Malwarebytes Wont Install Help Please.....malware Present

Did you follow method two to install MBAM? Did you follow the instructions precisely?

 

Please go to add/remove programs and uninstall:
s5m
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.
Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7, Win8, or Win10 don't double click, use right click and select Run As Administrator).
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:Processes
explorer.exe
:Services
SecurityHealthService
gplyra
:files
C:\WINDOWS\tasks\JaSZgvLfgwdeDbT.job
C:\WINDOWS\tasks\jJKowXmxzIFxIuj.job
C:\WINDOWS\system32\tasks\efUEhcuJwHYJuW
C:\WINDOWS\system32\tasks\IBUpd2
C:\WINDOWS\system32\tasks\JaSZgvLfgwdeDbT
C:\WINDOWS\system32\tasks\JaSZgvLfgwdeDbT2
C:\WINDOWS\system32\tasks\jJKowXmxzIFxIuj
C:\WINDOWS\system32\tasks\jJKowXmxzIFxIuj2
C:\WINDOWS\system32\tasks\LSjUFtTofwjkxN
C:\WINDOWS\system32\tasks\System HealerPeriod
C:\WINDOWS\system32\tasks\System HealerStartUp
C:\WINDOWS\system32\tasks\SystemHealer Monitor
C:\WINDOWS\system32\tasks\SystemHealer Run Delay
C:\WINDOWS\system32\tasks\SystemHealer Task
C:\WINDOWS\system32\tasks\{0F7E0F47-7E7E-087D-0911-08080E78110A}
C:\WINDOWS\system32\tasks\{1CE17C39-93FF-48DF-B339-BA10EB4F2E22}
C:\Users\Annette\AppData\Roaming\76cce9c4cc3e4891afe412379a9cc833
C:\Users\Annette\AppData\Roaming\et
C:\Users\Annette\AppData\Roaming\excdir
C:\Users\Annette\AppData\Roaming\gplyra
C:\Users\Annette\AppData\Roaming\inkscape
C:\Users\Annette\Desktop\HitmanPro_20171003_1647.log
C:\Users\Annette\Desktop\HitmanPro_20171003_2256.log
C:\Users\Annette\Desktop\HitmanPro_20171003_2325.log
C:\Users\Annette\Desktop\HitmanPro_20171003_2349.log
C:\Users\Annette\Desktop\HitmanPro_20171004_1832.log
C:\Users\Annette\Desktop\HitmanPro_20171004_2012.log
C:\Users\Annette\Desktop\HitmanPro_20171004_2117.log
C:\Users\Annette\Desktop\HitmanPro_20171005_1945.log
C:\Users\Annette\Desktop\HitmanPro_20171005_2140.log
C:\ProgramData\1506974420
C:\ProgramData\2d6223c0-3db1-0
C:\ProgramData\2d6223c0-3f85-1
C:\ProgramData\326e133250304cdd9018b2994e03314c
C:\ProgramData\937bf904-08a3-0
C:\ProgramData\937bf904-3a75-1
C:\ProgramData\DP45977C.lfl
C:\ProgramData\hgf.3dew
C:\Program Files (x86)\AvMVIUoBwtUn
C:\Program Files (x86)\CKCpTyVyQIE
C:\Program Files (x86)\TQoarIXzU
C:\Program Files (x86)\s5
C:\WINDOWS\ServiceProfiles\LocalService\AppData\Local\Temp
C:\WINDOWS\SysNative\drivers\56fd6c7e5abb46787c3cc26a520bd3af.sys
C:\WINDOWS\TEMP
C:\Users\Annette\AppData\Local\Temp
:Commands
[purity]
[ResetHosts]
[createrestorepoint]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.
Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7,or Win8 don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).
Rerun Hitman.

Then attach the below logs:
C:\MGlogs.zip
Hitman log
OTM log

 

Your latest logs indicate that you did not uninstall s5m!

Your HJT log also indicates that you did not fix:
O4 - HKLM\..\Run: [booster] "C:\Users\Annette\AppData\Local\PCBooster\booster.exe" -o pool.supportxmr.com:5555 --user=49YfoE2xWHG1vywX2xTV8XZzBzB1E2QHEF9GtzPKSPRdK5TEkxXGRxVdAq8LwbA2Pz7jNQ9gYBxeFPHcqiiqaGJM2QyW64C --pass=WORKER64 --keepalive --background --donate-level=1

Download OTCby Old Timer and save it to your Desktop.

Double-click OTL.exe to start the program.

• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:

:processes
:killallprocesses
:otl
O4 - HKLM\..\Run: [booster] "C:\Users\Annette\AppData\Local\PCBooster\booster.exe" -o pool.supportxmr.com:5555 --user=49YfoE2xWHG1vywX2xTV8XZzBzB1E2QHEF9GtzPKSPRdK5TEkxXGRxVdAq8LwbA2Pz7jNQ9gYBxeFPHcqiiqaGJM2QyW64C --pass=WORKER64 --keepalive --background --donate-level=1
:services
gplyra
excdir
et
:files
C:\Users\Annette\AppData\Roaming\et
C:\Users\Annette\AppData\Roaming\excdir
C:\Users\Annette\AppData\Roaming\gplyra
C:\Users\Annette\AppData\Roaming\inkscape
C:\ProgramData\1506974420
C:\ProgramData\2d6223c0-3db1-0
C:\ProgramData\2d6223c0-3f85-1
C:\ProgramData\326e133250304cdd9018b2994e03314c
C:\ProgramData\937bf904-08a3-0
C:\ProgramData\937bf904-3a75-1
C:\ProgramData\hgf.3dew
C:\Program Files (x86)\AvMVIUoBwtUn
C:\Program Files (x86)\CKCpTyVyQIE
C:\Program Files (x86)\ICBaloCIDxXU2
C:\Program Files (x86)\s5
C:\Program Files (x86)\TQoarIXzU
C:\WINDOWS\SysNative\drivers\56fd6c7e5abb46787c3cc26a520bd3af.sys
C:\Users\Annette\AppData\Local\PCBooster
C:\WINDOWS\tasks\JaSZgvLfgwdeDbT.job
C:\WINDOWS\tasks\jJKowXmxzIFxIuj.job
C:\WINDOWS\system32\tasks\efUEhcuJwHYJuW
C:\WINDOWS\system32\tasks\JaSZgvLfgwdeDbT
C:\WINDOWS\system32\tasks\JaSZgvLfgwdeDbT2
C:\WINDOWS\system32\tasks\jJKowXmxzIFxIuj
C:\WINDOWS\system32\tasks\jJKowXmxzIFxIuj2
C:\WINDOWS\system32\tasks\LSjUFtTofwjkxN
C:\WINDOWS\system32\tasks\System HealerPeriod
C:\WINDOWS\system32\tasks\System HealerStartUp
C:\WINDOWS\system32\tasks\SystemHealer Monitor
C:\WINDOWS\system32\tasks\SystemHealer Run Delay
C:\WINDOWS\system32\tasks\SystemHealer Task
C:\WINDOWS\system32\tasks\{0F7E0F47-7E7E-087D-0911-08080E78110A}
C:\WINDOWS\system32\tasks\{1CE17C39-93FF-48DF-B339-BA10EB4F2E22}
C:\Program Files\Reimage
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
C:\ProgramData\Reimage Protector
C:\rei
C:\Users\Annette\AppData\Local\Mindspark_Interactive_Net\EliteUnzip.exe_StrongName_gzmrfrrkrve1wghp1nel3iobez4nojnd
C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
C:\Windows\Reimage.ini
C:\Windows\System32\Tasks\ReimageUpdater
C:\Windows\System32\Tasks\System HealerPeriod
C:\Windows\System32\Tasks\System HealerStartUp
C:\Windows\System32\Tasks\SystemHealer Monitor
C:\Windows\System32\Tasks\SystemHealer Run Delay
:reg
[-HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL]
[-HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}]
[-HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}]
[-HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}]
[-HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}]
[-HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}]
[-HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1]
[-HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine]
[-HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}]
[-HKLM\SOFTWARE\Classes\WOW6432Node\AppID\REI_AxControl.DLL]
[-HKLM\SOFTWARE\Classes\WOW6432Node\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}]
[-HKLM\SOFTWARE\Classes\WOW6432Node\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}]
[-HKLM\SOFTWARE\Classes\WOW6432Node\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}]
[-HKLM\SOFTWARE\Classes\WOW6432Node\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}]
[-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ReimageUpdater]
[-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\System HealerPeriod]
[-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\System HealerStartUp]
[-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SystemHealer Monitor]
[-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SystemHealer Run Delay]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Reimage.exe]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Repair]
[-HKLM\SOFTWARE\Reimage]
[-HKLM\SOFTWARE\WOW6432Node\Google\Chrome\NativeMessagingHosts\com.mindspark.eliteunzip_aa]
[-HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\EliteUnzip_RASAPI32]
[-HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\EliteUnzip_RASMANCS]
[-HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\Reimage.exe]
[-HKLM\SYSTEM\ControlSet001\Services\ReimageRealTimeProtector]
[-HKLM\SYSTEM\CurrentControlSet\Services\ReimageRealTimeProtector]
[-HKU\S-1-5-21-3730457624-2241265431-985006982-1001\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.]
[-HKU\S-1-5-21-3730457624-2241265431-985006982-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}]
[-HKU\S-1-5-21-3730457624-2241265431-985006982-1001\Software\Reimag]

:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Download TFC by OldTimer to your desktop.
Double-click TFC.exe to run it.

Right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

• 
  
  
  • Click the Start button to begin the cleaning process.
  • Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
  • Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista ,Win7 or Win8, Win10, don't double click, use right click and select Run As Administrator).

It might be helpful if you would open task manager and get me a screen shot of the processes tab.

 

OK.... one other thing to see if it will run:

http://www.majorgeeks.com/files/details/unhackme.html

 

Click open. You do not get an option to run?

 

Can you get me the requested logs?

 

Where you able to run the fix in OTL??? Please give me as much information as possible about what is happening.

 

The screen shots are too small to read. Could you attach the OTL log as well as a new MGLogs.zip?

And see if you can run:

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista,Seven,Eight or 10, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

 

Double-click OTL.exe to start the program.

• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:

:processes
vdizcxs
coakishsvc
:killallprocesses
:otl
O4 - HKCU\..\Run: [SpyEmergency] C:\Program Files\NETGATE\Spy Emergency\SpyEmergency.exe
:services
lsdihpc
coakishsvc
vdizcxs
:files
C:\Program Files (x86)\McAfee
C:\Program Files (x86)\Norton Security
C:\Program Files (x86)\NortonInstaller
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan
C:\ProgramData\NortonInstaller
C:\ProgramData\Norton
C:\ProgramData\McAfee Security Scan
C:\ProgramData\McAfee
C:\Users\Annette\AppData\Roaming\Spy Emergency
c:\users\annette\appdata\local\vdizcxs\lsdihpc.exe
c:\users\annette\appdata\local\vdizcxs\coakishsvc.exe
C:\Users\Annette\AppData\Local\vdizcxs\vdizcxs.exe
C:\Users\Annette\AppData\Local\vdizcxs\lsdihpc.exe
:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpyEmergency"="C:\\Program Files\\NETGATE\\Spy Emergency\\SpyEmergency.exe"=-

[-HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\RunOnce\ApprovedByRegRun2\AntiRepl]
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista ,Win7 or Win8, Win10, don't double click, use right click and select Run As Administrator).
The last OTL log you attached was empty, but MGLogs shows the removal. Attach the new MGLog.zip.
Now see if you can run JRT. And also rerun Unhackme.

 

That looks hopeful. Please get me the new MGLogs.zip and tell me if Unhackme is still reporting issues.

 

Right click start, run,
and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The red is merely informational.
cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.

 

Those files are still showing in HJT.

Please do the following:

Right click start, run and type in cmd. When the command prompt opens:
copy/paste the following command into the box and press OK:

cmd /c del /F C:\Users\Annette\AppData\Local\vdizcxs\vdizcxs.exe

A blank command window will open on your desktop, then close in a minute or two. This is normal.

Now do the same for:

cmd /c del /F C:\Users\Annette\AppData\Local\vdizcxs\lsdihpc.exe

Then rerun Unhackme and tell me if they are still being reported.

Also, after the above, try to run this:
http://www.majorgeeks.com/files/details/clamav.html

 

I am afraid we will have to reset your PC> Please right click on the start menu, click on settings. When that pane opens ... at the bottom right will be update and security. Click on that and on the left side will be recovery. Click on that and you will have the option to keep your files and folders.

 

Yes, it should. But try this first: Right click the start menu and choose file explorer. When that opens, click on this pc. Then click on your C: drive and in the address bar, click it and it should change to a C: prompt. Copy in this file:
C:\Users\Annette\AppData\Local\vdizcxs\vdizcxs.exe

If it finds it, right click and choose properties then security. You should see a box where you can click on your user name and give yourself full permissions.

Try that and let me know how you get on.

 

I was afraid of that. Your only choice now is a reset. Sorry.

 

If you are worried about your files and pictures...transfer them to the flash drive first.

 

You are welcome. I am sorry we couldn't clean out the malware. I have never encountered a virus this pervasive. There is no need to send me anything. We do it to try to help people.

Do let me know how you get on.

 

If you reboot, do you see a small circle with a line in it at the bottom of the screen? If you press the shift key and click on that ... what happens? Do you get Troubleshooting? If so, can you click on that to get to reset?

 

I am going to give you a link on how to reinstall Windows 10. But you will have to download the installation media to a clean computer and transfer it to a USB drive. Then you will need to access your computers bios by hitting F2 as soon as it starts to boot up. Once in the bios, you will have to change the boot order to USB first device. Then plug in the USB drive and reboot. Follow the instructions> this will remove everything....so make sure you have saved your files and pics to a flash drive to transfer later. ( Just click on installation media to reinstall Win10)

https://support.microsoft.com/en-us/help/12415/windows-10-recovery-options

 

No problem....do let me know.