Problem with Malwarebytes?

crafty*kate

Hi, I am following the steps to remove the System Tool 2011 virus and I'm having trouble with Malwarebytes - it scans for about half an hour (finds 2 infected files) and then I get the message 'Malwarebytes has encountered a problem and needs to close' etc.

I'm already in Safe mode - following the instructions from bleeping computer.com. Is there something else I should be doing? How can I remove this virus if I can't run Malwarebytes?

Thanks everyone!

The_Grandmaster

Is this a full scan or a quick scan?
If a full scan keeps crashing, run a quick scan first, remove everything found, update definitions and rerun a full scan. Post logs each time here.

Malwarebytes official instructions: renaming malwarebytes might help too?
http://forums.malwarebytes.org/index.php?showtopic=66064

crafty*kate

Aha...it was a full scan. Good idea. Thanks for the link as well.

I love this forum - thank you!

crafty*kate

Ok....quick scan worked I think. Just posting my log here so I don't lose my place!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5983
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702
07/03/2011 23:42:53
mbam-log-2011-03-07 (23-42-53).txt
Scan type: Quick scan
Objects scanned: 171522
Time elapsed: 3 minute(s), 13 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gAkKcNh06300 (Trojan.FakeAlert) -> Value: gAkKcNh06300 -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\all users\application data\gakkcnh06300\gakkcnh06300.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

aliEnRIK

You may have to switch of 'heuristics' to get a full scan