MBAM won't start - Chamelon didn't work. Need someone to help with process, please.

[requiem]

MBAM stopped working. Tried uninstalling it, that failed. Tried all 13 Chameleons, all failed. Need someone to take me through the process with the other removal tools. I posted in the wrong area of the forum earlier and was refered here. Here are my Farbar files. I have not tried to fix anything yet. Appreciate any help, thanks!

Addition.txt

FRST.txt

[kevinf80]

Hello and welcome to Malwarebytes,

Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....
 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Please download MBAM-clean and save it to your desktop.

•    Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.
•    It will ask you to reboot the machine - please do so.
•    Run the cleaner tool again, re-boot when complete.

Download & install the newset MBAM version.

Please download Malwarebytes Anti-Malware
 

•    Install the progam and select update.
•    Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
•    In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
•    Click the Scan tab, choose Threat Scan is checked and click Scan Now.
•    If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
•    Upon completion of the scan (or after the reboot), click the History tab.
•    Click Application Logs and double-click the Scan Log.
•    At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.
 

 

Next,

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

• Quit all running programs.
• For Windows XP, double-click to start.
• For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
• Read and accept the EULA (End User Licene Agreement)
• Click Scan to scan the system.
• When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
• Close the program > Don't Fix anything!
  

 

 

Post those logs for me to see...

 

Thank you,

 

Kevin.

[requiem]

Well, used mbam cleaner and reinstalled Malware bytes. Still wouldn't run, so no log there. Here is what I got out of Rogue Killer.

rk_EA01.tmp.txt

[kevinf80]

Double-click RogueKiller.exe to run again. (Vista/7/8/10 right-click and select Run as Administrator)

When "initializing/pre-scan” completes  press the Scan button, this may take a few minutes to complete.

When the scan completes open the Registry tab and locate the following detections:


[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -> Found
[PUP|VT.not-a-virus:AdWare.Win32.Coupons.w] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CouponPrinterService (C:\Program Files (x86)\Coupons\CouponPrinterService.exe) -> Found
[PUP|VT.not-a-virus:AdWare.Win32.Coupons.w] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CouponPrinterService (C:\Program Files (x86)\Coupons\CouponPrinterService.exe) -> Found
[PUP|VT.not-a-virus:AdWare.Win32.Coupons.w] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\CouponPrinterService (C:\Program Files (x86)\Coupons\CouponPrinterService.exe) -> Found

Make sure those entries are Checkmarked (ticked) also ensure that all other entries are not Checkmarked.

Open the Tasks tab and locate the following detections:

[suspicious.Path] \4736 -- wscript.exe (C:\Users\owner\AppData\Local\Temp\launchie.vbs //B) -> Found

 

Make sure those entries are Checkmarked (ticked) also ensure that all other entries are not Checkmarked.

Open the Files tab and locate the following detections:

[PUP][File] C:\Users\owner\AppData\Roaming\Microsoft\Windows\Recent\uninstall.lnk [LNK@] C:\Program Files (x86)\Coupons\Uninstall\uninstall.xml -> Found
[PUP][Folder] C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} -> Found
[PUP][Folder] C:\ProgramData\{ADCBF7A8-716E-4B21-AF03-E3F11C06C309} -> Found
[PUP][Folder] C:\ProgramData\{B3C2C1CD-6B77-4A96-B670-F734AC2A1CBC} -> Found
[PUP][Folder] C:\Program Files (x86)\Conduit -> Found
[PUP][Folder] C:\Program Files (x86)\Coupons -> Found
[PUP][Folder] C:\Program Files (x86)\File Type Helper -> Found
[PUP][Folder] C:\Program Files (x86)\JustCloud -> Found
[PUP][Folder] C:\Program Files (x86)\W3i -> Found

 

Make sure those entries are Checkmarked (ticked) also ensure that all other entries are not Checkmarked.


Hit the Delete button, when complete select "Report" in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference.
 

Post that log.....

 

Try Malwarebytes again, post log if it runs and completes...

 

Thank you,

 

Kevin

[requiem]

Here is the log. Had to reboot, so doing that now then will try MB again. Thanks!

rk_C14E.tmp.txt

[kevinf80]

Thanks for the update....

[requiem]

OK, tried MB again, still won't run. Nothing happens at all.

[kevinf80]

Run the following:

 

Download AdwCleaner by Xplode onto your Desktop.

• Double click on Adwcleaner.exe to run the tool.
• Click on the Scan in the Actions box
• Please wait fot the scan to finish..
• When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
• Click on the Cleaning box.
• Next click OK on the "Closing Programs" pop up box.
• Click OK on the Information box & again OK to allow the necessary reboot
• After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...
  

 
Next,
 
Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts. (re-enable when done)
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.
  

 

Next,

 

Download Dr Web Cureit from here http://www.freedrweb.com/cureit save to your desktop. (Scroll to bottom of page)

• The file will be randomly named
• Reboot to safe mode <<<<<------------ http://support.eset.com/kb2268/
• Run Dr Web
• Tick the I agree box and select continue
• Click select objects for scanning
  
  
  
  
  
• Tick all boxes as shown
• Click the wrench and select automatically apply actions to threats
  
  
  
  
  
• Press start scan
• The scan will now commence
  
  
  
  
  
• Once the scan has finished click open report <<<--- Do not miss this step
  
  
  
  
  
• A notepad will open
• Select File > Save as..
• Save it to your desktop
  

This log will be excessive,  Please attach it to your next reply…
 

Next,

 

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs....

 

Let me see those logs,

 

Thank you,

 

Kevin
 

[requiem]

On ADWCleaner there were a bunch of ambiguous registry files that I was afraid to delete, so I unchecked them. Should I have left them checked?

[kevinf80]

Yes please delete all entries in AdwCleaner...

[requiem]

OK. Deleted all those files. When I went into Safe Mode, I was able to run MalWare Bytes. So I have attached a log for that as well. Did I give you the Rogue Killer docs?

FRST2.txt

Addition2.txt

cureit.log

mbam 12-1-15.txt

AdwCleanerC3.txt

AdwCleanerS3.txt

JRT.txt

AdwCleanerC2.txt

AdwCleanerS2.txt

[requiem]

Malwarebytes still won't run in normal orperating mode...

[kevinf80]

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Can you run Malwarebytes in Normal mode?
 

Fixlist.txt

[requiem]

OK, here is the log. Still cannot run Malwarebytes in normal mode. The MB icon looks odd as well. I have attached a screen capture of it. Thank you for your help, btw!

Fixlog.txt

[kevinf80]

Run the following then try Malwarebytes again...

 

Download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7/8/10, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
• If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
• If the tool does not run from any of the links provided, please let me know.
  

 
Post that log, if Malwarebytes fails to run again try a clean istall...
 
Please download MBAM-clean and save it to your desktop.

•    Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.
•    It will ask you to reboot the machine - please do so.
•    Run the cleaner tool again, re-boot when complete.
  

Download & install the newset MBAM version.



Please download Malwarebytes Anti-Malware

•    Install the progam and select update.
•    Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
•    In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
•    Click the Scan tab, choose Threat Scan is checked[/b and click Scan Now.
•    If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
•    Upon completion of the scan (or after the reboot), click the History tab.
•    Click Application Logs and double-click the Scan Log.
•    At the bottom click Export and choose Text file.
  

Save the file to your desktop and include its content in your next reply.

 

Thank you,

 

Kevin

[requiem]

Here is the RKill Log. Malwarebytes still won't load so I am cleaning and reinstalling.

Rkill.txt

[kevinf80]

Thanks for the update..

[requiem]

Well, used the cleaner and reinstalled. Still won't launch and the icon is still screwy. This is frustrating.

[kevinf80]

Is the icon image that you posted previously a shortcut to Malwarebytes?

[requiem]

yeah

[requiem]

it looks normal in safe mode

[kevinf80]

Try this please:

 

Download Shortcut-cleaner from here:

http://www.bleepingcomputer.com/download/shortcut-cleaner/dl/172/ save to your Desktop.
 

Right click on sc-cleaner and select "Run as Administrator"
 

When complete the tool will save a log to the same place the tool was ran from "sc-cleaner.txt" post to your reply

[requiem]

OK, here is the log. Thanks again for helping!

sc-cleaner.txt

[kevinf80]

With your system in Normal Mode navigate C:\ > Program Files (X86) > Malwarebytes Anti-Malware.  Inside that folder scroll to MBam.exe > Right click on that file > Select "Run as Administrator" accept UAC alert if offered, run a threat scan.... Does it run OK...

[requiem]

Still doesn't run. I noticed the dates are different on the folders inside the file (12/2/15) than the MBAM.exe and other program filrs which are dated 10/5/15 despite running the cleaner. Shouldn't that have erased all of it so all the dates would be today?