MWBytes unable to remove certain things?

TakeThis

How is it now?

You can read about it here

bigblackdog

TakeThis wrote: »

W32/Ramnit!B1CB993C762C

Have you tried a System Restore. Probably infected by now anyway.

the link wants payment

bigblackdog

RussJK wrote: »

Agreed with TakeThis, looks like Ramnit.

Yes it's possible to disinfect in Windows 7, but it would be something I'd only really be willing to do with the machine in front of me.

bigblackdog - do you have backups of your files? Or another machine to work with?

just done another scan no malicious items detected , they will be back though.

backups - not really , you mean O/S and suchlike?

TakeThis

ESET Online Scanner

Scan all drives, as it has likely infected your Factory Restore partition as well as System Restore.

waddler_8

bigblackdog wrote: »

the link wants payment

Don't buy anything from that link - I've never seen such a bogus article (well, I have in all truth, that's sites full of them) It's just designed to have you download & pay for what's little more than a registry cleaner that definately wont fix the problem.

RussJK

bigblackdog wrote: »

just done another scan no malicious items detected , they will be back though.

backups - not really , you mean O/S and suchlike?

No, documents/photos/music/emails etc.

TakeThis

waddler_8 wrote: »

Don't buy anything from that link - I've never seen such a bogus article (well, I have in all truth, that's sites full of them) It's just designed to have you download & pay for what's little more than a registry cleaner that definately wont fix the problem.

There is no cost to read about the virus and I certainly did not suggest to click though to any pages further to the initial link.

It was simply for the reader to recognise the symptoms.

It generates its own copy in recycle bin and produces several Autorun.inf files. These files are created in each drive; when you access any drives then automatically this virus start executing and hence create numerous awful issues. To get rid of these annoying problems and to keep your PC secure it is very necessary to remove W32-Ramnit as soon as possible.

Symptoms of W32.Ramnit:-

o Corrupts files of different formats like HTML, EXE, DLL etc
o Hijack web browser
o Make your PC slow and unreliable
o Alter the system settings
o Redirects the browser to misleading websites
o Emails would be send to your saved contact without your permission
o Speed of internet gets slower
o Prompts annoying pop ups
o Generates duplicate files

waddler_8

Definately Ramnit. As said, it's really not worth trying to fight this, back-up format & reinstall.

http://www.threatexpert.com/report.aspx?md5=ba9048574c81cd438cbea36fb4307843

http://www.virustotal.com/file-scan/report.html?id=d0846af5780b7862556095fd0ccfb8c8d0557aa5e269d88440d5704987b7f1e3-1315947276

Win32/Ramnit infects Windows executable files with a file extension of ".EXE", ".DLL" and ".SCR

Win32/Ramnit infects HTML document files with ".HTML" or ".HTM" extension

Win32/Ramnit also infects Microsoft Office OLE document files with ".DOC", ".DOCX" or ".XLS" file extensions

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fRamnit

bigblackdog

ESET scanning now , see how it does

bigblackdog

50 win32/ramnit.H virus found after 2 mins