MWBytes unable to remove certain things?

bigblackdog

theres some trojans in my netbook .
have been scanning with mwb since Sunday .
and then removing selected infections.
latest scan had 10 and mwb says unable to remove certain ones ............ they just gonna stay ?
any help gratefully recieved , thanks

santer_2

You could try running the scan with the netbook in safe mode with networking

Can you post the names of the ones it does not remove?

RussJK

Go into the Malwarebytes 'Logs' tab, and post the relevant logs first so we know what's happening.

Could be a file infector. Might be easier to backup anything important, then run the factory restore tool.

waddler_8

Malwarebytes' detection and removal capabilities are at their best in normal mode. A driver it uses doesn't load in safe mode.

As Russ said, post the log.

TakeThis

It probably is written that it cannot remove them until you re-boot.

bigblackdog

due to screen freezing , and other wierd things i didnt realise i had actually posted my thread .
MWB asks to re start to remove the items , so of course i re start . Soon though they are back .

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 7929
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
12/10/2011 15:56:27
mbam-log-2011-10-12 (15-56-27).txt
Scan type: Full scan (C:\|)
Objects scanned: 243665
Time elapsed: 36 minute(s), 10 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MICORSOFT_WINDOWS_SERVICE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Micorsoft Windows Service (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PwmJvpyi (Trojan.Agent.H) -> Value: PwmJvpyi -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent.H) -> Bad: (C:\Users\user\AppData\Local\hquwlppr\pwmjvpyi.exe) Good: () -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\users\user\appdata\local\hquwlppr\pwmjvpyi.exe (Trojan.Agent.H) -> Delete on reboot.
c:\program files\common files\Adobe\cs5.5servicemanager\cs5.5servicemanagermgr.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\pwmjvpyi.exe (Trojan.Agent.H) -> Delete on reboot.

bigblackdog

ok i shut down , re started , and am running a quick scan , already found 4 objects infected ......

TakeThis

W32/Ramnit!B1CB993C762C

Have you tried a System Restore. Probably infected by now anyway.

bigblackdog

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 7929
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
12/10/2011 16:25:41
mbam-log-2011-10-12 (16-25-41).txt
Scan type: Quick scan
Objects scanned: 162168
Time elapsed: 5 minute(s), 33 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MICORSOFT_WINDOWS_SERVICE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Micorsoft Windows Service (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PwmJvpyi (Trojan.Agent.H) -> Value: PwmJvpyi -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent.H) -> Bad: (C:\Users\user\AppData\Local\hquwlppr\pwmjvpyi.exe) Good: () -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\user\AppData\Local\hquwlppr\pwmjvpyi.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\user\AppData\Local\Temp\hchebrxrmapnbwyp.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.

bigblackdog

TakeThis wrote: »

W32/Ramnit!B1CB993C762C

Have you tried a System Restore. Probably infected by now anyway.

no i havent

RussJK

Agreed with TakeThis, looks like Ramnit.

Yes it's possible to disinfect in Windows 7, but it would be something I'd only really be willing to do with the machine in front of me.

bigblackdog - do you have backups of your files? Or another machine to work with?