Microsoft installer is curropted - deeply infected

• Download Malwarebytes Anti-Rootkit
• Once the file has been downloaded, right click on the downloaded file and select the Extract all menu option.
• Follow the instructions to extract the ZIP file to a folder called mbar-versionnumber on your desktop.
• Once the ZIP file has been extracted, open the folder and when that folder opens, double-click on the mbar folder.
• Double-click on the mbar.exe file to launch Malwarebytes Anti-Rootkit.
• After you double-click on the mbar.exe file, you may receive a User Account Control (UAC) message if you are sure you wish to allow the program to run. Please allow to start Malwarebytes Anti-Rootkit correctly.
• Malwarebytes Anti-Rootkit will now install necessary drivers that are required for the program to operate correctly.
• If you receive a DDA driver message like could not load DDA driver, click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer and will start automatically.

• Please click by the introduction screen on the Next button to continue.

• Next you will see the Update Database screen.
• Click on the Update button so Malwarebytes Anti-Rootkit can download the latest definition updates.

• When the update has finished, click on the Next button.

• Next you can select some basic scanning options. Make sure the Drivers, Sectors, and System scan targets are selected before you click on the Scan button.
• Malwarebytes Anti-Rootkit will now start scanning your computer for rootkits. This scan can take some time, so please be patient.

• When the scan with Malwarebytes Anti-Rootkit is finished, the program will display a screen with the results from the scan.
• Make sure everything is selected and that the option to create a restore point is checked.
• Next click on the Cleanup button. Malwarebytes Anti-Rootkit will then prompt you to reboot your computer.
• Click on Yes button to restart your computer.

• There will now be two log files created in the mbar folder called system-log.txt and one that starts with mbar-log.
• The mbar-log file will always start with mbar-log, but the rest will be named using a timestamp indicating the time it was run.
  • For example, mbar-log-2012-11-12 (19-13-32).txt corresponds to mbar-log-year-month-day (hour-minute-second).txt.
• The system-log.txt contains information about each time you have run MBAR and contains diagnostic information from the program.

There were quite a few errors running these applications. Do you think this might have anything to do with the fact that i am in safe mode? In any case i was able to successfully get the FRST log. The ADW cleaner log how ever did not open. It shown 4 results infected and i removed them, they were only ask tool bar items though. The third scan with the JRT produced an error related to a missing DLL.

• Please download and run ESET Online Scanner
• Check 🖼Click to load external image (qy7AMI8.jpg) (if available) and click on the 🖼Click to load external image (ePL5oyv.jpg) button.
• Check the option beside: Enable detection of potentially unwanted applications.
• Now click on Advanced Settings and make sure that the option Clean threats automatically is NOT checked, and select the following:

• Enable detection of potentially unsafe applications
• Enable detection of suspicious applications
• Scan archives
• Enable Anti-Stealth Technology

• Click on the Change button and select only Operating memory, Autostart locations and drive C:\ to be scanned.

• Push the Scan button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes a list of found threats will open automatically (if any malicious files are found).
• Push save to text file and save the file to your desktop using a unique name, such as ESETScan.txt. Include the contents of this report in your next reply.
• Push the do not clean button.
• Push 🖼Click to load external image (a3dBJq5.jpg) and the close the application.

• Download Emsisoft Emergency Kit and save it to your desktop.
• Double-click icon then click Install
• A Window should open highlighting Start Emergency Kit Scanner
• Right click on the icon and select Run as administrator
• Click 1. Update now!
• Once the update is completed select Settings under Scan
• Uncheck Join the Emsisoft Anti-Malware Network
• Click Scan at the top
• Click On scan completion
• Click Quarantine detected objects, then click OK
• Click Malware Scan
• Once completed click View Report
• Save the file to your Desktop using the default file name
• Copy and paste the report in your reply
• ===============

Thanks. I will get right on this. I just wanted to notify you at the fact that i attempted my self to try and isolate and fix the issue with viruses and infections. I found quite a few in previous scans, unfortunately i didn't save the logs but most were found with malewarebytes and hitman Pro as well as antispyware. It is possible that the numerous infections and maleware from past scans on this machine may of caused some instability and corruption. Though i am wondering why the scans we ran, specifically FRST did not pick up any traces of anything previously. I think you have the right idea though with using the "repair All in one" to fix any permanent damage to drivers or system files and then proceed to scan with some online scanners. 

I think what i may do though is to try and operate these scanners well in Normal startup Mode. I know safe mode often limits usability of some tools so it could also be the reason why so many error were apparent when trying to run the scans. Let me know if this is advisable?

Also to answer the question bout firewalls, arnt' most firewalls already disabled in safe mode? I didn't see anything running in the tool bar. Anyways, ill be working on these next steps and report back to you soon.

 

I found quite a few in previous scans, unfortunately i didn't save the logs but most were found with malewarebytes and hitman Pro as well as antispyware. It is possible that the numerous infections and maleware from past scans on this machine may of caused some instability and corruption. Though i am wondering why the scans we ran, specifically FRST did not pick up any traces of anything previously.
 

My first comment was

 

Looks like you've run every tool imaginable, I can see so many listed.

FRST shows me

Malwarebytes
EMSISOFT ANTI-MALWARE
dds.txt
kss16.0.0.1344en_9702 (1).exe
Zemana.AntiMalware.Portable.exe
HitmanPro
rkill.exe
tdsskiller.exe
ESET

The Tweaking.com certainly found a whole alot of errors with system files and the like. But i am not sure i did this correctly, the instructions you gave me were a little bit different. 

STEP 2

I basically did a pre scan, then proceeded to do a full scan. After the scan was finished it shown the results of the files that are corrupted. I then selected "repair reparse points" but it opened up a different window with nothing selected. So i clicked on "scan for parse points" so then i had to scan for reparse points, after that was finished scanning. I clicked on "Select all" and then it proceeded to supposedly repair those files i think.

There was no "Done" though indicating that the process completed successfully. I had to close out of this window and return to the previous scan window.

The next step i did a pre scan and full scan again. I opened up the next tab "repair environment Variables" on the bottom of the screen which opened up a screen with different windows pertaining to different information.

#1. Environmental Variable Path

#2. Apply New paths

#3. Environmental PS module Path

#4. Environmental PS module Path: Apply new paths

#5. Environmental Variable: Pathext

#7 Environmental Variables: OS, Comspec, Windir and username

So which of these buttons do i have to use. I didn't notice any scan on this window at all.

I do have a log though that i saved, after running these scans, can you confirm rather or not i completed all the necessary tasks from Steps #2. I think i repair the reparse points but i don't think anything was fixed with the "repair Environment Variables"

Can you be a little bit more specific. What do you mean by 

"Trend micro went after temp files, C:\WINDOWS\TEMP\"

Also can you confirm rather or not the required steps were successful and how do you know to what extent is the OS corrupted? I need a little more info so i can understand precisely whats going on here.

Based on the logs was there any files or any sort of procedures not executed efficiently with ALL in one?

To answer the question related to usage of the machine. Yes i have, the start menu is still having a few issues opening though but other then that i do for sure notice a quicker boot-up time. But in regards to rather or not its fully repaired? I have no idea. Some of the software used during this diagnoses had some issues as well so that may or may not be related to the corruption of the file system. Certain tools were not able to run efficiently either like SFC.

EDIT: I just ran another prescan with Tweeker and it picked up some 4000+ corrupted files I have not executed any other commands beyond the initial prescan.

EDIT2: The computer is running extremely slow. I am in normal start up mode and my keyboard can barely manage to keep up with my key strokes. I am running the ESET scanner currently but its chugging along at a slow rate.

In addition it looks upon loading the Desktop Screen, Trend Micro also found a malicious file and removed it. I will post the log here:

Also can you confirm rather or not the required steps were successful and how do you know to what extent is the OS corrupted? I need a little more info so i can understand precisely whats going on here.

But in regards to rather or not its fully repaired? I have no idea. Some of the software used during this diagnoses had some issues as well so that may or may not be related to the corruption of the file system. Certain tools were not able to run efficiently either like SFC.

EDIT: I just ran another prescan with Tweeker and it picked up some 4000+ corrupted files I have not executed any other commands beyond the initial prescan.

Emisoft found no infected files, ESET is still running but this is a pretty deep rooted scanner. If ESET finds nothing, then the likehood of infections is highly unlikely.