Computer infected with fake "spyware protection" program

great, thank you. i will try this tonight. one question: if i cannot get OTL.exe to open, should i employ the same tricks we used previously (i.e., rename OTL.exe) thanks, kristin

Hi kristin031204 OTL should open in safe mode since you were able to open other programs so try it first. If it will not open rename it to explorer.exe again. Let me know if you needed to rename it. When OTL reboots the computer let it boot to normal windows into the infected account.

We will need a new copy of OTL. You can get one from HERE You may need to use another computer and a CD to transfer it the infected computer along with the fix.

i couldn't access this site. i was able to get it from here: http://oldtimer.geekstogo.com/OTL.exe hopefully that was where you wanted me to go??

attached is the log that was open when the computer rebooted.

computer is being well-behaved!! no spyware protection program opening…can open word and other files. firefox opened, but i can't have 2 computers connected to the internet at once, so not sure yet if it can connect.

i feel we're getting close!

Hi kristin031204, Ok this looks ok. Try connecting to the internet and see if MBAM will update. If it does then please run an MBAM scan. Is it possible to leave this computer connected and work directly with it?

hi there! i'm on the infected computer/account and (obviously) able to connect through the internet. cannot get MBAM to check for updates through either malwarebytes.org or SecurityWonks.net what shall we try next??

Hi

We renamed mbam.exe to iexplore.exe. Try renaming it back to mbam.exe and see if that helps.

If still no go, check McAfee's firewall and make sure that mbam.exe is allowed access to the internet.

Can you reach any of the MBAM sites with your browser?

If everything is ok in the firewall you can try a manual update.

• Open windows explorer and namvigate to this folder
  C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware
  
• Rename to rules.ref to rules1.ref

Download the rules package from HERE

Save the download to C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

i am having a lot of problems with this step. unfortunately, we had a huge windstorm on friday night and lost power. we have been unable to connect to the internet on either computer since then. we think that perhaps an antenna was knocked down in the storm and are working with our ISP to fix this…so, it may take me a few more days before i can get connected back to the internet at home. thanks for the patience… kristin

Hi kristin031204, No problem. Thanks for letting me know.

alright…antenna fixed (finally!) so i'm back…

We renamed mbam.exe to iexplore.exe. Try renaming it back to mbam.exe and see if that helps.

did not help

If still no go, check McAfee's firewall and make sure that mbam.exe is allowed access to the internet.

Can you reach any of the MBAM sites with your browser?

sorry, but i am not able to figure out how to check the firewall. mcafee says i need to verify my subscription to do this…the computer is about 7yrs old and mcafee expired a loooong time ago…i know, i know, probably one of the reasons i am dealing with this virus. i have already read up on WTT's suggestions for securing my computer and will do that after i get the "all clean" signal

Yes, I can access both sites with my browser (SecurityWonks.net and Malwarebytes.org)

If everything is ok in the firewall you can try a manual update.

• Open windows explorer and namvigate to this folder
  
C:\Documents and Settings\<user name>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware


• Rename to rules.ref to rules1.ref

I went to try the manual update, but I do not have a "rules.ref" file or folder in the "Malwarebytes Anti-Malware" folder…could that be part of the problem??

i am sorry this seems to be such a pain…

Hi kristin031204,


Sorry about the delay, I've been traveling.

mcafee expired a loooong time ago…

If that is the case then it's not protecting you very much. We'll replace it with a good free one. First let's see if we can get MBAM updated.

I went to try the manual update, but I do not have a "rules.ref" file or folder in the "Malwarebytes Anti-Malware" folder…could that be part of the problem??

The file contains the definitions and shouldn't effect the ability to update.

Have a look in this location for the file

C:\Documents and Settings\All users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

If you are still unable to locate it try searching for it

• click start > search
• click All files and folders
• in the "all or part of the file name box" type rules.ref
• scroll down and set the look in box to local hard drives (C:)
• click search

If you successfully locate the file be sure to download the new one to the location you located the old one in.

ugh…i keep getting this message: Oops! Internet Explorer could not connect to files2.majorgeeks.com Suggestions: Go to majorgeeks.­com Try reloading: files2.­majorgeeks.­com/­files/­/­spyware/­mbam-­rules.­exe Search on Google: malwarebytes is apparently no friend of mine!!

Hi kristin031204,

Let's try it this way. Click here to get to the MajorGeeks web site.

Do not click the official mirror link, use the first download link named Download@Author's Site.

I just tried it and it worked for me.

okay, so i think what we are trying to do now is update malwarebytes. i was able to download a program called mbam-rules.exe from the major geeks website. i placed it where you told me to (C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware), noting that this is in "all users" and not the infected account. should i run this program?? i thought i would be downloading a file (rules.ref or something like that) thanks, kristin

Hi kristin031204, Seems things are a bit different. Yes double click the file you have downloaded, it should install the database.

i am having a really difficult time with malwarebytes. i downloaded rules.exe to C:\Documents and Settings\All users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware. Ran it and it in installed to C:\Program Files\Malwarebytes' Anti-Malware Tried to run malwarebytes from both C:\Documents and Settings\Program Files\Malwarebytes' Anti-Malware Keep getting the error code 730 (0, 0) The computer seems to be running okay. slow, but no other symptoms…