PaulAllen

@Ried Here is a FRST and picture when it has turned off for no reason. The computer has been on all day and about 18.00ish it just turned off. Hope this is of help Thanks FRST.txt Addition.txt

No it is still there and will not budge I even tried mbam file assassin on individual files and again no joy still nothing lol it just refuses to go. Thank you for the suggestion though much appreciated

Happy new year to you to

I have tried to set full permissions on the folder but still it wont go I will try in safe mode thank you.

Wow thanks for the info Dave I didn't expect you to go to so much trouble but am very much appreciative as I love to learn about all this type of stuff. Thanks for the info

Found my old VHS tape of Pi so been watching it again its still a good movie

I was just wondering whats to stop something nasty being backed up alongside everything else. I was covering all malware being backed up by mistake is there something that stops this happening? I'm just curious that's all. It was a broad spectrum question I'm not good at technical jargon as you can tell. Thanks Dave

It was running when I did the scan it turns off randomly now and again for no reason and I have to reboot to get it to come back on. Next time it turns off it I will do another frst scan and take a screen shot

I ran mbar the other day and the folder now wont delete. I'm using windows 10 with admin account. It says permission denied

Whats to stop malware spreading to an external drive when your doing a back up? ie if your back up includes malware?

Heres the mbam log and the 2 FRST logs hope they are helpful Note I haven't activated the copy of mbam yet. Thank you Ried Addition.txt FRST.txt MBAMSERVICE.LOG

Hello I thought at first maybe it was something I did as web protection keeps turning off and will not come back on till I restart the machine it has done this 3 times now for no reason. I don't think I have any malware as I have checked recently.

@ Aura oh I thought the new 3.0 they said it can now replace your antivirus? did I miss read that the wrong way? @Telos yes I have looked at windows firewall advanced menu and set rules manually but it takes forever lol and I'm pretty lazy.

It's OK it's been solved I took the pc to bits and cleaned it and put it back together and that has solved the problem.

Hello Aura About the firewall thing that if you had an option to enhance windows firewall it would be nice you get that option with some AV's to make windows firewall better well enhance the rule set. I think it would still be nicer to have a bigger more defined button with update written on it.

I think over all its great. 3 things I think would help it the first being on the dash board screen next to the scan now button would be an update button I know you can click current and it updates or have them auto. I'm sure I can't be alone in liking to manually update all my av's and stuff on home pc.'s. The second it would be great if when first loading mbam it had an option to enhance windows firewall. The 3rd a dash board you can sign into with all your mbam products on it so you can sort your own problems when mbam says to many instillation on this cd you can look see what it is installed on and de-uninstall it from these items this would also save support from my emails lol. Thanks mbam overall it's very good and hope you all at mbam have a great christmas. Thanks for all your help

Here are the FRST text documents FRST.txt Addition.txt

UPDATE Ok I downloaded MBAR while i waited and got these 6 Registry Keys Detected: 6 HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.exe (Trojan.Agent) -> Delete on reboot. [f14c0b32bdbfb4824a8305efce35bc44] HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MsMpEng.exe (Security.Hijack) -> Delete on reboot. [b885211c3c4079bda541629210f3dd23] HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\svchost.exe (Security.Hijack) -> Delete on reboot. [2d10ae8f8eeeb77f9571e3142fd421df] HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.exe (Trojan.Agent) -> Delete on reboot. [93aaf647aece9a9cdfee985cd62d946c] HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MsMpEng.exe (Security.Hijack) -> Delete on reboot. [41fc9aa3740890a63da9bc38a45fcb35] HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\svchost.exe (Security.Hijack) -> Delete on reboot. [fd407ac36c1078bea561718632d1bd43]

Below is a post i did in another forum relating to my problem the helper there said it may be malware so I thought I'd come here and get checked out by experts before doing anything else. Thank you Paul "Hello I have a boot problem at first i thought it was the old drive going so I replaced the drive reinstalled the os and everything worked ok that day. Nest day went to boot new drive and exactly the same as the old drive happened File:\Boot\BCD The boot configuration data for your pc is missing or corrupt. Here is what I have tried so far. Use instillation disk went into the part at the start with cmd prompt and typed bootrec /fixmbr bootrec /fixboot attrib -r -s -h c\:boot\bcd del c:\boot\bcd bcdboot c:\windows bootrec /rebuildbcd None of this works. I can get into the operating system and once in it's ok and the even weirder thing once it is open it will reboot just fine shutdown and then turn back on just fine but leave it over night off and the next day it's got problems. It couldn't be the cmos could it?"

Don't forget to dress up to hide your identity lol and clean up after your done so know one knows you have been there.

Thank you for the reply much appreciated.

Thank you. I just joined bleeping computer. Good to know

I was having a go with rkill and it shows this is it anything bad or just because I'm running it in windows 10? They seem legit files just incorrect image path and service dll. I googled it but came up blank apart from what the file is, nothing showed why the wrong path/service. Thank you for any help provided * AJRouter => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted [Incorrect ImagePath] * WpnService => %systemroot%\system32\svchost.exe -k netsvcs [Incorrect ImagePath] * vmicrdv => %SystemRoot%\System32\icsvcext.dll [Incorrect ServiceDLL] * vmicvss => %SystemRoot%\System32\icsvcext.dll [Incorrect ServiceDLL]

Hello If I have a single computer and the drive is partitioned half is windows 7 and the other windows 10 is each operating system on that drive classed as a single computer or 2 for a copy of malwarebytes antimalware. Thank you

Got given this on dvd it's a very interesting and compelling argument that he did escape very interesting indeed It's got me thinking 99% for sure he got away. Reading the book to atm absolutely fascinating.