pum.hijack.startmenu help please

[areske86]

hi.. malwarebytes keeps removing pum.hijack.startmenu... i scan in safe mode and doesnt find it i scan regular and keeps finding it.. i am far from an expert with computers and would greatly appreciate any help i can get.. please thank you

[Maurice Naggar]

Hello areske86,

Let me suggest, if you're an MBAM customer, you contact the help desk at support@malwarebytes.org

Alternatively, Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Follow this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Please post there the contents of MBAM scan log & the DDS logs

Don't post your logs here.

[abcd1234]

I was at work today and someone had clicked on a download button that is obviously a malware download. After doing some searching on google, I found that many people have this problem with pum.hijack.startmenu....I took some advice and ended up doing the following:

1. Went into safe mode as admin

2. Ran a program called RKill. http://www.bleepingcomputer.com/forums/topic308364.html

3. Tried to do a system restore. The system restore refused to execute, mainly because pum.hijack.startmenu hides a lot of important windows files.

4. Ran a program called Unhide. http://www.bleepingcomputer.com/forums/topic405109.html

5. Tried to do a system restore. This time it worked.

6. Jumped up and down

7. Logged into windows and turned off system restore, then restarted computer.

8. Logged into windows and turned on system restore. Created a Restore point

This worked for me, hopefully it might work for you.

[Maurice Naggar]

No. no. no.

The system is likely still infected.

Rkill & unhide do not remove infections off your hard drive.  rkill only stops known rogues temporarily that are in memory but NOT off the hard drive. Unhide does not remove malwares.

And using system restore is not a cure either. Malwares have many more places to hide in areas that system restore does NOT cover.

If this is a corporate system as I suspect it is, a) you should report to the ownership and the Tech support/help desk immediately, and b) this system should be disconnect from the network.

Bottom line: If there is an infection that your antivirus & antimalware does not handle, do not self-medicate / self-diagnose if you are not trained in malware removal.

I would suggest you contact Consumer Support and/or Corporate Support for assistance.