Good to see you again. I know that you were in great hands with Ken545.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan as shown below.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-
I see that Ken already had you try to run ComboFix. Once Malwarebytes has finished running and produced the new log, please attempt to run ComboFix again in Normal Mode. After it has run, it will create a log that I would like for you to post into your next reply.
———-
In your next reply please post the logs created by both Malwarebytes and ComboFix.
Hi Jeff,
Nice to see you too again. Yes, Ken was very nice and tried his best to help me. Ok, I already have Malawarebytes on my computer but every time I open it , it says…. Database is outdated by … would you like to update it now? When I click yes I get an error screen that says… An error has occurred. Please report this error code to our support team. Program_error_updating( 2,0, CreateFile). the system cannon find the file specified. I recently wrote in and told them about it (I kind of forgot about it before) so I'm waiting to see if I hear back from them. I ran a Malawarebytes scan about a week ago, around when I got the Genome Trojans, but nothing showed up on the report. I'm not sure if that's because I can't update it or what. Gosh! I just can't get anything to work right, can I …. lol! I'm sorry. And I definitely remember having trouble with Combo Fix and a couple other things months ago when I had some problems. I never did get it to work.
The past few nights or so the F-Secure scans I've ran all came out clean. I don't understand how I can have Trojans one day and they just disappear the next. Seems kind of weird to me. But then again I really don't know anything about all this stuff.
I will run the Malwarebytes again but I'm not sure if its going to be any good if I can't update. As far as ComboFix, I dunno….. I don't think its going to work. I'll try again but I really doubt it.
Let's see about getting a clean version of Malwarebytes onto your system. I know that their was a completely new version just put out a day or so ago so we should get that onto your system. Please do the following:
———- Download Revo Uninstaller
Double click the installation file on the desktop to run the installer.
Let it install to the default location.
Double click the new Revo Uninstaller Icon on the desktop to start the program.
You will now see a list of installed programs that Revo Uninstaller can remove.
Locate the program you are uninstalling <Malwarebytes>
Right Click the Icon then choose Uninstall.
Click yes to the warning and choose the Uninstall Mode
Choose the Advanced option and then click Next.
This will launch the programs built in uninstaller. Be patient it can take several seconds.
Once the uninstaller is done click Next.
Revo Uninstaller will now scan for leftover information. Be patient it can take several seconds.
Once this scan is done click Next.
You will then be presented of the leftover entries found by Revo Uninstaller
Look at ALL of the entries to ensure they relate to the uninstall.
Next click Select All > Delete to remove the entries.
Click Next.
If there are any program file folders left over you will be presented with a list to be removed.
Again look at ALL of the entries to ensure they are related to the uninstall.
Click Select All > Delete to remove the entries.
Click Finish to go back to the uninstall list.
Close the program
———-
Now download Malwarebytes from here, check again for any updates and then run a Quick Scan of the system. Once finished it should produce a log that I will need for you to copy/paste into your next reply.
**Note** Even if you are not able to get Malwarebytes to run, please run ComboFix using my earlier instructions, if you have not already done so, and post the log created by ComboFix as well.
Ok, I downloaded Revo uninstaller, clicked on it and did the scan, I'm at the part where it lists all the left over things. You said to look through to make sure everything has to do with Malwarebytes but the list starts with My Computer, next down is HKey_Current_User, next down is Software, then Microsoft, Windows, Current Version, Explorer, Menu order, Start Menu2, Programs each one is under the other and each is indented in by another space in. Then there is a line down from Current Version to ShellNoRoam and under that is (indented in a space) MUICache. Then there's a line down from HKey_Current_User to Hkey Local Machine and things listed under there, each one indented in another space. And it continues. You said to delete only the one's associated with Malwarebytes but I'm not sure what these other things are. The first one My Computer, I don't know if that's actually My Computer and everything in it or if its just part of the path to get to the Malwarebytes files(the files I already deleted). It seemed like all the files that had to do with Malwarebytes were in bold, so I put a check next to those one's that I knew for sure had to do with Malwarebytes and deleted those. But now I'm not sure what to do. Please help asap!!! Thanks!
I forgot to mention, on the list of files the HKey_Current_User and Software(right underneath) are both in Red. Same with HKey_Local_Machine and a few things listed underneath of that. The rest are in regular black type letters. And all of these are in what's called " Found leftover Registry items".
Oh, and after it did the scan before I clicked to find the left over files a box came up saying to complete everything I needed to restart my computer. I clicked no because it didn't say anything about that in your notes.
Um,… I had the Revo box minimized and accidentally clicked on it (thinking I was clicking on something else) when it came up I went to minimize it again but as I was moving my mouse over it I accidentally clicked the mouse and it was by the "Next" button and went to the next screen. There was no "Back" button. It came up with a list of Documents and things all associated with Malwarebytes so I went ahead and check them all and deleted them. Then it went to the "Finish" page. I'm really sorry, I hope I didn't do anything wrong. The only thing would be those list of things I mentioned before like My Computer and HKey, Software, Microsoft, etc. I'm really hoping I wasn't supposed to put a check beside those and delete those too, if I was is there a way to go back to delete those? I'm really sorry.
It sounds like you did everything correctly using Revo Uninstaller. I apologize if my instructions were not clear enough and it was difficult to use.
Now download Malwarebytes from here, check again for any updates and then run a Quick Scan of the system. Once finished it should produce a log that I will need for you to copy/paste into your next reply.
Ok, Good, thanks. I was afraid I might have did something wrong with the Revo. Glad to hear I didn't. I got Malwarebytes downloaded and I did the Quick scan. It doesn't look like anything was found. Here is a copy of the scan results….
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7268
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
7/24/2011 10:52:58 PM
mbam-log-2011-07-24 (22-52-58).txt
Scan type: Quick scan
Objects scanned: 151317
Time elapsed: 4 minute(s), 37 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Thanks!
I tried running Combo Fix a few more times but it still won't run. It keeps freezing and then makes the rest of my computer freeze. I have to shut the computer down and restart to be able to do anything. I don't know why it does that and why it won't work. I had the same problem a while ago when I wrote in for help and I don't think we ever did get it to work. Sorry
Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.
Link 1 Link 2
[external image: Posted Image]
[external image: Posted Image]
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Hey Jeff,
I'm sorry I haven't been in touch the past couple days. I got sick and wasn't feeling good. But I'm starting to feel better, but its pretty late. I will do as you asked in your last post probably some time tomorrow. Again, I'm really sorry.
Hello again Jeff,
Thank you! I'm really sorry I wasn't able to try downloading ComboFix again today. I was hoping I would have felt a little better than I did today. I'm starting to feel a little better, just not as good as I hoped. But, I should be able to try downloading ComboFix again either today(Fri.) or tomorrow. I just wanted to drop you a quick note to let you know just so you didn't think I forgot about it or just wasn't going to do it. And so this wasn't closed. I'm really sorry to keep you waiting and I will get that done asap.
Thank you!
I know that you were in great hands with Ken545. 