Hello!

So I have tried to do the cleaning guide throughout but I have had a hard time following through. I've been able to get to the point (Step one: scan for spyware/adware) where I install Malware Bytes anti malware and I am having trouble with the program. I can get it all installed and open the program; however, once I click to start the scan, within 5 seconds the program just completely closes without me pressing anything. When I go to the program on the desktop to reopen it, it says:

"Windows cannot access the specified device, path, or file. You may not have the appropraite permissions to access the item."

After uninstalling and reinstalling a second time, the end result is still the exact same, closing out immediately and remaining unavailable. Does anyone know what the problem could be with this? I am just rather frustrated and confused. Thanks so much!

--Sincerely,
Kristen

Hello and welcome to Geeks to Go! I'm Dave and I'll be helping you out. Let's get started:

Please go to the GMER Rootkit Scanner Download Site.

• Click on the Download EXE button.
• The file you are downloading will have a random name in order to circumvent the attempts of malware to block it from running.
• Take note of the name of the file (please don't change it), and then save it directly to your desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click on the file you downloaded (Vista users please right-click it and select Run as Administrator). The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure that the "Show all" box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity, don't worry.
• Click Ok.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it to a location where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Then:

Please visit this webpage for download links and instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Click on any of the links at that website to download ComboFix. At the window that appears, please change the name of the file from ComboFix.exe to svchost.exe. This name is important and must be exactly as I have given it to you here. Once you have changed the name, save the renamed file directly to your desktop.

Return to the above link and continue with the instructions provided there for running ComboFix. Be sure that you read ALL of the instructions on that page very carefully and follow them exactly. It is particularly important to disable all your protection programs before running ComboFix. If you need further help figuring out how to disable a specific program look here. Installing the recovery console if you're running an XP machine is another critical step. By following the directions in that guide closely, you give ComboFix the best chance at a successful run and minimmize the likelihood of having potentially serious problems occur after an attempted removal of malware.

Once the program has finished running its log should pop up automatically, or if for some reason you lose it it can found at C:\ComboFix.txt. Please post the log's contents in your next reply.

Just need the logs from GMER and ComboFix in your next reply.

Cheers,
Dave

Just checking in since it's been a few days - still need any help on this one?

yes dave I figured it out thank you so much! have a great day!

-kristen

Alright glad to hear you got it worked out good luck!

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.