MalwareBytes removed a serious threat but Win 7 machine crippled

Howdy,

 

Yes, I live in Sarasota Florida USA. but, until two years ago I lived in New York City USA.  BTW, the Rouge Killer is running now as I said in last post.

Thanks for the info.

 

Some of the entries in the RogueKiller result were not selected and therefore didn’t get fixed:
 

¤¤¤ Registry : 25 ¤¤¤
[PUP.Gen0] (X64) HKEY_CLASSES_ROOT\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96} (C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe) -> Not selected
[PUP.ByteFence|PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\ByteFence -> Not selected
[PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\SuperEasy Software -> Not selected
[PUP.Gen0] (X86) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\AutorunsDisabled | {25A3A431-30BB-47C8-AD6A-E1063801134F} :   -> Not selected
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Not selected
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowDownloads : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowUser : 2  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowVideos : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowDownloads : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowUser : 2  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2396228472-3482715812-2186985281-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowVideos : 2  -> Not selected

¤¤¤ Tasks : 1 ¤¤¤
[PUP.Gen0] %WINDIR%\Tasks\FreeFixer background scan.job – C:\Program Files\FreeFixer\freefixer.exe (-bgscan) -> Not selected

¤¤¤ Web browsers : 3 ¤¤¤
[PUM.HomePage][Firefox:Config] dzygi7op.default : user_pref("browser.startup.homepage", "moz-extension://e7d6542d-2267-4cbe-bd03-54fcd30695a4/newtab/newtab.html"); -> Not selected
[PUM.NewTab][Firefox:Config] dzygi7op.default : user_pref("browser.newtab.url", "http://services.fres…B57D4599}&i=");-> Not selected
[PUM.SearchEngine][Firefox:Config] dzygi7op.default : user_pref("browser.search.selectedEngine", "Yahoo!"); -> Not selected

 

RogueKiller

• when the scan is finished make sure that all the ones I mentioned above are checked apart from these::
  

  
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{047E6F90-FFFB-43B3-8B31-820B734306B1} | NameServer : 167.206.254.1,167.206.254.2 ([United States][-])
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{047E6F90-FFFB-43B3-8B31-820B734306B1} | NameServer : 167.206.254.1,167.206.254.2 ([United States][-])
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{047E6F90-FFFB-43B3-8B31-820B734306B1} | NameServer : 167.206.254.1,167.206.254.2 ([United States][

 

• then, press the Remove Selected button and please post the log it produces.

 

Pease then run it again and send the new log

================================================

Also, some of the AdwCleaner results were not cleaned:

Run AdwCleaner

• run AdwCleaner by clicking on Scan
• when it has finished, leave everything that was found checked, (ticked), then click on Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

Logs to include with next post:

RKfixlog.txt
New RK log
AdwCleaner log

Thanks

Satchfan

 

Have to go out for a while now but will reply later.

 

Satchfan

RougeKiller is running; based on past times, it will prolly run for another 5 hours.  

Adware is queued up to run but will close all processes if I say press OK, so I will hold off on that till Rogue Killer ends.

BUT, I am remembering what you said about rebooting and loosing what has already been done.

So, when Rough Killer ends, what should be the protocol?

I know the first thing is send you the log of RK.

But, after that, what?

Do more with RK or press OK on Adware?

ok, THE rOUGE kILLER TOO ABOUT 5 HOURS AND HERE IS THE LOG - i SELECTED ALL EXCEPT FOR THE 3 tcpip ENTRIES THAT YOU SINGLED OUT:  rouge Killer is still loaded; I will leave it that way until I hear from you.  

But, now, I have Adware loaded from before waiting for me to press OK to continue.

 

Here are RogueKiller 2018 03 10 ALL BUT 3 TCPIP APOSTED TO SATCHANFAN SATURDAY 15-30

And, after that post, I clicked OK on the Adware program - then it asked for a reboot and after reboot, here is the log:

You are doing well and we're getting there.

 

Run Malwarebytes Anti-Malware

Please download Malwarebytes Anti-Malware to your desktop.

• double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program
• at the end, be sure a checkmark is placed next to the following
  • Launch Malwarebytes Anti-Malware
  • a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
• click Finish.
• on the Dashboard, click Update Now
• after the update completes, click the Scan Now' button.
• if an update is available, clicking the Update Now button will update it
• a Threat Scan will begin.
• when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
• when the prompt to restart the computer appears, click Yes.
• after the restart once you are back at your desktop, open MBAM once more
• click on the “History” tab, the “Application Logs”
• double-click on the scan log which shows the date and time of the scan just performed.
• click Copy to Clipboard
• please paste the contents of the clipboard into your reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

Mbam log
Frst.txt
Addition.txt

Thanks

Satchfan

 

LOG CONTINUATION:

 

CONTINUATION OF LOG FROM LAST POST:

 

You're welcome.

 

Won't be in touch immediately as that is a very long log and I also have things to do today but will get back as soon as I can.

 

BTW, you ran all of those perfectly and things are slowly getting sorted.

K, thanks again.  Have a god day.

Another delay.

 

There are some entries in your logs that have been flagged as 'bad' and I've asked the author of FRST why they have been flagged so will need to await a reply. Hopefully won't be too long.

Just came back to machine and noticed that Malware Bytes is again active in the tray and monitoring websites.  Machine seems normal; weirdness gone so I cam not doing anything but waiting to hear from you.

 

About 5 hours later, I came back to the machine.  I had one one program running and it was not doing anything; normal this program never causes any problems. I tried to open Windows Explorer and got "Server Error" dialog box.  Was not from any program.  I could not open any folders on local or NAS drives.  Nothing without getting this error.   (This was on 2018 03 10 around 20:00.  FWIW.

 

I felt I had to reboot so I did and then machine normal again.  BTW, after re-boot, MalwareBytes was not running in the task bar tray —- actually not running at all.

 

Hi Satchafan!  It is now Thursday March 15th at 9:30 AM.  I have been using this machine with no incidents (no MWB) for about 5 days,  FYI.  Waiting for instructions when you have time.