MrEPM

Support, I was recently infected with a Malware/SpyWare/Virus with process and program names related to Unisaales and archivecopymonitor. They appear to work together and seem to only affect all browsers. They are not detected by Malwarebytes, Spybot Search and Destroy, or AV software removal tools using the latest definitions. They won't uninstall and the browser addin can be disabled. The source files were generated from an apparent download of a Honda Pilot Service manual. I've attached all the files including the folders on my C drive that are related as they were all created at the same time around 11:50am on Sunday, January 11 2014. Please let me know if you can figure out how to remove using your software. AppData Local cgicompilerProt-BAD unisaales archivecopymonitor.zip ProgramData unisaales archivecopymonitor malware.zip Program Files (x86) unisaales malware1.zip

I removed MBAM and SpyBot as a temporary measure and have not had any problems since. I hope to add the full versions back eventually by adding the correct exclusions between Windows and all Firewall, AV, and Malware programs. Bitdefender is now the registered Firewall and Malware program with Windows also. There were definitely some conflicts with all these running.

Thank you for the initial analysis. I won't rule out a virus or malware completely but I think that is unlikely. I purchased a new hard drive and reinstalled windows (from CD) and MS office from an ISO image. I have run some utilities (Gizmo and ISO Mount) to help determine why my laptop was locking up. I thought the lockups could have been due to a bad driver. Bitdefender has been running since Windows was installed and before any other programs were installed. I've also scanned the disk numerous times with MBAM and Bitdefender with only once getting a few browser cookie items. I've also had to reboot many times after lockup and went into safe mode also several time -- this could be the cause of some MS error events. I think all my drivers are updated including the BIOS. I think the problem relates to having conflicts with to much virus protection. Bitdefender Total Security 2013 AV with real time protection Firewall Internet Protection Malware [*]Malwarebytes Pro with real time protection [*]Spybot Search and Destroy with active protection [*]Windows Firewall Enabled [*]Windows Defender Enabled My previous experience was that MBAM and Spybot worked with AV but I was only using the free versions. I've now disabled Windows Firewall and Defender in place of Bitdefender and uninstalled Spybot and Malwarebytes. I've alwas left the Microsoft items enabled but with only a single purpose AV enabled. The laptop has not locked up for a whole day. I like the Bitdefender UI and it had top ratings for 2013. I also ran a full scan in recovery mode and found no virus. Bitdefender actually boots into a Linux OS to scan in recover mode scan. How can I revert back to MBAM Free from PRO? I reinstalled and it kept the Pro enabled?

The results from all three tests are in the attched files. Please let me know what you find. I also learned that I had Windows Firewall and Bitdefender Firewall enabled, only one is enabled now. The same was true for Windows Defender and Bitdefender Spyware/Malware. Attach.txt CheckResults.txt DDS.txt

Log Name: Application Source: Application Error Date: 1/24/2013 9:44:04 PM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: V1520-KATHIE Description: Faulting application name: mbamservice.exe, version: 1.70.0.0, time stamp: 0x50cb9148 Faulting module name: mbamservice.exe, version: 1.70.0.0, time stamp: 0x50cb9148 Exception code: 0x40000015 Fault offset: 0x0005f6eb Faulting process id: 0x7d4 Faulting application start time: 0x01cdfa95e3595e20 Faulting application path: C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe Faulting module path: C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe Report Id: 14a0b466-6699-11e2-ad54-904ce5fee62d Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-01-25T02:44:04.000000000Z" /> <EventRecordID>2579</EventRecordID> <Channel>Application</Channel> <Computer>V1520-KATHIE</Computer> <Security /> </System> <EventData> <Data>mbamservice.exe</Data> <Data>1.70.0.0</Data> <Data>50cb9148</Data> <Data>mbamservice.exe</Data> <Data>1.70.0.0</Data> <Data>50cb9148</Data> <Data>40000015</Data> <Data>0005f6eb</Data> <Data>7d4</Data> <Data>01cdfa95e3595e20</Data> <Data>C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe</Data> <Data>C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe</Data> <Data>14a0b466-6699-11e2-ad54-904ce5fee62d</Data> </EventData> </Event>