Spyware, viruses, & security forum: malwarebytes not working

The rep from malware sent me a combofix and its looks liked it worked.

Hello all,

Intermediate user here.
Trying everything to get rid of this junk. It won't allow me to run any of the four versions of rkill, even to open as admin. I have Malwarebytes installed on the laptop, only because I transferred it with a jump stick from another computer. I can't open any programs incl IE browser on affected computer, including a command prompt.

I don't know where to start to get rid of this junk.

Any help is gratefully appreciated.

Kathy

I had the same problem, but i ran rkill as soon as possible after booting... and it actually worked! Now I can finally go to sleep!

http://download.bleepingcomputer.com/grinler/WiNlOgOn.exe


and


http://download.bleepingcomputer.com/grinler/uSeRiNiT.exe


give them a try!

After you ran one of the above........ do NOT reboot your computer but run Malwarebytes Anti Malware.

I would suggest:

please use a friend's or family member's computer and download the Malwarebytes tool and it's manual update from the link below.. Once downloaded, rename the program installer "mbam-setup.exe" file to something else like "Your Name.exe", then copy the installer file and the update file to a CD or flash drive.. Transfer the file to the problem machine, then install the "Your Name.exe" file, then run the update to get the program current.. After that, run a full system scan and delete anything it finds.

Malwarebytes Download Link (Clicking on the links below will immediately start the download dialogue window.)
http://www.besttechie.net/tools/mbam-setup.exe

Malwarebytes Manual Updater link
http://www.malwarebytes.org/mbam/database/mbam-rules.exe

SuperAntispyware
http://www.superantispyware.com/

SuperAntispyware Manual Updater
http://www.superantispyware.com/definitions.html

Does that work?

I can't thank you enough for this post Marianna. I was beginning to think that "Security Tool" had outwitted everyone...
Preventing "Security Tool' from starting, at boot up, at all, and then eliminating it altogether with a mal ware program was a stroke of genius.
A step by step approach for anyone interested in trying this is here:

http://www.bleepingcomputer.com/tutorials/tutorial101.html

Thanks again!

My Malwarebytes scan ran all night but it found and erased all of this pesky malware. Thanx so much for this insight.
M

I read the posts about using the rkill.com and other renamed versions of it (all of the ones in the posts here), so I tried to download each one in succesion. Each one was tagged as a trojan by my McAfee Total Protection, so I blocked them.

I specifically looked here on CNET because I am careful about following one set of instructions to get rid of a problem when I'm not even sure if they're from a reputable source. Since I trust CNET as a credible source I looked here and see the references to the http://www.bleepingcomputer.com fixes.

What do you guys suggest now given that the files McAfee sees as trojans are the first ones needed in the process to get rid of the Control Center virus?

Help!

FSUJohn

McAfee does give me the option to allows the file. After I chose to block it before it popped up a message saying that McAfee had detected and deleted a trojan and that I did not have to take any action. This is why I am weary about allowing the file, since McAfee saw it as a Trojan.

It sounds like you're saying that depsite McAfee seeing it as a trojan file I should trust it anyway. This is why I came here vs. some other random site.

Please clarify if I am understanding your advice correctly and thanks much for the help.

FSUJohn...

It is NOT uncommon for an A/V to detect Rkill (and other similar tools) as malicious. To avoid interference, temporarily disable McAfee before running Rkill. It's why this thread was created. If McAfee Total Protection has an exclusion list, you can also go that route. I would go one step further, and let McAfee know their Total Protection is detecting Rkill erroneously. Hopefully, they'll correct it.

Additionally, you'll note the creator of Rkill states in his introduction to Rkill:

'On a final note, when you download and run RKill, certain anti-virus programs may state that the program is a security risk. This is because some of the tools used by RKill can be used for good or bad, though the programs themselves are perfectly harmless, and most anti-virus programs just lump them into the bad category. I assure you we are using them only for good purposes'

I commend you for being cautious and asking first.

Best of luck..
Carol

'I'm still stuck on the infected computer and I'm at the point where I can get the rkill and the installation file for malwarebytes on a jump drive, but I'm stuck from there.'

Before copying the MBAM installer/mbam-setup.exe (AND the update file ) on to the jump drive, did you rename the installer? If not, you need to. Rename it fsujohn.exe, or the like.

Your first paragraph confuses me. IF you already managed to install MBAM on the infected computer, navigate to C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe and rename the mbam.exe. (It may be necessary to unhide your files and folders, in order to view the mbam.exe.) Once renamed, double-click on the file and see if you're able to run the program.

At one point, you mentioned the mbam.exe was no where to be found. There are certain instances, where the mbam.exe will be missing. If this continues to be the case, let us know, and I'll include a renamed mbam.exe in my next post.

At another point you stated you were unable to completely uninstall MBAM. If THAT'S the case, then try the MBAM Clean Up Utility and start again, as noted above. I don't know what set of instructions you've been following, but they should be similar to this.

Carol

This thing has taken over my computer. Made a few attempts to find it and delete it in harddrive, and it blocked me from access. Can't get past the "Welcome" screen where you have to click on "owner" box. Any tips on how to bypass that would be greatly appreciated. I am fairly computer ignorant, so good instructions would be very helpful. Thanks.

Marianna,
I really appreciate the advice, but my main problem now is that the software won't let me past the Welcome page to get to my desktop to load any software and do anything. When I click on the "owner" box to enter, my desktop flashes briefly and then the virus takes me right back to the Welcome page. Any ideas?

Marianna,

I really appreciate your attempts to help me, but I guess I am going to have to get the Geeek Squad people out here. I am using an extra older computer to connect with you.

My main computer is still locked up by this virus. No matter which safe mode I try, the thing always takes me back to the same Welcome page. Won't let me past that. I downloaded the malware and rkill software but can't load it without getting past the virus. Thanks again for your help.