Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MBAM, Superantispyware Pro, and system restore have all been disabled, please can you help?


  • This topic is locked This topic is locked
17 replies to this topic

#1 Lifetimer

Lifetimer

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 23 July 2009 - 04:53 PM

Hello, I have the paid SaS and the free Mbam. I got a malware, and it did trigger my live protection alert, but it mustve been carpetbombing it because it just kept giving more and more alerts until everything crashed.

After a reboot, I started the Mbam scan, and it terminated shortly after starting, now it says windows cannot access the program. Sas runs a scan every night, but I ran a manual one, and shortly after it started, it terminated and now gives the same "windows cannot access" error. I tried a full system restore, and it comes back System Restore Incomplete. I uninstalled and reinstalled bothMbam and SAS, and tried them in safe mode, with the same result. I thought maybe my Comcast McAfee was interrupting the system restore, so I tried deactivating it (same system restore Incomplete message) then uninstalling it (still system restore Incomplete)

I assume this means all of my restore points are corrupted. In addition, my google and other search engines are now being redirected to shopping sites.

Can one of you magicians please help me to clean up this mess? Thanks in advance :-(

BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:08:44 AM

Posted 23 July 2009 - 09:08 PM

Right-click on the Task Bar and open Task Manager
In the Applications window, end all running tasks
Start a new task and type explorer.exe
This should bring up the Desktop and you should be able to run some scans

Please download and run Process Explorer

http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspx

Under file and save as, create a log and post here

copy and paste into a reply
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 23 July 2009 - 09:55 PM

Hi, thanks, here's the log of procexp


Process PID CPU Description Company Name
System Idle Process 0 97.76
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 908 Windows NT Session Manager Microsoft Corporation
csrss.exe 976 Client Server Runtime Process Microsoft Corporation
winlogon.exe 1000 Windows NT Logon Application Microsoft Corporation
services.exe 1048 2.24 Services and Controller app Microsoft Corporation
svchost.exe 1240 Generic Host Process for Win32 Services Microsoft Corporation
MDM.EXE 788 Machine Debug Manager Microsoft Corporation
ehmsas.exe 3536 Media Center Media Status Aggregator Service Microsoft Corporation
hpqbam08.exe 4008 HP CUE Alert Popup Window Objects Hewlett-Packard Co.
hpqgpc01.exe 4044 GPCore COM object Hewlett-Packard
hpswp_clipbook.exe 2868 HP Smart Web Printing add-on for Internet Explorer Hewlett-Packard Co.
svchost.exe 1304 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1428 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1516 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1676 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1864 Spooler SubSystem App Microsoft Corporation
arservice.exe 1468 ARSVC Application Microsoft
ehrecvr.exe 1524 Media Center Receiver Service Microsoft Corporation
ehSched.exe 1536 Media Center Scheduler Service Microsoft Corporation
svchost.exe 1572 Generic Host Process for Win32 Services Microsoft Corporation
LSSrvc.exe 1696 Hewlett-Packard Company
MediaMallServer.exe 1832 PlayOn Server MediaMall Technologies, Inc.
MSCamS32.exe 312 MsCamSvc.exe Microsoft Corporation
svchost.exe 336 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 380 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 904 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 948 Generic Host Process for Win32 Services Microsoft Corporation
ULCDRSvr.exe 268 ULCDRSvr Ulead Systems, Inc.
mcrdsvc.exe 1972 MCRD Device Service Microsoft Corporation
dllhost.exe 2280 COM Surrogate Microsoft Corporation
alg.exe 2632 Application Layer Gateway Service Microsoft Corporation
svchost.exe 3736 Generic Host Process for Win32 Services Microsoft Corporation
lsass.exe 1060 LSA Shell (Export Version) Microsoft Corporation
explorer.exe 124 Windows Explorer Microsoft Corporation
ehtray.exe 360 Media Center Tray Applet Microsoft Corporation
DMAScheduler.exe 396 DMAScheduler Sonic Solutions
RTHDCPL.EXE 424 Realtek HD Audio Control Panel Realtek Semiconductor Corp.
vVX3000.exe 452 Microsoft LifeCam Device Application Microsoft Corporation
GoogleToolbarNotifier.exe 488 GoogleToolbarNotifier Google Inc.
hpqtra08.exe 596 HP Digital Imaging Monitor Hewlett-Packard Co.
hpqste08.exe 3980 HP CUE Status Root Hewlett-Packard Co.
OLFSNT40.EXE 644 Symantec Fax Starter Edition Port Launcher Microsoft Corporation
iexplore.exe 2532 Internet Explorer Microsoft Corporation
WinRAR.exe 3252 WinRAR archiver Alexander Roshal
procexp.exe 3296 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
Ymsgr_tray.exe 1064 Yahoo! Messenger Tray Yahoo! Inc.
svchost.exe 3856 Generic Host Process for Win32 Services Microsoft Corporation
kbd.exe 2668 KBD EXE Hewlett-Packard Company
hpsysdrv.exe 3152 hpsysdrv Hewlett-Packard Company
jusched.exe 3168 Java™ 2 Platform Standard Edition binary Sun Microsystems, Inc.

#4 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 24 July 2009 - 10:37 AM

Hi, got no response yet so I've been using bleepingcomputer guides to try and at least provide more info

Rootrepeal shows noting as far as I can tell?
---------------------------------------
Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\netlogon.dll
Status: Locked to the Windows API!
------------------------------------------


My situation is currently:

Mbam prepares to scan then aborts and becomes unusable
SaS Mbam prepares to scan then aborts and becomes unusable

(I've tried renaming both Mbam and SAS, it just disables the renamed file)

My MacAfee Virusscan doesnt work
search engines redirect to shopping
System restore always reboots saying restore incomplete


I'd love to just do a system restore. I suspect its too late for that but if anyone has any advice on how to proceed, thanks in advance!

Edited by Lifetimer, 24 July 2009 - 10:42 AM.


#5 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 25 July 2009 - 10:44 AM

Garmanma seems to be gone...Can anyone else help? :thumbsup:

#6 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 25 July 2009 - 03:50 PM

Hi, my symptoms are as follows:

Google and others being redirected to shopping sites
Malware/antivirus programs disabled


here are the things I have attempted so far

I ran ATF Cleaner successfully first

MBAM begins its scan, then shuts down and is thereafter unusable with the message "Windows cannot access the specified path"
SuperAntiSpywarePro begins its scan, then shuts down and is thereafter unusable with the message "Windows cannot access the specified path"

I tried renaming the exe files and directories, same thing happened

McAfee Antivirus is disabled, with the message "Error starting on-demand scanner"

DrWeb scanned in safe mode for about 2 hours, then locked up


RootRepeal gave me the following report:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/07/25 16:46
Program Version: Version 1.3.2.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\netlogon.dll
Status: Locked to the Windows API!

Path: c:\windows\temp\mcafee_ytr4ayzuqk1mome
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: c:\windows\temp\mcmsc_fl548l8cs17qrmh
Status: Allocation size mismatch (API: 4096, Raw: 0)




Can anyone suggest anything else? I'm at my wit's end here!

#7 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:08:44 AM

Posted 25 July 2009 - 08:02 PM

I'm sorry I missed you yesterday. not sure how I passed over you


Some types of malware will disable Malwarebytes Anti-Malware and other security tools. If MBAM will not install, try renaming it first.
  • Right-click on the mbam-setup.exe file file and rename it to mysetup.exe.
  • Double-click on mysetup.exe to start the installation.
  • If that did not work, then try renaming and changing the file extension. <- click this link if you do not see the file extension
  • Right-click on the mbam-setup.exe file, rename it to mysetup and change the .exe extension to .scr, .com, .pif, or .bat.
  • Then double-click on mysetup.scr (or whatever extension you renamed it) to begin installation.
If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files.
  • Right-click on mbam.exe, rename it to myscan.exe.
  • Double-click on myscan.exe to launch the program.
  • If that did not work, then try renaming and change the .exe extension in the same way as noted above.
  • Double-click on myscan.scr (or whatever extension you renamed it) to launch the program.
If using Windows Vista, refer to How to Change a File Extension in Windows Vista.

Be sure to update MBAM through the program's interface (preferable method) or manually download the definition updates and just double-click on mbam-rules.exe to install. Then perform a Quick Scan in normal mode and check all items found for removal. Don't forgot to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the report in your next reply.

Note: MBAM uses Inno Setup instead of the Windows Installer Service to install the program. If installation fails in normal mode, try installing in safe mode. Doing this is usually not advised as MBAM is designed to be at full power when running in normal mode and loses some effectiveness for detection & removal when used in safe mode. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Therefore, after completing a scan it is recommended to uninstall MBAM, then reinstall it in normal mode and perform another Quick Scan.
-------------------------------


If SUPERAntiSpyware will not run when your PC starts or when you double-click the program shortcut, you may have a class of infection that specifically targets SUPERAntiSpyware and prevents it from running.
USE this link.

http://downloads.superantispyware.com/downloads/SAS_FREE.EXE
---------------------------------

I sent you a PM
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#8 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 25 July 2009 - 08:55 PM

Hi!

Well, my problem isnt that Mbam or SaS don't install and run, they install and start up just fine. However, when I try to do a scan they simply disappear, then they become unusable. I've tried removing and reinstalling them a bunch of times with the same result.


here are the things I have attempted so far

I ran ATF Cleaner successfully first

MBAM installs fine, updates, and begins preparing for its scan, then when the scan starts it shuts down and is thereafter unusable with the message "Windows cannot access the specified path"
SuperAntiSpywarePro installs fine, updates, and begins its scan, then blanks and shuts down and is thereafter unusable with the message "Windows cannot access the specified path"

I tried renaming the exe files and directories, same thing happened

I tried the renaming tool you gave me, same result

McAfee Antivirus is disabled, with the message "Error starting on-demand scanner" when I try to scan

DrWeb scanned in safe mode for about 2 hours, then locked up



RootRepeal gave me the following report:

ROOTREPEAL AD, 2007-2009
==================================================
Scan Start Time: 2009/07/25 16:46
Program Version: Version 1.3.2.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\netlogon.dll
Status: Locked to the Windows API!

Path: c:\windows\temp\mcafee_ytr4ayzuqk1mome
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: c:\windows\temp\mcmsc_fl548l8cs17qrmh
Status: Allocation size mismatch (API: 4096, Raw: 0)



any ideas on other programs or procedures I could try? I'd hate to have to reformat. Thanks again in advance!

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,488 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:44 AM

Posted 25 July 2009 - 09:09 PM

Hi...
Hello let's try Fatdcuk's fix.

Please navigate to the MBAM folder located in the Program Files directory.

Locate MBAM.exe and rename it to winlogon.exe

Once renamed double click on the file to open MBAM and select Quick Scan

At the end of the scan click Remove Selected and then reboot.


Post the scan log. The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.



reRun RootRepeal
Click Settings - Options
Set the Disk Access Level slider in the general tab to High

Try scanning now with the settings as described above.


{EDIT,, I have merged the two topics,, I have replied to the second before I realized you were already being helped here.. I will leave the posts in case the info is helpful.
Starting 2 topics, about the same problem, is called double posting, and is not allowed on this board.
Please keep all of your replies in this one topic.
The members helping you, will be looking for your responses to their questions, in the topic they replied to.
Posting it elsewhere, will cause a delay in the help you receive, and neither one of us, wants that. smile.gif
When you start several topics, for the same problem, it becomes very confusing to follow, for all of those involved.~~boopme}

Edited by boopme, 25 July 2009 - 09:29 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 25 July 2009 - 11:05 PM

Hi boop, yeah I wasnt trying to annoy but I only started the next one after I didnt hear back from garman for a couple days. Thanks for merging though.

I reset the slider on rootrepeal to high and got back the same report

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/07/25 23:59
Program Version: Version 1.3.2.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\netlogon.dll
Status: Locked to the Windows API!


Per your post I also tried the Fatdcuk fix, to no avail. Mbam still installs, updates, starts scanning, then poof it crashes.

yeesh this thing is really worrying me, is it going to steal my info?

:-(

#11 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 25 July 2009 - 11:32 PM

and as an update, I just tried Spybot S&D and Spyware Dr. it disabled both of them.

unbelievable

#12 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:08:44 AM

Posted 26 July 2009 - 04:00 PM

NOTE: If you get a blue screen type crash or any other crash of SUPERAntiSpyware when trying to run the scan then after a reboot, configure the below options and rescan

* Run SuperAntiSpyware
o In SUPERAntiSpyware under Configuration and Preferences, click the Preferences button.
o Click the Scanning Control tab.
o Under Scanner Options uncheck the below two options
+ Use Kernel Direct File Access (recommended)
+ Use Kernel Direct Registry Access (recommended) o Then try doing a new Complete scan.
---------------------------------------


You may have a class of infection that specifically targets SUPERAntiSpyware and prevents it from running.
USE this link.

http://downloads.superantispyware.com/downloads/SAS_FREE.EXE
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#13 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 26 July 2009 - 07:50 PM

Hi Garman! Your suggestion worked! It actually completed a full scan, I'm tacking on the log it gave me, then I'm going to reboot and see how it did at removal. I'll run it through again too, and post another log.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/26/2009 at 08:08 PM

Application Version : 4.26.1006

Core Rules Database Version : 4020
Trace Rules Database Version: 1960

Scan type : Complete Scan
Total Scan Time : 00:36:24

Memory items scanned : 624
Memory threats detected : 0
Registry items scanned : 6675
Registry threats detected : 0
File items scanned : 22717
File threats detected : 50

Adware.Tracking Cookie
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@apmebf[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@realmedia[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@interclick[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@casalemedia[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@bridge1.admarketplace[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@media6degrees[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@kontera[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ads.pointroll[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@insightexpressai[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@fastclick[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@yadro[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@atdmt[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@revsci[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@media.legacy[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@statse.webtrendslive[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@oneclickresolution[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@trafficmp[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@specificclick[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ads.bleepingcomputer[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@adrevolver[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@bidsystem.adknowledge[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ad1.clickhype[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@oasc10.247realmedia[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@chitika[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@oasc09.247realmedia[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@pgcom.adbureau[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@admarketplace[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@imrworldwide[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@mediacollege[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@mediaplex[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@dmtracker[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@waterfrontmedia.112.2o7[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ads.cnn[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@tribalfusion[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@media.adrevolver[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ad.yieldmanager[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@overture[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@cracked[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@zedo[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@tracking.foxnews[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@invitemedia[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@advertising[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@media.adrevolver[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@doubleclick[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@collective-media[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ads.undertone[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@adbrite[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ad.wsod[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@specificmedia[1].txt

Adware.Vundo Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{106CF321-99A3-4E3A-9103-1BD027606A99}\RP49\A0009620.DLL

#14 Lifetimer

Lifetimer
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:44 AM

Posted 26 July 2009 - 08:53 PM

well, here's an update, its not good...SaS was disabled on reboot. I reinstalled it and ran it again the same way, it only picked up some adware cookies and deleted them. But MBaM is still being disabled, and my search engines are still being redirected.

Any thoughts on a next step?

#15 Little_Buster

Little_Buster

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:U.S. of A
  • Local time:08:44 AM

Posted 26 July 2009 - 08:56 PM

I had the same problems, Repair installing windows helped abit, I was able to run programs but the malware was still there




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users