malwarebytes not finding malware, issues with running scan and bluescreen

[Gbaby614]

should i try this??
http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?softwareitem=oj-22424-5&cc=uk&dlc=en&lc=en

 

[Fiery]

should i try this??
http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?softwareitem=oj-22424-5&cc=uk&dlc=en&lc=en

I don't think that would help..

I have gone through your quarantine logs multiple times, none of the tools removed any drivers. Your webcam stopped working after combofix removed some files but we have restored that and its registries.

So right now I think we have 2 viable options excluding trying to fix it as we have been doing for the past few days.

1) You can call or contact HP (http://h20180.www2.hp.com/apps/Nav?h_pagetype=s-006&h_lang=en&h_cc=ca&h_product=321957&h_client=S-A-R311-2&h_page=hpcom)

2) Perform a system restore to a previous point where your webcam worked and we will swiftly remove the malware again if they appear. We won't use combofix this time but instead use OTL, adwcleaner and RK. The removal process will be quick since I already know what is needed to remove.

Let me know

If you decide on the second option, after the restore finishes, run adwcleaner, RK then do a OTL scan with the instructions before.

 

[Gbaby614]

i think i need to do a system restore again, i was notified a little while ago that windows defender is no longer working an the reason was at this link for the error code given:
Windows defender stopped working/-----http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/1897827f-f9ff-4018-b72c-30deee560825
I just keep running into issue after issue and if u don't mind... since we already did all this it should be easier to explain this time..id rather system restore.. are you going to be on in a few mins bc I am seriously delayed from your posts.. i dont know if it has anything to do with the state of my pc and the errors or not.. but i refresh often and never see your posts until i decide to msg u again..thus is why i sometimes leave msgs often

 

[Gbaby614]

also........ before removing visi_coupon.. i need to remove it from my yahootoolbar next time.. is aw it there yesterday and couldnt remove it because it was unavailable to view, yet it was still on my toolbar..

 

[Gbaby614]

Im having issues already... my webcam isn't loading at all now.. atleast the Youcam software would load now nothing. I had the webcam on briefly 2 days ago and after one of our scans and fixes is when i noticed it quit.. about 2/1/13.. I also started to run OTL but it wasnt on my system anymore so I clicked your link and i got the warning from geeks2go that it contained malicious content, so i closed it. I really dont knowwh at to do now. I need to run these scans, but dont have the progs.. i think i still have adwcleaner, i will run that and return but i need to know should i run the 2 files u sent earlier about updating webcam drivers? maybe the old ones were deleted on restore.....

---

my roguekiller is gone too

 

[Gbaby614]

i dont see a log for adwarecleaner, u may have to remind me of a folder bc the last Adwcleaner.txt I see is from 2/2/13

---

i did remove visi coupon from my toolbar, i just may need u to remove the prog

 

[Gbaby614]

i was able to dl OTL and the other progs

 

[Gbaby614]

RogueKiller V8.4.4 [Feb 3 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version
Started in : Normal mode
User : Michelle [Admin rights]
Mode : Scan -- Date : 02/04/2013 03:34:10
| ARK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 12 ¤¤¤
[TASK][SUSP PATH] Test TimeTrigger : C:\Users\Michelle\AppData\Local\Temp\Runner.exe C:\Users\Michelle\AppData\Local\Temp\DNS.exe -> FOUND
[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKCU\[...]\System : DisableCMD (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableCMD (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableCMD (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

---

i did NOT delete any of these items as u did NOT instruct me to do so...

 

[Gbaby614]

here is the OTL and Extras txt

 

[Gbaby614]

i think i found the driver that is missing, but it is in C:\SwSetup\SP34746\WCAMR\driver\RY5U870_SU002_32_64bit_Release on my pc and there are drivers that we may be able to install in (C) SwSetup> SP36409>WCAMR

 

[Gbaby614]

OMG, I got it to work a little bit ago, around 8am, I tried to update the drivers and reinstalled the whole mediasmart program several times, and I finally saw imaging device in my device manager and got the webcam to load and work then it kept saying it had to close, and now its not showing imaging devices in the devicem anager anymore and I cannot update the Intel Corporation-Display-Mobile Intel(R) 4 Series Express Chipset Family which is what I was trying to update when I had it working.. but it fails. I have my driver recovery cd I just need to know how to find the right drivers to reload.. I can't guess..bc I don't want to mess anything up. There is a file called FUPDATE but again.. I need someone to guide me thru this. I searched all night and it says my drivers are missing or need updated or repaired, so if we can figure this out, I believe it will work again.

 

[Gbaby614]

The webcam is working again.. but not sure how long, I guess just help me with any malware removal and I will check to see if it is still working after we are done. The malware removal seems more important at this point.

 

[Fiery]

Good to hear that your webcam is working again! Let's clean some stuff.

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
IE - HKLM\..\SearchScopes\{251E6002-154D-42BD-BCE2-460628EE3FA7}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE - HKU\.DEFAULT\..\SearchScopes\{251E6002-154D-42BD-BCE2-460628EE3FA7}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
[2013/02/04 01:59:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{40D65E82-75AC-47CA-8A73-1CEDC2668EFF}
O2 - BHO: (no name) - {300BEC06-B743-4D19-86B9-11DC711D7FFB} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKU\S-1-5-21-3488472860-609737526-646370250-1000\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.

:Files
C:\USERS\MICHELLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2V64ZCE3.DEFAULT\EXTENSIONS\PLUGIN@SELECTIONLINKS.COM
ipconfig /flushdns /c

:Commands
[EMPTYTEMP]
[RESETHOSTS]

Then click Run Fix. Let your PC reboot to normal mode. A new log will be created automatically, post the content in the next reply.

---

Do a scan with roguekiller again. Uncheck all the detection except for:
[TASK][SUSP PATH] Test TimeTrigger : C:\Users\Michelle\AppData\Local\Temp\Runner.exe C:\Users\Michelle\AppData\Local\Temp\DNS.exe -> FOUND
It should be under the Registry tab. Click delete.

---

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool(For Vista or Windows 7, right-click and select Run as Administrator to start)
• Click delete
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt

 

[Gbaby614]

Sorry I took so long getting back, I had some things to tc of yesterday.. here is the OTL log, will return w RKlog and AdC log:

OTL by OldTimer - Version 3.2.69.0 log created on 02052013_071203

Files\Folders moved on Reboot...
C:\Users\Michelle\AppData\Local\Temp\Low\~DFCD6C.tmp moved successfully.
C:\Users\Michelle\AppData\Local\Temp\Low\~DFD0BC.tmp moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WCANYHFI\newmailcount[4] moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WCANYHFI\rsa[1].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WCANYHFI\Thread-malwarebytes-not-finding-malware-issues-with-running-scan-and-bluescreen[4].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S8VN82WV\css[1].css moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S8VN82WV\search[3].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NWZSBO15\en-us[1].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NWZSBO15\js[1].js moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NWZSBO15\newmailcount[4] moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GL5AC7BK\oneMscomMaster[1].js moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GL5AC7BK\search[2].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GL5AC7BK\Segments[1].js moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File\Folder C:\Windows\SysNative\OLD51B3.tmp not found!
File\Folder C:\Windows\SysNative\OLD51D3.tmp not found!
File\Folder C:\Windows\SysNative\OLD51D4.tmp not found!
File\Folder C:\Windows\SysNative\OLD51E4.tmp not found!
File\Folder C:\Windows\SysNative\OLDC553.tmp not found!
File\Folder C:\Windows\SysNative\SET2F42.tmp not found!
File\Folder C:\Windows\SysNative\SET2FD3.tmp not found!
File move failed. C:\Windows\SysNative\SET30CF.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SET3AF7.tmp not found!
File move failed. C:\Windows\SysNative\SET3BF7.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SET3F82.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SET4512.tmp not found!
File move failed. C:\Windows\SysNative\SET45E0.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SET499B.tmp not found!
File move failed. C:\Windows\SysNative\SETAEA5.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SETC27B.tmp not found!
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[Gbaby614]

OTL by OldTimer - Version 3.2.69.0 log created on 02052013_071203

Files\Folders moved on Reboot...
C:\Users\Michelle\AppData\Local\Temp\Low\~DFCD6C.tmp moved successfully.
C:\Users\Michelle\AppData\Local\Temp\Low\~DFD0BC.tmp moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WCANYHFI\newmailcount[4] moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WCANYHFI\rsa[1].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WCANYHFI\Thread-malwarebytes-not-finding-malware-issues-with-running-scan-and-bluescreen[4].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S8VN82WV\css[1].css moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S8VN82WV\search[3].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NWZSBO15\en-us[1].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NWZSBO15\js[1].js moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NWZSBO15\newmailcount[4] moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GL5AC7BK\oneMscomMaster[1].js moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GL5AC7BK\search[2].htm moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GL5AC7BK\Segments[1].js moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Michelle\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File\Folder C:\Windows\SysNative\OLD51B3.tmp not found!
File\Folder C:\Windows\SysNative\OLD51D3.tmp not found!
File\Folder C:\Windows\SysNative\OLD51D4.tmp not found!
File\Folder C:\Windows\SysNative\OLD51E4.tmp not found!
File\Folder C:\Windows\SysNative\OLDC553.tmp not found!
File\Folder C:\Windows\SysNative\SET2F42.tmp not found!
File\Folder C:\Windows\SysNative\SET2FD3.tmp not found!
File move failed. C:\Windows\SysNative\SET30CF.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SET3AF7.tmp not found!
File move failed. C:\Windows\SysNative\SET3BF7.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SET3F82.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SET4512.tmp not found!
File move failed. C:\Windows\SysNative\SET45E0.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SET499B.tmp not found!
File move failed. C:\Windows\SysNative\SETAEA5.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\SETC27B.tmp not found!
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[Gbaby614]

RogueKiller V8.4.4 [Feb 3 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version
Started in : Normal mode
User : Michelle [Admin rights]
Mode : Remove -- Date : 02/05/2013 08:09:00
| ARK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 12 ¤¤¤
[TASK][SUSP PATH] Test TimeTrigger : C:\Users\Michelle\AppData\Local\Temp\Runner.exe C:\Users\Michelle\AppData\Local\Temp\DNS.exe -> DELETED
[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> NOT SELECTED
[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> NOT SELECTED
[HJPOL] HKCU\[...]\System : DisableCMD (0) -> NOT SELECTED
[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> NOT SELECTED
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> NOT SELECTED
[HJPOL] HKLM\[...]\System : DisableCMD (0) -> NOT SELECTED
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> NOT SELECTED
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> NOT SELECTED
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableCMD (0) -> NOT SELECTED
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NOT SELECTED
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NOT SELECTED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

 

[Gbaby614]

this is the 1st time I got this warning, was the link to the adwcleaner u posted clean?? it said not signed by publisher and doesn't want me to dl... or was i supposed to tuen off my virusprotection to dl this? here is what i see:

---

going to just leave this set until u reply........

 

[Jack]

Hello Gbaby614,
Adwcleaner is a safe and known tool, that alert from Internet Explorer Smart Screen filter is just a false possitive....

TIP: If you ever suspect that a file might be infected, you can upload it to virustotal.com to be scanned with multiple antivirus engines.
Adwcleaner Virustotal scan: https://www.virustotal.com/file/ae3337886b874ae8c5c402d8ede284493176ffe61f57f87bad113967e0c2e3ca/analysis/

 

[Gbaby614]

yeah, i have that link in my favorites but the dl isnt complete and isnt showing me the link to check unless im supposed to check the page itself.. but thanks Jack, i wil continue the dl now.. be back w log...

 

[Gbaby614]

# AdwCleaner v2.111 - Logfile created 02/05/2013 at 08:56:59
# Updated 05/02/2013 by Xplode
# Operating system : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# User : Michelle - MICHELLE-PC
# Boot Mode : Normal
# Running from : C:\Users\Michelle\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Ask.com
Deleted on reboot : C:\ProgramData\Ask
Deleted on reboot : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v18.0.1 (en-US)

File : C:\Users\Michelle\AppData\Roaming\Mozilla\Firefox\Profiles\2v64zce3.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v24.0.1312.57

File : C:\Users\Michelle\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S3].txt - [1067 octets] - [05/02/2013 08:56:59]

########## EOF - C:\AdwCleaner[S3].txt - [1127 octets] ##########