Adware Infection, Can´t Install some Anti-Spyware

Y

Yanezez

New Member
Hello everyone,



I have a windows 7 home edition laptop that has been infected with malware that i cannot remove. According to research, Malware bytes would solve the problem, but cant run it, and Chameleon mode wont work.



I have some adware that pretty much gives me ads. On google chome extensions I have Mouse Drag 2.1.4 which I cannot remove. I already have tried developer mode and look in the registry with the ID, but if and when i find it, just comes back.



Before posting this I removed all antispyware software on my pc, and did a clean uninstall of Malware bytes (NOTE: have the free edition).



Like I mentioned before, I cannot download malware bytes through the main site, so I get it from download.com. I have tried renaming it Firefox or Explorer but to no avail, it simply wont start. Tried running in admin mode, nothing.



According to most of the research Ive done, Malware bytes will indeed fix my problem, but just cannot get it to run.



Ive also tried a few other spyware programs to no avail.

Thank you in advamce


As of now i have zero adware software installed.

Attached Files
 

Attachments

Hijackthis is no longer used in malware removal. Please run the following programs and post the logs.

1.

Please download AdwCleaner by Xplode onto your Desktop.



•Please close all open programs and internet browsers.
•Double click on adwcleaner.exe to run the tool.
•Click on Scan.
•After the scan you will need to click on clean for it to delete the adware.
•Your computer will be rebooted automatically. A text file will open after the restart.
•Please post the content of that logfile in your reply.
•You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

2.

Please download Junkware Removal Tool to your desktop.

•Shutdown your antivirus to avoid any conflicts.
•Very important that you run the tool in this manner:
Right-mouse click JRT.exe and select Run as administrator
Do NOT just double-click it.
•The tool will open and start scanning your system.
•Please be patient as this can take a while to complete.
•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
•Post the contents of JRT.txt in your next message.

3.

Please download Malwarebytes' Anti-Malware and save it to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version. Please keep updating until it says you have the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • A log will be saved automatically which you can access by clicking on the Logs tab within Malwarebytes' Anti-Malware

If for some reason Malwarebytes will not install or run please download and run Rkill.scr, Rkill.exe, or Rkill.com. If you are still having issues running rkill then try downloading these renamed versions of the same program.

EXPLORER.EXE
IEXPLORE.EXE
USERINIT.EXE
WINLOGON.EXE

But DO NOT reboot the system and then try installing or running Malwarebytes. If Rkill (which is a black box) appears and then disappears right away or you get a message saying rkill is infected, keep trying to run rkill until it over powers the infection and temporarily kills it. Once a log appears on the screen, you can try running malwarebytes or downloading other programs.

Please post the log that Malwarebytes displays on your screen.

4.

Download OTL to your Desktop


•Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
•Click on Minimal Output at the top
•Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
◦When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Just post the OTL.txt file in your reply.

Then post the logs from the following 4 programs.

1. Adwcleaner
2. Junkware removal tool
3. Malwarebytes
4. OTL
 
Hello, thanks for the quick reply. As for the steps;

1. Have attached the file (had 2 files, run it 2 times by accident)
2. Have attached JRT file
3. COULD NOT COMPLETE THIS STEP. Malwarebytes will download, but will not run. I tried all the Rkills, and they all show no results. (Chameleon wont work either)
4.Attached file

Thank you
 

Attachments

Did you click on the cleaning box in adwcleaner? If you didn't, nothing got deleted.
 
Ok. Does this happen in any other browser? Have you tried resetting chrome back to defaults?

I would like for you to run the following.

Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
  • Download this file here :

    Combofix

  • When the page loads click on the blue combofix download link next to the BleepingComputer Mirror.
  • Save the file to your windows desktop. The combofix icon will look like this when it has downloaded to your desktop.

    cf-icon.jpg
  • We are almost ready to start ComboFix, but before we do so, we need to take some preventative measures so that there are no conflicts with other programs when running ComboFix. At this point you should do the following:

  • Close all open Windows including this one.
  • Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. Instructions on disabling these type of programs can be found here.
    Once these two steps have been completed, double-click on the ComboFix icon found on your desktop. Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all. The scan could take a while, so please be patient.
  • Please click on I agree on the disclaimer window.
  • ComboFix will now install itself on to your computer. When it is done, a blue screen will appear as shown below.

    cf-preparing.jpg

  • ComboFix is now preparing to run. When it has finished ComboFix will automatically attempt to create a System Restore point so that if any problems occur while using the program you can restore back to your previous configuration. When ComboFix has finished creating the restore point, it will then backup your Windows Registry as shown in the image below.

    erunt.jpg

  • Once the Windows Registry has finished being backed up, ComboFix will attempt to detect if you have the Windows Recovery Console installed. If you already have it installed, you can skip to this section and continue reading. Otherwise you will see the following message as shown below:

    recovery-console-prompt.jpg

  • At the above message box, please click on the Yes button in order for ComboFix to continue. Please follow the steps and instructions given by ComboFix in order to finish the installation of the Recovery Console.
  • Please click on yes in the next window to continue scanning for malware.
  • ComboFix will now disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.
  • ComboFix will now start scanning your computer for known infections. This procedure can take some time, so please be patient.
  • While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. You will also see the text in the ComboFix window being updated as it goes through the various stages of its scan. An example of this can be seen below.

    still-scanning-clockchanges.jpg

  • When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
  • This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
  • When ComboFix has finished, it will automatically close the program and change your clock back to its original format. It will then display the log file automatically for you.
  • Now you just click on the edit menu and click on select all, then click on the edit menu again and click on copy. Then come to the forum in your reply and right click on your mouse and click on paste.

If for some reason, if you try to run a program or open a file and you get an error message saying "illegal operation attempted on a registry key that has been marked for deletion", please just reboot your pc and you'll be fine.


Please post the combofix log.
 
I need you to post a log that combofix produces but doesn't show you. Please navigate to C:\Qoobox and in that folder will be a file named add-remove programs.txt Open that file and copy and paste the contents back here. You have a few programs that need to be uninstalled.
 
So did you uninstall Avg, hitman pro, lavasoft, spybot- search and destroy, microsoft security essentials? They don't show up in the list. Have you tried resetting chrome back to defaults?
 
Programs are installed. I have tried resetting chrome back to defaults but nothing happens. On extensions i still have the mouse drag extension.
Looks like reformatting is the way to go
 
johnb35 said:
So did you uninstall Avg, hitman pro, lavasoft, spybot- search and destroy, microsoft security essentials? They don't show up in the list. Have you tried resetting chrome back to defaults?
Click to expand...

First of all. Thank you very much for all your help. Was finally able to remove that damn virus. Here is what I did:

Deleted the extension folder for Mouse Drag 2.1.4. After that was finally able to run ComoFix in normal mode. After that was able to run Malwarebytes and update. Malware bytes fixed everything.

Thank you, you have been very patient.
 
Yanezez said:
Programs are installed
Click to expand...
You need to get rid of those programs I listed if they are installed. Microsoft Security Essentials is no longer accepted as a decent antivirus program. I would suggest getting the free version of Avast.

Please run OTL again but this time copy and paste the following that is inside the codebox into the custom scan/fixes box at the bottom and then click on run fix up top.

Code: 
:OTL
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173}: "URL" = http://search.searchult.com/?bd=ds&oem=testsinstcr&uid=HitachiXHTS547564A9E384_J2130053DRHU7BDRHU7BX&version=2.3.0.8956&pid=414031160&tid=442&q={searchTerms}
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:5C321E34

:commands
[emptytemp]
 
You must log in or register to reply here.
Back
Top