Hello, I am new here and I'm having a little trouble figuring out how to use your site. I hope I am posting in the right place. Sorry if this is a repeated issue. I am trying to follow your malware removal guide. I am on the step that requires installing MBAM. I start the installation process but in middle of it I get a message that an error has occured and it won't finish installing. It won't run the program. I tried to install it on the D drive. There are files there named Malwarbytes etc, but no file named mbam-setup.exe since it says to try and change the name of that specific file name. The reason I started this is because I have been getting messages popping up saying this file and that file is corrutpted. Also my comp is running really slow. I have personal AV on it and I can't get rid of it. {my daughter installed it without asking} I also have some left over norton/symantic stuff I can't get rid of. I have no virus protection, I tried norton but cancelled it because i couldnt install it and now I can't get rid of it. It installed something. Just don't know what! I have windows XP. Hope this is enough information. Thank you so much ahead of time.

This post has been edited by instablue: Oct 20 2009, 07:30 PM

Hello instablue,

Welcome to Geekstogo.

Please download ExeHelper by Raktor

• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Thank you so much for getting back to me. Here is what came up in the notepad.
exeHelper by Raktor
Build 20091021
Run at 12:33:32 on 10/25/09
Now searching...
Checking for numerical processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

Hello instablue,

Let's see if you run this on your machine.

Download Combofix from either of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2





--------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.

Double click on Combo-Fix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for review.

ok I was able to download combofix although it had me download some kind of microsoft tool firs. Then it would begin to run. The message was something like "this process will take apprx 10 minutes unless your comp is severely infected and then it could easily double. So I let it run all night acutually and nothing ever happened. I tried it again this morning. Same thing happened. I never did reboot the computer after the microsoft tool downloaded. So I don't know if that has anything to do with it.

That would be for the Recovery Console. That's a back up situation if we run into trouble.

Have you tried rebooting and running ComboFix again.?

yes, I have. I also have Avast. I turned it off, rebooted and tried it again, but it just says it will take 10 minutes or maybe double that time but then nothing else happens.

Just question here instablue - Did you rename CombFix before you saved it?

Also did you try running Malwarebytes with a different name? For example change the name from MBAM.exe to MBAM.com

yes I renamed combofix and also Malwarbytes.

Okay, let's see if you can run this one then.

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
• This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, select Complete scan.
• Click the green arrow at the right, and the scan will start.
• Click Yes to all if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click File and choose Save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

Hello again. Ok so it let me download drweb. The short scan ran and detected a virus. I moved it. Then I tried to run the complete scan and it froze about a fifth of the way through. So I rebooted and ran the short scan again. Nothing found. Tried to run the complete scan again, but it froze again in the same place. I had to reboot to get anything at all to happen and the a blue screen came up that said it was going to do a disc check if I don't stop it in 10 seconds. So I stopped it and it let me on the net. This blue screen was coming up before, until I started the malware removal process suggested on your site. It quit doing that somewhere along the line. I can't find any kind of log that was created except a partial one that was never completed and it won't let me copy it. So I was wondering also if I should remove the combofix since it didn't work. Thanks again for your time.

One more thing. I keep getting a prompt that my windows firewall is turned off. and I have to go and turn it on manually. This started after I did the drweb scan.

Hello instablue,



Dr Web may have turned it off. In fact it occurrs to me that it may be a firewall that stopped ComboFix and Malwarebytes. Often it is some sort of anti-malware program that gets in the way of our tools.

As we haven't run any scans I haven't been able to see what you have on your machine.

Having said that we will try a different approach in this post.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.

1. rkill.exe
2. rkill.com
3. rkill.scr
4. rkill.pif

After that try running ComboFix again.

ok, i was able to download it, tried to run combofix but the same thing happens. I also tried to run drweb again and windows shut down. A blue screen popped up and said a problem had occured and to prevent damage it shut down. Said it could be a problem with new hardware or software ect. I don't know if this is relevent but it had this message underneath.
Driver-irol-not-less-or-equal. I have a feeling what ever the problem is, it's going to be a real issue. Anyway, thanks again for your time!

That can be be a non malware issue. Maybe a driver problem. Something the techies here are better qualified to help with than me.

I wonder though if there might be a corrupt file there.

Perhaps we could try this one.

Please run System File Checker, to make sure your protected files are not corrupt.

The scan will automatically replace any corrupt files that it finds.

Click Start
Select Run
At the prompt type sfc /scannow Please note that there is a single space between sfc and /scannow.

Typing this will start the program, and a box should appear telling you how much longer the process should take.

Sometimes the scan will prompt you for your Windows XP disc upon starting the scan. if this happens please make sure that you can view protected files:

My Computer
Tools
Folder Options
View
"Uncheck" Hide protected operating system files.

Then rerun the scan.

Once the scan is complete:

Check your Windows Updates! After using the File Protection Service, you might need to reapply some updates.

Please reboot, and let me know if anything has changed.

Also, please rehide the protected files:

My Computer
Tools
Folder Options
View
"Check" Hide protected operating system files.