Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

"The requested resource is in use" when trying to run antivirus, winvmx client


  • This topic is locked This topic is locked
13 replies to this topic

#1 brendyman

brendyman

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:02 PM

Posted 12 May 2017 - 11:20 PM

I'm having this issue: every time I try to run an anti-virus or anti-malware software, I get an error that reads "The requested resource is in use." Around the same time this issue started happening, task manager shows 3 instances of "winvmx client" running (after a Google search, I learned this isn't friendly software either).

 

It looks like the only way to beat this clever virus is with the help of the members of this forum, so I'd like to ask for your help. 

 

What do I need to do to get started?

 

Thanks,

 

Brendan



BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 13 May 2017 - 12:07 AM

Hi brendyman :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.
  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens;
  • As long as I'm assisting you on BleepingComputer, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you;
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system;
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!;
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced;
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against BleepingComputer's rules;
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process;
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread;
This being said, it's time to clean-up some malware, so let's get started, shall we? :)

Follow the instructions in the thread below. Make sure to download the MBAR linked in it. Let me know if you're not able to launch it and run a scan.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

If you manage to run a scan, delete everything it finds, and then copy/paste the content of the "mbar-log-TODAY'S-DATE.txt" log that is located in the MBAR folder here after.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 brendyman

brendyman
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:02 PM

Posted 13 May 2017 - 01:17 AM

I tried to follow the directions in the thread you linked, but I get the same error: "The requested resource is in use." Any ideas?



#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 13 May 2017 - 08:52 AM

If you execute the mbar.cmd file in the MBAR folder, does it works?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#5 brendyman

brendyman
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:02 PM

Posted 14 May 2017 - 02:20 PM

Well, it was working but MBAR kept hanging during the scanning process (after detecting 3000+ instances of malware -- wow!). I tried to run it in safe mode, but it wouldn't even start in safe mode. So I turned off safe mode, but now I've encountered a bug that makes the login screen blank on Windows 10 after using safe mode, which has effectively locked me out of my computer. Any ideas on how to get past this one without wiping my computer and setting up an clean installation?



#6 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 14 May 2017 - 02:24 PM

Are you able to go back in Safe Mode normally?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#7 brendyman

brendyman
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:02 PM

Posted 14 May 2017 - 02:31 PM

Nope. Microsoft made it way harder to get into safe mode in Windows 10. The only way to do that is by changing a setting that can only be accessed AFTER logging in...which I cannot do. I've also seen talk of a method to get into safe mode by shift+clicking on the restart button on the blank login screen -- that didn't work. I've also seen other people say you can get into safe mode by restarting your computer from the login screen three times -- no luck there either. I'm seriously just locked out of my computer.



#8 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 14 May 2017 - 02:37 PM

Do you have your Windows installation media?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#9 brendyman

brendyman
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:02 PM

Posted 14 May 2017 - 09:44 PM

Update: I'm working on creating a bootable Windows 10 USB drive. My only other computer that I have access to is a Macbook, so it hasn't been as easy as it would be on a PC. 

 

 

In the meantime -- after leaving my computer powered on at the login screen for an extended period of time (a few hours or longer), when attempting to login, my login name is shown on the screen but without a password entry field. I waited a while longer, and eventually the password field showed up, and I was able to log in. Logging in took a long time (+5 minutes), which is really unusual for my computer (usually, it's lightning fast). After finally logging in, I tried to open MBAR, explorer.exe crashed, and I had no choice but to hard reboot my computer. Anyway, I'm starting to suspect that this locked-out-of-login-screen fiasco may be the work of another extra-crafty piece of malware, and not a bug as I'd initially thought. Could be wrong, though. I'm no expert.

 

What should I do once I've got my Windows 10 USB at the ready?


Edited by brendyman, 14 May 2017 - 09:45 PM.


#10 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 16 May 2017 - 06:55 AM

Sorry for the late reply. The Windows 10 installation media should allow you to re-enter Safe Mode. When you boot from it, you can choose "Repair your computer" after entering the language preferences. From there, you'll access the Recovery PE and you can select to get in Safe Mode from there.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#11 brendyman

brendyman
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:02 PM

Posted 16 May 2017 - 08:22 PM

There is no "Repair your computer" option. I see the following when I boot from installation media:

 

-System Restore

-System Image Recovery

-Startup Repair

-Command Prompt

-UEFI Firmware Settings

-Go back to the previous version.

 

None of these lead to safe mode.

 

Also, there's a dialog box that shows up right after booting from install media that says "It looks like you started an upgrade and booted from installation media. If you want to continue with the upgrade, remove the media from your PC and click Yes. If you want to perform a clean installation instead, click No." Clicking Yes just restarts the computer. Clicking no brings me to the screen I mentioned in the first part of this post.



#12 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 18 May 2017 - 07:43 AM

Sorry, I somehow keep forgetting your thread. It'll be easier for us to work from the Recovery PE in your case.

On a clean machine, please download FRST and save it to your flash drive (you can save it on the one you have the Windows 10 installation files on. From there, go back in the "Repair your computer" mode (Recovery PE), and open the Command Prompt by clicking on its option.

Once in the Command Prompt:
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#13 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 21 May 2017 - 11:54 AM

Hi brendyman,

Are you still with me?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#14 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:02 AM

Posted 23 May 2017 - 11:10 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users