Jump to content

Recommended Posts

Can you please check the instructions below to see if it resolves your issue:

  1. Press Windows Key + R to bring up the run dialog
  2. In the dialog window, type certmgr.msc and click Ok
  3. In the window that comes up, on the left side, double click Untrusted Certificates so you can see the folders beneath it
  4. If a Certificate folder exists, click it
  5. Delete any certificates in this folder that have the name Malwarebytes in it
  6. Run the MB-Clean tool again an check if you are able to uninstall the program.

Thank you.

Link to post
Share on other sites

Quick question. Did you see any Malwarebytes certificates in your certificate manager? Also after you deleted them and tried to clean up and reboot, did the Malwarebytes certificates appear back in the untrusted list?

Also please use the forum post below and post the FRST.txt, Addition.txt and MB-check-results.zip file to this post.

 

Link to post
Share on other sites

  • Staff

Hello mohamed3666,

Download the attached Fixlist.txt and save it in the same location as FRST64.exe.  Both the Fixlist.txt and FRST64.exe must be in the same location for the script to execute.

1. Double click FRST64.exe to launch the tool

2. When the tool opens, click the *FIX BUTTON*.

3. Once it has finished, a Fixlog.txt will open and also have been saved in the same location the tool was run from.

Reboot the machine and check the Untrusted Certficates again. If you see Malwarebytes in there again, please run a new scan with FRST64.exe and send new logs.

 

Fixlist.txt

Link to post
Share on other sites

  • Staff

The Fixlist.txt needs to be in the same location as FRST64.exe in order for the tool to be able to 'see' it to execute it.

According to the FRST.txt you sent, the tool is located in this folder:

C:\Users\hacks\Downloads\Programs

You need to save the Fixlist.txt in that Downloads\Programs folder as well for it to work

Link to post
Share on other sites

  • Staff

I've sent another Fixlist.txt - delete the one you have and download the one attached here.

After you've run the Fixlist.txt, you'll have to go back into the certmgr.msc and manually delete all those Untrusted Certficates listed there, that belong to any AV, all these:

HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== ATTENTION
HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== ATTENTION
HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== ATTENTION
HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== ATTENTION
HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== ATTENTION
HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== ATTENTION
HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== ATTENTION
HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== ATTENTION
HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== ATTENTION
HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== ATTENTION
HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== ATTENTION
HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== ATTENTION
HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== ATTENTION
HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== ATTENTION
HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== ATTENTION
HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== ATTENTION
HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== ATTENTION
HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== ATTENTION
HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== ATTENTION
HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== ATTENTION
HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== ATTENTION
HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== ATTENTION
HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== ATTENTION
HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== ATTENTION
HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== ATTENTION
HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== ATTENTION
HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== ATTENTION
HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== ATTENTION
HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== ATTENTION
HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== ATTENTION
HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== ATTENTION
HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== ATTENTION

Fixlist.txt

Link to post
Share on other sites

  • Staff

Can you please answer my questions? I need to get an idea of what is working and what is not.

Quote

Have you run a scan with Malwarebytes yet? Does it even open for you?

Also, it appears that the reason you received that initial message from FRST64.exe is because you had saved the Fixlist.txt  as an .exe.  Please delete all these extra files so they don't get confused with what I need you to actually run:

C:\Users\hacks\Downloads\Fixlist (1).txt
C:\Users\hacks\Desktop\Fixlist.exe
C:\Users\hacks\Downloads\Fixlist.txt

Once you've deleted those, download this next Fixlist.txt and save it in the same location as FRST64.exe

1. Double click FRST64.exe to launch the tool

2. When the tool opens, click the *FIX BUTTON*.

3. Once it has finished, a Fixlog.txt will open and also have been saved in the same location the tool was run from. Please send me the Fixlog.txt in your next reply, along with an update on machine behavior.

 

Fixlist.txt

Link to post
Share on other sites

  • Staff

We really need to scan with Malwarebytes - what I'm going to have you do is use a special version of our stand alone MBAR.

Follow the instructions and use the download link in our Knowledgebase Article located here https://support.malwarebytes.com/customer/portal/articles/2097176?b_id=6400

If malware is found, do NOT press the Cleanup button when the scan completes. Click EXIT.

Please send the following logs as attachments to your reply. These logs are located in the MBAR folder on your desktop where the tool extracted itself to._
1. *mbar-log-2013-xx-xx(xx-xx-xx).txt* (where xx-xx(xx-xx-xx) is the date and time of the scan)
2.*system-log.txt*

 

 

 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.