Jump to content

Recommended Posts

Hi there

I have just registered on this forum hoping to find a solution to an annoying problem.

When running a scan, mbam finds an extension.mismatch threat. I managed to delete is successfully but started experiencing annoying problems after rebooting. I get an error message saying the specific program (ccleaner, opera, windows live mail...at random) is an illegal installation copy and the error refers to ntshrui.dll located in the system32 folder.

The only way I managed to get rid off the error messages was by restoring a system image I made a month ago. Unfortunately, the trojan (which I suspect it to be) is already in that system image. I no longer get the error message since I haven't allowed mbam to delete it yet. Still, it is not a solution and I would love to get rid off it without having to perform a clean installation.

I have created a log file (it's in Dutch since I live in Belgium). I have translated to reference if that helps.


Databaseversie: v2012.04.23.01

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Filip :: METHOS [administrator]

Realtime bescherming: Ingeschakeld

23/04/2012 13:36:08

mbam-log-2012-04-23 (13-51-19).txt

Scantype: Volledige scan

Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

Uitgeschakelde scanopties: P2P

Objecten gescand: 46886

Verstreken tijd: 2 minuut/minuten, 43 seconde(n) [beëindigd]

Geheugenprocessen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerdata gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Files detected: 1

c:\dell\drivers\r140135\3100_216\win64\rightarrow.gif (Extension.Mismatch) -> No action taken.


When going to that specific location, I don't see rightarrow.gif at all (it's also not a hidden file)

Any kind of help would be very much appreciated.


Link to post
Share on other sites

Hello and welcome to MBAM, Methos:

Sorry to hear you are infected.

We cannot review scan logs or deal with malware-related issues in this particular sub-section of the forums.

So please read below for assistance with cleaning your system.

IMPORTANT: Please do NOT use any temporary file cleaners unless instructed to do so - they can cause data loss, making it hard to recover your system.


OPTION 1: Free, one-on-one, expert assistance in the Malware Removal Forum.

OPTION 2: For paid users of MBAM PRO, free, one-on-one, expert assistance from MBAM support.

OPTION 3: Fee-based, one-on-one, expert assistance from Premium Support.


  • Please print out, read and carefully follow the instructions in the "I'm Infected - What Do I Do Now?" article.
  • If the infection has so crippled the computer that you cannot complete some or all of the steps, then just do the best you can and start a new topic as described below.

  • Then please start a new post in the Malware Removal Forum.
  • When starting your new post, please note the following:
  • Please do NOT post in a topic started by someone else, even if their problem sounds similar.
  • Please COPY/PASTE the requested logs into your post, rather than attaching them.
  • Under options, please be sure to select "track this topic" and "immediate email notification", so you'll know when a helper responds.

  • Please be patient - it may be 48 hours or more before a helper can assist you, especially when the forum is very busy.
  • Please do NOT "bump" your topic or reply back to it for at least 48 hours.
  • Doing so may cause your topic to be overlooked, as it will appear that you are already being helped.


If you are a paid user of MBAM PRO and would like support via the helpdesk, please contact them here.


If you prefer the Malwarebytes Premium Services (comprehensive solutions to all your computer support needs – from installation and set-up to troubleshooting and tune-ups), please go to our Premium Support site here.

Please be patient – someone will assist you as soon as possible.

Thank you very much,


PS Please use the "Reply to this Topic" or "More Reply Options" buttons (instead of the “Quote” and “MultiQuote” buttons) when replying here & at the other forums. That will make your topic easier to follow. :)

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.