justjared Posted August 7, 2009 ID:107207 Share Posted August 7, 2009 I am posting here because I have this same issue. I have found that any programs I install to scan for this virus are rendered useless because the virus is resetting the security on the actual .exe for any scanning program I install. The following is a list of software I am using to try and clean my Windows XP media edition PC ( doen in safe mode so I can reset permissions after they are wiped):Mcafee (mcods.exe)Windows DefenderSDFIXComboFixHijackthis.exeMBAMRunning any of these prgrams results in them shutting down almost instantly. If you try to run them again, you get the "file could not be found or you do not have permission" error message. If you look at the permissions tab for any of the associated .exe files you will see that "everyone" has been given full control but "system" "administrators" and any current user accounts have been completely removed or all of the their permissions removed.Another groovy side effect is that I searched for files on the PC that were time stamped at the time I got the infections and sure enough I found a hidden directory in %system%/system32. When I clicked on the directory in the search results window, permissions on explorer.exe were reset and the GUI went black except for the little "safe mode" banner at the top and bottom of the screen.Some Background: This started as the "windows antivirus pro/ Braviax" infection as initially detected by Mcafee (before the virus hosed mcafee) now it's something else... possibly a rootkit that I cannot scan as it detects and wipes any file that attempts to access it.Please help and sorry but I cannot get HJT or MBAM to produce a log. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 30, 2009 Root Admin ID:117119 Share Posted August 30, 2009 I apologize for the long delay however the site has been swamped with too many requests and your post appears to have been overlooked in the rush.If you still require assistance please let us know. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 31, 2009 Root Admin ID:118069 Share Posted August 31, 2009 Since you appear to no longer be monitoring this post we will assume that you've already addressed the issue and no logner require assistance and we will close the post now.If however you do still require assistance please send a private message to open the post again. Link to post Share on other sites More sharing options...
Recommended Posts