Egermeier

I just tried and it's still behaving the same way, but I will survive. I understand the big red target MB.org must have on it's tail. I have a couple of javascript behaviors turned off (Hide status bar, change status bar text and change images). Those shouldn't be at fault. Weird. I'll post a message on the seamonkey board. Thanks for the quick reply. -JME

Guess I was too quick to post. I ran combofix and it cleared the behavior. Just before that I tried to install Avira, it failed to install. Then I tried Avast, failed. I have yet to try the AV programs again, but Malwarebytes is happily running a scan as I type. Perhaps this topic will be useful to others.

I have killed it manually using a boot disk. I was able to rename the dredded winlogon32 and smss32 and a couple of others I found through research. I made a few registry corrections and ran a lesser malware tool that is included on my boot disk. Though I have seemed to correct ALL of the issues except ONE! I can't run malwarebytes for a final cleanup. It will start but only runs for a few seconds. I made a new topic with more detail after not finding anyone with this specific behavior. I have what I needed from this topic and have taken my remaining concern to the new topic.

After fighting with this for a IS2010 for a few hours, I have control of the machine. Policy changes were removed manually (UBCD) and the infection files were renamed (winlogon32 lsass32 warning.html). I fixed the LSP to remove helper32). I was able to run a lesser tool from UBCD (boot disk) and it caught some additional things. Unfortunately, the only problem that has not changed it that Malwarebytes will only stay open for a few seconds (slight variation in time). I can start a scan or an update, but it shortly closes the entire program. If I just open it and wait it will close. I uninstaled the older version that was on the machine bafore the infection. I tried to install the new version (cnet, 1.44?) but had and error (can't remember) that kept it from starting. I then went to remove all folders, but the main program folder contained a file that would not allow deletion. I worked around that and removed all Malwarebytes folders (profile and program files). This time it installed, but still aborts with no message as before. It can't even update. Everything else seems fine. I can access your site, move to the download page, download... but I can't run my final scan with MB. Hijack this looks clean. I can't find any other issues. I took a quick look across the posts, but can't find this particular behavior. HEP! Any ideas? -JME

I seem to have the same one here. MB was installed on thi already, so no install trouble, but this is what has happened so far: -It's still so active in safemode that I can't do much. -Can't open task mgr (profile change, admin won't let you) -Can't run cmd. let's it open and immediately shuts it with alert that cmd is "infected". -CAN run command, but cant run "dir" or "del" without getting "infected" warning. -Malwarebytes opens (renamed) but is shut down shortly with "infected" warning. -Ran boot disk. Deleted entire programfiles/is2010 folder, removed reference found in startups, removed "run" instance in reg. -reboot, still there in full force. This itteration stops me at all I try so far. I love your product, but can't get at it. This is the first time I have seen these fake AVs actually behave like a real AV, but with a devious signature list. .....and no responses yet, must be new?

First, I am a tech. Some of the questions seem targeted to users? Most techs would say, spy/mal-ware comes through a browser's open doors using technologies that make it near impossible to prevent infection from happening. I've been with you since the start. I have used many such programs and individual tools in the past. malwarebytes has the longest running successful reputation so far. AdAware, SpybotSD, Giant, eWidow were all good at their time. I still use SD for a couple of things, but each fell behind. As mentioned previously by others, If you sell out, cash in, etc. They will ruin your work and rep much like ewidow/avg. (they seem more worthless toward spyware each day. I would have had much more trouble doing my job if it werent for MB. I should send you some more money

I just spent 30 minutes trying to get logged in and post a reply elsewhere. the system will seem to let me log in, but upon the return from "you are successfully logged it as ...." it says WELCOME GUEST! I've checked cookie settings, originally session and orig site only, changed to wide open but didn't work. I was able to post a year ago (+2 days!) using the older version of seamonkey (old mozilla suite i.e.Netscape). The new version of seamonkey uses most of Firefox backend stuff. I'm puzzled. I HATE using IE, but here I am..... What is the site requiring to properly HOLD the login? I DID see the "you are now logged in as egermeier" message and when returned I was still guest... ...now back to the malware "rat killing" that seems to have your number ( new 2010).

Follow-up: Success! The newer version (exe) did launch with an alternate name! I'm not sure if changes I made may have caused the change in behavior or if the new version was somehow different. Besides, I think I am in the forum for an old product by mistake

I have a similar situation. I think this one "has your number". I managed to get malwarebytes installed (safe mode), but the program won't launch. I have had to rename the installer before, but this new behavior won't let the -program- launch. After installed I tried to rename the executable... no luck. I then uninstalled and installed to a non-default folder... no luck. I never even saw it "flash" in the task manager. The first poster and I may be the first to mention it in the forums. It must be fresh. I hate being at the front end of an issue... I had hoped to find a solution here. I will update here if I find anything useful as I try to kill it manually. Malwarebytes has been excellent so far, I just hope you can master this latest variant. It really seems to know and defeat our beloved tool. Anyone else?? Did I miss a post that addresses this one? Apologies in advance if I did.