laptop, malware.

Saint_Chris

Been doing a clean up (best I can) of the lap top, I've done malwarebytes, and these 4 problems keep coming up on a scan, I can't get rid of them. Any ideas...thanks.


Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2014.04.06.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
chris :: CHRIS-HP [administrator]
06/04/2014 13:32:09
mbam-log-2014-04-06 (13-32-09).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 220820
Time elapsed: 4 minute(s), 26 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{FE6F06FB-0FC0-4499-828F-EE48088F504F} (PUP.Optional.MyScrapNook.A) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{FE6F06FB-0FC0-4499-828F-EE48088F504F} (PUP.Optional.MyScrapNook.A) -> Data: ûoþÀ™D‚îHPO -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{b3b5c47e-61f7-4d81-af06-461fc86686ce} (PUP.Optional.MyScrapNook.A) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks|{b3b5c47e-61f7-4d81-af06-461fc86686ce} (PUP.Optional.MyScrapNook.A) -> Data: -> Quarantined and deleted successfully.
Registry Data Items Detected: 0

Saint_Chris

I've gone into add remove programs and it's there,


my scrapnook internet explorer toolbar..........it won't let me remove it.


I don't know how or why this has appeared.

grumpycrab

http://malwaretips.com/blogs/myscrapnook-toolbar-removal/

Saint_Chris

thank you


I've done the malware bytes, but it still keeps coming back.


I've tried the add remove prog, but I just get.


there was a problem starting.................
the specified module could not be found.

emptybox

Try starting the computer in Safe Mode (press F8 repeatedly as the computer is booting up), and then try running Malwarebytes in there.

Also try to uninstall the scrapnook thing in Safe Mode.

macman

That's only a Quick Scan. If it finds 4 items on that brief scan, you need to run a Full Scan as well.

sparkyspark

Saint_Chris wrote: »

thank you I've done the malware bytes, but it still keeps coming back. I've tried the add remove prog, but I just get.
there was a problem starting.................
the specified module could not be found.

A Cannot find, Cannot start, Cannot load, Could not run/Cannot run or “specific module could not be found” message is usually related to malware or (PUP)Potentially Unwanted Programmes that were set to run at startup, but the referenced files have been deleted after a malware scan leaving behind a registry entry pointing to a file that does not exist, in your case by Malwarebytes.

Windows is trying to load this file but cannot locate it since the file was mostly likely removed/deleted during the scan for malicious software. However, an associated orphaned startup parameter or registry entry remains and is telling Windows to load the file when you boot up or login.

You need to remove the referenced entry so Windows stops trying to run the file. It may or may not be in the registry. Autoruns (see below) will find the item no matter where it is.
If you just locate and uncheck the item in msconfig, that disables the item but does not remove the reference to the bogus startup item from your computer.

Autoruns does not install anything on your computer. It will display all of the startup locations where the reference might be so you can disable it or delete it completely. Here is the download link for Autoruns:
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Read this first Use Autoruns to Manually Clean an Infected PC then Launch Autoruns.exe and wait for it to finish populating the list of entries.
When Autoruns is finished scanning your system, it will say “Ready” at the bottom left corner. Autoruns can be a little intimidating at first if you have never see it before since it displays a lot of information. You are really only interested in a couple sections.
The problem item is usually in the system startup or user startup entries so click the Logon tab.
Scroll through the list and look for a startup entry related to the file(s) in the error message, in your case anything relating to MyScrapNook.
If you don’t find it there, look for it in the Everything tab.
Right-click on the offending entry and choose to delete it. If you don’t see it in Autoruns you will have edit the registry and remove the item from the Startup folder there. Autoruns displays the same information though.

Also the link grumpycrab gave you explains how to clean up up your Internet Browser manually as it will have most likely hijacked your browser configuration.

Saint_Chris

thank you for those replies.


I did a full scan and it picked up 6 problems, I tried to correct them....then I re-booted, again I did a full scan, and it came up with the 4 problems, I re-booted again, and did a quick scan and the 4 came up again.


It's a bit late now, had a busy day, but thanks for those replies and i'll have a good read through tomorrow and try and remove them, technically I'm not good, but i'll have a go.


thank you

Saint_Chris

I've just done a full scan, and the same 4 problems came up, nothing else.


thanks

emptybox

Saint_Chris wrote: »

I've just done a full scan, and the same 4 problems came up, nothing else.


thanks

It's likely these are just the remnants in the registry.
Try updating to Malwarebytes version 2.0. That has a slightly longer reach, in my experience.

If that doesn't help you may have to resort to guddling in the registry, if you want to get rid of all traces of it. Remember to back up the registry first.

GunJack

run CCleaner's registry cleaner, it will remove the last reg key elements, then MBAM quick scan again afterwards