virus

waddler_8

MBAM was designed with the technician in mind. You need a quick resolution - not to be sat for hours watching scans - therefore the quick scan will the find malware that is actively affecting the system. In most cases a full scan isn't needed.

waddler_8

GunJack wrote: »

what happened to waddler's post ???

I deleted as we posted the same advice about running unhide

GunJack

oops, sorry, was doing that to dcm last night...he wanted to shoot me :eek:

GunJack

sorry, losing track. Can you still get into safe mode with networking, in the admin or user accounts, but with no progs showing ???

debitcardmayhem

GunJack wrote: »

oops, sorry, was doing that to dcm last night...he wanted to shoot me :eek:

Still might :A

peter_the_piper

Right. In networking safe mode. Programs visible, mostly, in administrator. In user no programs visible, Avira will download in firefox but will not finish installing. MS essentials will not install because its in safe mode. If I go to standard user mode then the !!!!!! comes up again with the scanning screen. All program names under "programs"are empty. Ran avira from startup disk but although it removed some things it missed the problem one. Ran malbytes, removed 7 but did not improve things. Still will not recognise usb drive so cannot run avira from card.
Did not have much hair before, even less now.

waddler_8

Post the malwarebytes log - lets see what it removed.

peter_the_piper

lwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 3

15:52:49 28/02/2012
mbam-log-02-28-2012 (15-52-49).txt

Scan type: Quick Scan
Objects scanned: 43338
Time elapsed: 3 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 7
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
I xpect its out of date but can't update at presnt.

waddler_8

In safe mode with networking, download (don't run) this file:

http://download.bleepingcomputer.com/grinler/WiNlOgOn.exe

Boot to normal mode.

Try to run the above file you downloaded, if it's successful, then run mbam again - quick scan.

peter_the_piper

I'll do my best but do I ignore the scanning screen that comes up?