BleepingComputer.com: Infected with QuestScan

I think my Windows Vista Computer is Infected with the Questscan Virus. Cannot run Malwarebytes. It allows me to Install Malwarebytes and update it, but when I start to scan it closes the program and makes the shortcut icon unavailable. Please Help. What do I need to provide to help you diagnosis how to fix it.

(Moderator edit: post moved to more appropriate forum. jgw)

This post has been edited by jgweed: 15 July 2011 - 10:47 AM

Welcome aboard

It must be something more than just QuestScan. QuestScan is merely an adware and it wouldn't prevent MBAM from running.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

See, if you can run MBAM now.

The RKill ran and the Log is attached. But it did not ask me to reboot.
The Malwarebytes does the same thing. It acts as if it is going to run but then the window closes.

RKill Log contents

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 07/15/2011 at 13:43:35.
Operating System: Windows Vista ™ Home Basic


Processes terminated by Rkill or while it was running:

\\.\globalroot\Device\svchost.exe\svchost.exe


Rkill completed on 07/15/2011 at 13:43:37.

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

I tried running the GMER it did the same thing as Malwarebytes. Started to run and then shut down.
I tried doing the RKill first and it has a few new entries in the log. But the GMER would not even run in Safe Mode.
Anything you could do to help would be appreciated.

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 07/17/2011 at 21:02:31.
Operating System: Windows Vista ™ Home Basic


Processes terminated by Rkill or while it was running:

\\.\globalroot\Device\svchost.exe\svchost.exe
C:\Windows\system32\wermgr.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE


Rkill completed on 07/17/2011 at 21:02:34.

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!