1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

No malware detected, but can't install any antivirus

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by LAareadad, Aug 26, 2012.

  1. LAareadad

    LAareadad Private E-2

    My problem started two days ago with some general slowdown and unreliable behavior from my Windows 7 Vaio laptop, as well as the unwanted appearance of Babylon search as the default for all my browsers. (Not sure what caused the infection, but I was recently away for a long business trip and my kids have had more unsupervised computer time than usual.)

    I removed Babylon from my computer, but when I went to update my Trend Micro antivirus program, it was disabled and could not update. I couldn't get any other antivirus to work.

    I ran across a related thread on these forums and tried Combofix, which ran successfully and created a log. Then I saw that I should have started with the guide, and I proceeded to work my way through those steps. Afterward, having not yet found an obvious problem, I also ran Bazooka.

    I've clearly made some progress, because at one point I couldn't update or run MalwareBytes and now I can, but it did not find any problems ...in spite of the fact that I still can't install an antivirus program like Avast or Antivir. Hoping the community here can help me find the insidious cause of my problems.

    Here are my logs, and thanks so much.
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You need to attach the other two logs requested in the below procedure:

    READ & RUN ME FIRST. Malware Removal Guide

    The logs you are missing are from Hitman Pro and MGtools. We need these to continue.

    Based on your ComboFix like, you still have TrendMicro installed ( at least it was not fully uninstalled ) and you should not be trying to install another antivirus program.
     
  3. LAareadad

    LAareadad Private E-2

    Thanks for the welcome!

    I should have stated that I was not able to run HitmanPro. I downloaded the 64-bit version, but when I double-click on it, nothing seems to run. There were other programs that didn't work at various times in this process (like MalwareBytes) that worked later in the process, but HitmanPro and new antivirus programs still won't work.

    I had just forgotten to include the MGTools log. Here it is.

    Also, the Combofix log in my previous post was from before I uninstalled Trend Micro. I just ran it again, so here's a fresh report.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please attach the logs from TDSSKiller and Malwarebytes too.
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay but now the MGtools logs are all out of date and still show TrendMicro since you did not run MGtools after uninstalling TrendMicro. Hence I still cannot tell if everything was properly uninstalled. I do see a driver for Panda in your ComboFix log too.

    Let's make an assumption that TrendMicro did not uninstall properly and run a fix for this along with another tool.

    Let's begin with some uninstalls. Uninstall the below.
    Coupon Printer for Windows >>> Not safe. See http://www.dslreports.com/forum/r20236965-Is-installing-a-Coupon-Printer-safe
    Java 2 Runtime Environment, SE v1.4.2_02
    Java(TM) 6 Update 33
    Panda ActiveScan 2.0


    Be patient while doing the below. The fixes can take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.


    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.


    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now download and save the below to your DESKTOP!!!! Then right click on it and select Run As Administrator. If you run into any problems, tell me EXACTLY what happens and exactly what messages you receive.

    Avira Free Antivirus


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
     
  6. LAareadad

    LAareadad Private E-2

    My MalwareBytes log is included in the original post as "mbam-log-2012-08-26 (17-10-16).txt" but I have attached another one from today.

    I've also attached the TDSS log.

    EDIT: Just saw the subsequent post and I am going through those steps now!
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Once you finish those instructions and attach the new logs, we can continue.
     
  8. LAareadad

    LAareadad Private E-2

    Great! I performed the following steps:

    - Uninstalled the four programs you specified
    - Completed all steps of Windows Repair
    - Used Combofix with the CFscript you provided

    But when I went to update Java, I received the following error:

    ""Error 1335. The cabinet file 'Data1.cab' required for this installation is corrupt and cannot be used. This could indicated a network error, an error reading from the CD-ROM, or a problem with this package."

    I have attached an image of the error, as well as the Combofix log. (Windows Repair does not appear to have generated a log.)

    Should I proceed with installing Avira and running MGTools again, or should I hold off until I figure out the Java error?
     

    Attached Files:

  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes just continue on.
     
  10. LAareadad

    LAareadad Private E-2

    More trouble, unfortunately.

    After selecting Run as Administrator, Avira displays an "Extracting files" process and gets mostly complete until an error message that says, "Some of the installation files are invalid. Please download the file again and try again."
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay skip Avira and continue.
     
  12. LAareadad

    LAareadad Private E-2

    Okay, here are the logs again, updated as of this morning.

    I'm not seeing any super-obvious virus symptoms, but Flash-related stuff is running very badly. (From Facebook to my kids' Disney games, a lot of Flash-intensive stuff just isn't working.) Performance also seems a bit slow on RAM-intensive stuff like Photoshop, but that could be my imagination.

    Thanks so much for the help. I appreciate the kindness, especially with how difficult my problem appears to be. If this remains a mystery, I am open to wiping my hard drive and re-installing Windows.
     

    Attached Files:

  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    It does not appear that this is related to malware as your logs are clean. However let's run a couple more scans to be sure.


    Please do the below so that we can boot to System Recovery Options to run a scan.

    For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)

    Now please download OTL by OldTimer.
    • Save it to your desktop.
    • Right mouse click on the OTL icon on your desktop and select Run as Administrator
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
      netsvcs
      
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     

Share This Page


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


<