MBAM shuts down allmost instantley

[malware attack]

umm, ok i have recentley notcied my computer redirects me to sites i am not going to (i.e i type in hello and it redirects me to "buy anti viris softwear")

anyways i downloaded MBAM and updated it, but soon after i ran the scan it closes down and i if i click it again i get "windows cannot access the specified device, path, or file. you may not have the appropriate permissions to access this item."

anyways i figuired it was just dandom so i re downloaded it, and again, and again, untill i went and downloaded avg free, its scan found "virises" but when i clicked delete it closed down the softwear.

anyways im realy frustrated and i dont know what to do because now my computer wont let me download ANYTHING!?!, i click run or save but nothing works, im affraid it will get worse and worse.

anyways i figuired, cuz i have 2 comps, u can tell me what to download and ill exchange it over using a usb or sumthin, maby even email. if you could help me that could be great.

and btw my computer is running vista, i have never had any problems b4, plz help

thx in advance

[malware attack]

ohh and btw, i cannot save things to my desktop so i dont know how to get around this, in all the instructions it says save to desktop, is this realy needed or can som1 write a new step by step for me (remember i have to transfer all files first)

[Maurice Naggar]

Hello,

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not malware attack and have a similar problem, do NOT post here; start your own topic

do this to close the rogue window. Repeat as needed.

Use ALT+F4 keys to close those rogue pop-up windows. Press and hold the ALT key & then press F4 key.

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Given that this is a Vista system, on most all of the following programs and tools, you will need to do a right-click on the program link or shortcut or desktop icon (as appropriate) and then select "Run as Administrator". Please remember that as you go along.

If needed, use My Computer {Windows Explorer} to copy files to the desktop.

Start with this:

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

=

1. Set Vista to show all files and all folders.

• Click the Start button, and then click Computer.
  
• On the Organize menu, click Folder and Search Options.
  
• Click the View tab.
  
• Locate and uncheck Hide file extensions for known file types.
  
• Locate and uncheck Hide protected operating system files (Recommended).
  
• Locate and click Show hidden files and folders.
  
• Click Apply > OK.
  

2. Take out the trash (temporary files & temporary internet files)

Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.

Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:

Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

ATF-Cleaner should be run per the above in every user-login account {User Profile}

=

Download and Save to the DESKTOP Win32kDiag from any of the following locations and save it to your Desktop.

• Download Win32kDiag (Win32kDiag.exe) - #1
  
• Download Win32kDiag (Win32kDiag.exe) - #2
  
• Download Win32kDiag (Win32kDiag.exe) - #3
  

Click on Start button. Select Run, and copy-paste the following command (the bolded text) into the "Open" textbox, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

I do NOT need a log from this.

=

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

Double-click gmer.exe. The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click Yes.
  
• Once the scan is complete, you may receive another notice about rootkit activity.
  
• Click OK.
  
• GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  
• Save it where you can easily find it, such as your desktop.
  

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

• Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  
• Save it where you can easily find it, such as your desktop.
  

Copy all the contents of Gmer.txt and Paste into the body of reply.

[malware attack]

aww, tryed all but as soon as the scanning program finishes, it closes down b4 i can save anything

[malware attack]

aww, tryed all but as soon as the scanning program finishes, it closes down b4 i can save anything

lol i give up i think ima just

uhh save all my good stuff (that i have viris scanned) and re format my computer, nothing is working,

i think my computer ^%&^&%$ itself

[Maurice Naggar]

Wiping and reloading Windows fresh is the safest thing to do in the long term and is also the fastest.

Confirm for me if that is what you have decided on.

[Maurice Naggar]

This topic is closed.

The procedures used here were only for this system. Do NOT use them on any other.

If you are having similar issues, open your own New topic.