I am trying to remove Personal Security from a computer running Windows XP. I know that Malwarebytes can remove this infection, but I am unable to run it because PS is blocking exes. I have tried various programs to "kill" the malicious processes, without success. What is the next step?
Thanks.
My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:
Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!
Please be advised I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay in response time, but I will do my best to keep it as short as possible.
I'd be happy to work with you. At the moment, it is not possible to post a log, in that so far, I have not been able to run any program capable of producing a log. I know that the infection is Personal Security - we just need to kill its processes so that it is possible to run Malwarebytes to clean things up.
Please not that I am not always at the location where the infected computer is, so there may be some delay before I am able to act on your suggestions.
Thank you.
Please download and run the following tool to help allow other programs to run. (Thanks to Grinler of BleepingComputer.com)
There are 4 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. Rkill.exe Rkill.com Rkill.scr Rkill.pif
Once it is downloaded, double-click on the rkill.com in order to automatically try to stop any processes associated with rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next steps.
If you get a message rkill is an infection, do not be concerned. The message is just a fake warning by some rogue programs when it terminates programs that may potentially remove it. The trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this should allow you to bypass the malware trying to protect itself so that rkill can terminate the rogue processes. Continue to try running Rkill until the malware is no longer running. You will then be able to proceed with the next steps.
Do not reboot your computer after running rkill as the malware programs will start again.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Full scan, then click Scan. Please be patient, a full scan can take a bit of time. You may want to go off and do something else anc check back on it from time to time.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
I know you said there might be a delay before you could get to the machine that was having the issues. I'm just checking to make sure you are still with me. Typically we close posts with no reply after 4 days, but since you did mention the possible delays I wanted to make sure to leave it open for a bit longer for you. Please let me know that you are still with me.
Unfortunately, as I mentioned in my previous post, Personal Security was blocking the running of essentially all programs, so rkill, etc. was of no use. I have been able to resolve the infection via other means, so you may close this thread. Sorry for the delay.
Thank you.
I'm glad to hear you were able to solve the immediate problem on the machine. However, the absence of symptoms does not necessarily mean a clean system.
I would be happy to review an OTL log for you to ensure all of the files associated with the infection have been fully removed and to be sure there is nothing else on the machine which may not have been detected. If you would like me to review the log, please follow these instructions:
Download and Run OTL
Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
If you do not wish to have the log reviewed, this thread will be closed in 3 days.
