Unable to download anything

[rc]

My Norton antivirus subscription ran out, and I wanted to change to Microsoft Security Essentials, so I uninstalled Norton.  Now, when I try to download MSE (I've also tried to download Adblock) and I get the message that this type of file cannot be downloaded.  I was using Internet Explorer, and changed to Mozilla.  My Mozilla seems to be outdated and I am trying to update, but Babylon has taken it over.  I've had trouble with Babylon before, and apparently never did quite get rid of it.  Is anyone able to help?  Thanks!

[Corrine]

Ah, Babylon!  In that case, lets see if you can download the tools to provide some logs.  See the instructions at Log Posting Instructions.

[rc]

I'm trying to follow the instructions, but an ad program keeps interfering.  I'm trying to uninstall it and it doesn't seem to be working.  It just keeps saying it is uninstalling.  The program is Sendori.  I'll try again to work around it since it won't uninstall.

[rc]

OK - I got the ad program closed and tried to download dds and got this message:  dds.scr couldn't be downloaded.   

[Corrine]

Hi, Rita.

Although you uninstalled Sendori, there may be other undesirable applications installed.  Please look for and uninstall any of the following you find:  Discount Cow, V-bates, PriceMeter, Supra Savings, weDownload Manager, PureLead, Search Assist, Re-Markable, Zombie Alert, Wajam, Coupon Server, Lollipop, HD-Total-Plus, BlockAndSurf, Safe Saver, SupTab, Search Protect, Lollipop, Software Updated Version, DP1815, Video Player, Convert Files for Free, Plus-HD 1.3, BetterSurf, Trusted Web, PassShow, LyricsBuddy-1, PureLeads, Media Player 1.1, RRSavings, Feven Pro 1.2, Websteroids, Savings Bull, TidyNetwork, Search Snacks, MyPC Backup, Re-markit as well as any other recently installed unknown programs.

After completing that, see if you can download the the files in the Log Posting Instructions.  If so, proceed with those instructions.  If not, please follow the instructions below.



I checked your previous posts and you've had to do this before so I know you can do it again!  If you are unable to follow these instructions, please let me know.

1.  Please restart your computer in Safe Mode with Networking. (To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard. Using the arrow keys on your keyboard, select Safe Mode with Networking and press Enter on your keyboard. Windows will now boot into safe mode with networking and prompt you to login as a user.) 

2.  Let's make sure the proxy settings haven't been changed. 

• Please start Internet Explorer, and when the program is open, click on the Tools menu and then select Internet Options.   
  
• Click on the Connections tab.
  
• Click on the LAN Settings button.
  
• Under the Proxy Server section, please uncheck the checkbox labeled "Use a proxy server for your LAN".
  
• Press the OK button to close this screen followed by the OK button to close the Internet Options screen.
  

3.  Without restarting the computer, please download Rkill by Grinler and save it to your desktop.  When you click the following link, a new tab will open and after a few seconds you will be provided a download option for iexplore.exe.  Save that file to your desktop:  http://www.bleepingcomputer.com/download/rkill/dl/11/

• Double-click on the Rkill desktop icon to run the tool.  Note:  For Windows Vista or Windows 7, please right-click and select "Run As Administrator".
  
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  
• If not, delete the file, then download and use the one provided in Link 2.
  
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  
• If the tool does not run from any of the links provided, please let me know.
  

Note:  Do not restart the computer, or you will need to run the application again.

4.  Hopefully, you still have Malwarebytes installed on your computer.  Please scan with MBAM:

• Launch Malwarebytes' Anti-Malware then click the Update tab and "Check for Updates"
  
• Please update the database by clicking on the Update Now button as shown below.
  
  
  
• Following the update, click on the large green Scan Now button to begin the Threat Scan.
  Note: Optionally, you could have simply clicked Fix Now if it is displayed. That will automatically download updates and run a Threat Scan.
  If Malware or Potentially Unwanted Programs are found you will receive a Prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.
  
• A window with an option to view the detailed log will appear. Click on View Detailed Log.
  
  
  • After viewing the results, please click on the Copy to Clipboard button > OK.
    
    
  • Paste your log into your next reply.
• Note: If you lose the Clipboard copy and need to retrieve the log again it can be found by opening Malwarebytes and clicking on History> Application Logs with the date of the scan. Simply double-click on that in order to see the options for Copying to Clipboard or to Export to a .txt file (Notepad). etc.. The .txt file can be saved and posted when you are ready.

5.  After that has been completed, if MBAM did not restart your computer, please do so now and go to the Log Posting Instructions topic.  In the event you cannot download the files in Normal Mode, please see the first set of instructions for restarting in Safe Mode with Networking.  Note:  Due to the forum character restrictions, it may be necessary to create two replies in order to get the requested logs to post.

[rc]

Corrine,
Thanks so much for responding!  I just got home and following instructions.
I got to #3, and when I clicked on the download link for rkill I got this message:  iExplore.exe could be downloaded.  Why did it say iExplore.exe and not rkill?  Thanks for your help!

[rc]

please disregard that last question - I see why it was called iExplore.exe and not Rkill.  I'll just wait to see what to do next - thank you!!

[Corrine]

Hi, Rita.

You posted again as I was multi-tasking here so I'll leave what I wrote.  :) 

I'm curious.  Did you find any of the other files that tend to accompany Sendori installed?

iExplore.exe is merely another name for the tool.  Go to http://www.bleepingcomputer.com/download/rkill/ and scroll down the page to "RKill download links".  Click any one of them.

Continue on with the instructions.  Since it is approaching the end of my day, I'll be more likely to look at logs tomorrow (after I've had sufficient coffee).

[rc]

OK - I should be home more tomorrow than I was today.
Was the list of files you told me to look for what you are asking about?  None of those on the list you gave me were installed.  I did find one called Jolly Wallet that I uninstalled.

[Corrine]

Yes.  We'll pick up any "extras" when I see the logs.

[rc]

I tried again using Mozilla, and I can download with it.  I downloaded Iexplore and will copy those results.  then I downloaded malwarebytes (this is my husband's computer, and he never had it on this one) and ran the scan.  It found over 300 items, I quarantined them, and had some trouble copying to clipboard and exporting - I tried both - then I exported to a text file but when I pull it back up it seems blank.  I'll send you what I have.
Rkill 2.7.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/27/2015 08:54:56 PM in x86 mode. (Safe Mode)
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* COM+ Event System (EventSystem) is not Running.
   Startup Type set to: Automatic

* Security Center (wscsvc) is not Running.
   Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
   Startup Type set to: Automatic (Delayed Start)

[rc]

here is malwarebytes - notepad - it's blank ;(
Malwarebytes Anti-Malware
www.malwarebytes.org

[Corrine]

Hi, Rita.

The good news is that RKill reports "No malware processes found to kill." so, although there may still be undesirable files on the computer, they aren't the reason for the problems.  The report does show a couple services that are not running and should be, in particularly the Security Center.

1.  Please tell me if this works to get the Security Center operational again:  Open Control Panel\All Control Panel Items\Action Center and see if you can restart the Windows Security Service by clicking on the "Turn on now" button.

2.  Please launch Malwarebytes and click on History> Application Logs.  Select the Scan log from last night and click View.  The log will open in Notepad.  Right-click in Notepad and click Select All.  Right-click again and select Copy.  Then paste the log here as a reply.

3.  After that, please proceed with the DDS logs and Security Check.

[rc]

ok - thank you!
should I do this in regular mode or safe mode?

[rc]

I went to the Action Center and could not find the words Windows Security Service anywhere.  In the Security tab, it just tells me that I'm missing virus protection and a button to find a program online.  I opened everything on the Action Center page, and the only things it tells me I'm missing are QuickTime and Backup.