clean. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 18, 2015 ID:996348 Share Posted October 18, 2015 Can you now open MalwareBytes? Link to post Share on other sites More sharing options...
Kiyah Posted October 18, 2015 Author ID:996360 Share Posted October 18, 2015 When I installed it again it still gave me the internal error and it wouldn't open when I try to launch it. The mbam.exe process does start but still terminates after a while without Malwarebytes popping up. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 19, 2015 ID:996503 Share Posted October 19, 2015 Check DiskPress the + R on your keyboard at the same time. Type cmd and click OK.Copy/Enter the command below and press Enter:chkdsk C: /rYou should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.Check Disk report:Press the + R on your keyboard at the same time. Type eventvwr and click OK.In the left panel, expand Windows Logs and then click on Application.Now, on the right side, click on Filter Current Log.Under Event Sources, check only Wininit and click OK.Now you'll be presented with one or multiple Wininit logs.Click on an entry corresponding to the date and time of the disk check.On the top main menu, click Action > Copy > Copy Details as Text.Paste the contents into your next reply. Link to post Share on other sites More sharing options...
Kiyah Posted October 20, 2015 Author ID:996662 Share Posted October 20, 2015 I was unable to perform the disk check as it never scanned after a restart. I have tried solutions at http://www.vistax64.com/tutorials/130824-chkdsk-will-not-run-startup-vista.htmlbut to no avail. I am starting to think my computer may not be infected at all but is corrupt in some way. However I once tried installing McAfee but couldn't initailize the installation due to a problem cleaning threats which lead me to believe that something was stopping antiviruses including Malwarebytes to scan and find the malware. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 20, 2015 ID:996719 Share Posted October 20, 2015 Why are you unable to run chkdsk? Link to post Share on other sites More sharing options...
Kiyah Posted October 20, 2015 Author ID:996784 Share Posted October 20, 2015 I was originally unable to run chkdsk because the "autochk.exe" file was corrupt according to an sfc scan. I replaced the corrupt "autochk.exe" with a clean one that was the same version as the one I had and the chkdsk ran when I restarted. I attached the results.chkdsk details.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 20, 2015 ID:996867 Share Posted October 20, 2015 Can you now try to reinstall and open MalwareBytes? Link to post Share on other sites More sharing options...
Kiyah Posted October 20, 2015 Author ID:996896 Share Posted October 20, 2015 I used mbam-clean and reinstalled it in normal mode and safe mode but the runtime error still appeared and Malwarebytes didn't open. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 22, 2015 ID:997239 Share Posted October 22, 2015 Can you run MalwareBytes clean tool two times? Link to post Share on other sites More sharing options...
Kiyah Posted October 22, 2015 Author ID:997255 Share Posted October 22, 2015 I did the mbam-clean twice, restarting each time but still couldn't open it. In case you didn't want me to reinstall Malwarebytes I ran the mbam-clean twice again Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 23, 2015 Root Admin ID:997345 Share Posted October 23, 2015 Hi there. I will go ahead and assist and see if I can help you. Please run the MBAM CLEAN tool 2 times. Reboot after each run. Then DO NOT reinstall MBAM. Please run the following tool after the removal and post back the log. Please create an mbam-check log:Download mbam-check.exe from here and save it to your desktopDouble-click on mbam-check.exe to run it, it should then open a log filePlease do not copy and paste the entire contents of the log into your next post, instead please attach the log CheckResults.txt file which should now be located on your desktop to your next postThank you Link to post Share on other sites More sharing options...
Kiyah Posted October 23, 2015 Author ID:997472 Share Posted October 23, 2015 Hello. I attached the log.CheckResults.txt Link to post Share on other sites More sharing options...
Recommended Posts