Cant Open Malwarebytes Website

[a_sociopath]

Got an Malware and had to download malwarebytes on a mirror site. Managed to quarantine and delete all suspicious sites but the site still can't be accessed. Wr64.sys also detected as vulnerable driver

Should I run Farbar or Malwarebytes Support Tool

 

Thank you!

[Maurice Naggar]

Hello.  My name is Maurice. I will guide you.

• Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

  Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
  1. Show-Hidden-Folders-Files-Extensions
  https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

  2. Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

3. 

If possibly you have a browser issue, can you try using a different web browser?
But in any event, always SAVE the downloads I guide you to. Then after download is complete, you go to the file using File Explorer.
and only then, launch it from there.

Let's do one special run  with Malwarebytes Adwcleaner. 

 

It will not take much time, Read over all lines before starting so that you have a good understanding of the whole method. Take your time and go careful. I ant to make sure you select all of what I list below - before- pressing the "scan" button.

 

First download & save it

download link

 

Then go to where the EXE file is saved. Start Adwcleaner.  Do not rush. There are a few first choices to set as I have listed below.

 

Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.

 

When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window

by clicking their button to the far-right for ON status

Delete IFEO keys
Delete tracing keys
Delete Prefetch files
Reset Proxy
Reset IE Policies
Reset Chrome policies
Reset Winsock
Reset HOSTS file

 

 

 

ONLY after you have set the selections above ....only after that .....

Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

 

 

This can take several minutes.

When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.

 

AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.

Click on the “Continue” button to finish the removal process.

 

 

Guide article

 

 

I would like a report set for review. This is a report only. This is the first beginning step so I can see what is what on this particular machine.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

Edited November 20, 2023 by Maurice Naggar
amended

[a_sociopath]

Hello!

After using AdwCleaner I can now access the Site. 

Thank you! 

mbst-grab-results.zip

[Maurice Naggar]

Good to know that site access if working. But there is a bunch more to be done. 

Malwarebytes can detect and remove most malware with no further actions required for free.

Please download, install, update Malwarebytes
https://support.malwarebytes.com/hc/en-us/articles/360038479134-Download-and-install-Malwarebytes-for-Windows

and do a Threat Scan with Malwarebytes https://support.malwarebytes.com/hc/en-us/articles/360038984773
and post back the log as shown below.
Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

Edited November 20, 2023 by Maurice Naggar
amended

[a_sociopath]

Hello!

Here are the scans.

Thank you

Scan After.txt Scan Before.txt

[Maurice Naggar]

Create a new special folder named Fixem

download & save a copy of the tool FRST64.exe from this link ---Save it to the folder Fixem https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Go to the folder Fixem using File Explorer
Do a right-click on FRST64.exe and select

Rename

and rename it to

Gazork.exe

RIGHT-click on GAZORK and select 

Run as Administrator

and tap ENTER. And reply YES to allow to proceed.  

•  When the tool opens click Yes to the disclaimer.  And be very sure to TICK the box for Addition.txt
• Press the Scan button.

• It will make a log (FRST.txt & Addition.txt) in the same directory the tool is run
• Have patience since the run may take something like 10 or so minutes  (less depending on your hardware speed)
• Close Notepad IF those show up on Notepad.
• Just please Attach the 2 files FRST.txt +Addition.txt  with your next reply. You may if you wish put the files into a ZIP file & attach that in a reply.  There is a lot of other work ahead. Stick with me.

[a_sociopath]

Here are the logs

thank you!

Addition.txt FRST.txt

[Maurice Naggar]

Uninstall Adobe Flash Player 32 PPAPI  That is a high risk exposure & also way way obsolete & not needed !

( 2 )

Insure to Turn OFF Avast until after the next Windows restart/reboot.
In you taskbar, on the right-hand side, locate the orange Avast icon (you might have to click the up-arrow to ‘Show hidden icons’
Right-click on the orange Avast icon one you have located it
Hover over ‘Avast shields control’ on the menu that pops up
From the expanded menu that comes up, you can choose to disable Avast ( Select the one to diable Until after next Restart )
Left-click on the option you want and Avast will be disabled

( 3   )

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine. This may take something like 55 minutes to finish.

Please Close all open work before you actually do begin this run.

Gazork ( which is FRST64 by a unique-name) program location:   \Downloads\Fixem folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to \Downloads\Fixem folder

Fixlist.txt <- < - - - -

NOTE. It's important that both files, Gazork, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  gazork and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads\Fixem folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

Edited November 20, 2023 by Maurice Naggar

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks