mbam.exe cannot found

paul1974 · October 27, 2009

Please, anyone help me!

I was recently hit by a nasty adware and it freezes up my internet explorer, I have AVIRA installed but did'nt help much to protect me.

When I tried to run MBAM it's just simply won't run.

I tried to re-install, renaming and all reccomended solution still wont work.

This is the Hijack this result.

hijackthis_10_26_09.txt

miekiemoes · October 27, 2009

Hi,

To run malwarebytes when you get the error code 2 during install, or mbam.exe gets deleted, please see here:

http://www.malwarebytes.org/forums/index.php?showtopic=29028

Once malwarebytes opens, click the "Update" tab, click "Check for Updates" in order to download the updates.

Then run the scan, let mbam quarantine/delete what it found and reboot afterwards.

After reboot, post the malwarebytes log together with a new HijackThislog.

paul1974 · October 27, 2009

Thanks Mieke for your response.

I did try exactly per detailed instructions, copy and renaming mbam.exe file to Malware folder but still having problem. When I tried to run the program

new window pop-up say's "AN ERROR OCCURED. PLEASE REPORT THE FOLLOWING ERROR CODE TO THE MALWAREBYTES SUPPORT TEAM, ERROR CODE:703 (0,453)"

miekiemoes · October 27, 2009

Was it the same Malwarebytes version you had on the other computer? Because that may explain it.

Anyway, Please download the utility from the following link, and it should reinstall the database so that you can update it through Malwarebytes' Anti-Malware:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe

Let me know if that solved it.

paul1974 · October 27, 2009

It updates using your link:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe

But still having the same error messages

"AN ERROR OCCURED. PLEASE REPORT THE FOLLOWING ERROR CODE TO THE MALWAREBYTES SUPPORT TEAM, ERROR CODE:703 (0,453)"

miekiemoes · October 27, 2009

What version is the renamed mbam.exe?

Please rightclick the file, select properties > version tab and let me know the file version.

Also, on your infected PC, Did you already have malwarebytes installed there? Was it the latest version as well?

paul1974 · October 27, 2009

I reinstalled latest malware program to infected computer and now it's the same version.

Copied and rename MBAM.exe to infected computer

Clean computer is 1.141.0

Infected Computer is 1.141.0

Re-run and and everything works fine now.....Malwarebyte is in complete control now..

Thank you very, very much for your help and patience.

May you have an awesome day!

Paul

miekiemoes · October 27, 2009

Hi Paul,

It would be a great idea to post a new Hijackthislog as well - this to make sure there are no leftovers anymore.

So, start HijackThis, click scan and copy and paste the log in your next reply :blush:

ddepumpo · October 27, 2009

Hello,

Please bear with me, I'm not too savy with this stuff. I'm having the same problem ... "can't find mbam.exe". I went to your link about getting mbam from a different computer. The only computer that I have acess to is my work computer. I can't "install" mbam on it (its a gov computer), but can I somehow just save mbam.exe to a flash drive without installing it?

Also, when you say to "Place the renamed mbam.exe in the Program Files\Malwarebytes' Anti-Malware folder on the infected PC and launch the renamed file.", how exactly to you "place" the renamed mbam.exe in the MBAM folder, and how do you "launch" it? Do I just copy and paste it? I appoligize if I sound a bit clueless here.

Thanks

Dan

miekiemoes · October 27, 2009

Hi Dan,

You are actually posting in someone elses thread which is confusing for Paul (the person who started this thread).

To make it easier for you, I uploaded a renamed copy of mbam.exe here: http://users.telenet.be/bluepatchy/miekiem...mp/explorer.exe

I have renamed it to explorer.exe in this case.

Download that file and place it (cut and paste, or copy and paste) it in your C:\Program Files\Malwarebytes Antimalware folder on the infected pc.

Then doubleclick that file (explorer.exe with mbam icon) in order to start the program / malwarebytes.

If you need further assistance with this one, please start your own thread with it, because it's confusing for me if I have to help different people in one thread

ddepumpo · October 27, 2009

Hi Dan,
You are actually posting in someone elses thread which is confusing for Paul (the person who started this thread).
To make it easier for you, I uploaded a renamed copy of mbam.exe here: http://users.telenet.be/bluepatchy/miekiem...mp/explorer.exe
I have renamed it to explorer.exe in this case.
Download that file and place it (cut and paste, or copy and paste) it in your C:\Program Files\Malwarebytes Antimalware folder on the infected pc.
Then doubleclick that file (explorer.exe with mbam icon) in order to start the program / malwarebytes.
If you need further assistance with this one, please start your own thread with it, because it's confusing for me if I have to help different people in one thread

Thanks. I'll start a new thread.

paul1974 · October 27, 2009

Hi Meike,

This is the Hijackthis result.

Thanks gain.

Best reards,

Paul

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:30:10 AM, on 10/27/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\ezSP_Px.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Sony\HotKey Utility\HKserv.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\system32\ICO.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\PowerPanel\Program\PcfMgr.exe

C:\Program Files\Sony\HotKey Utility\HKWnd.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\iPod\bin\iPodService.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!

O1 - Hosts: ::1 localhost

O1 - Hosts: 91.212.127.226 osguard-pro.microsoft.com

O1 - Hosts: 91.212.127.226 osguard-pro.com

O1 - Hosts: 91.212.127.226 www.osguard-pro.com

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - (no file)

O2 - BHO: (no name) - {ca5770bb-e407-497d-baac-c951865bc9ba} - serozoge.dll (file missing)

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe

O4 - HKLM\..\Run: [urlLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\explorer.exe" /runcleanupscript

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [vajojerob] Rundll32.exe "c:\windows\system32\badufega.dll",a

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: PowerPanel.lnk = ?

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople

O15 - Trusted Zone: *.intuit.com

O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - http://esupport.sony.com/VaioInfo.CAB

O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_ind.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O20 - AppInit_DLLs: nizefipu.dll c:\windows\system32\badufega.dll

O21 - SSODL: sefowihog - {66a6bae6-c841-4ec5-b4fc-34aa5acacb75} - c:\windows\system32\badufega.dll

O22 - SharedTaskScheduler: mujuzedij - {66a6bae6-c841-4ec5-b4fc-34aa5acacb75} - c:\windows\system32\badufega.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe

O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

--

End of file - 7391 bytes

miekiemoes · October 27, 2009

Hi,

Some malware is still up and running here...

First of all, * Download: HostsXpert

Unzip hoster to an own folder, eg C:\HostsXpert

Start HostsExpert.exe, click 'Restore MS Hosts file' and click OK.

Then, please update MalwareBytes, because there were two new updates in between to deal with this variant...

Start MalwareBytes and click the Update tab. There click "Check for updates"
Once the updates are downloaded, perform a quick scan again.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply along with a fresh HijackThis log, then we'll proceed from there with new steps.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

ddepumpo · October 27, 2009

Hi Dan,
You are actually posting in someone elses thread which is confusing for Paul (the person who started this thread).
To make it easier for you, I uploaded a renamed copy of mbam.exe here: http://users.telenet.be/bluepatchy/miekiem...mp/explorer.exe
I have renamed it to explorer.exe in this case.
Download that file and place it (cut and paste, or copy and paste) it in your C:\Program Files\Malwarebytes Antimalware folder on the infected pc.
Then doubleclick that file (explorer.exe with mbam icon) in order to start the program / malwarebytes.
If you need further assistance with this one, please start your own thread with it, because it's confusing for me if I have to help different people in one thread

Miekiemoes, Sorry to butt in again. I started a new thread "can't find MBAM.exe" by ddepumpo. Is there any chance you could reply to that since you seem to have a pretty good handle on this. (I'm not sure how this forum works.) Thanks. Dan

miekiemoes · October 27, 2009

Hi Dan,

I replied in your own thread now: http://www.malwarebytes.org/forums/index.php?showtopic=29121

paul1974 · October 27, 2009

Hi Mieke,

This is the last run of MBAM and HijackThis after running HosXperts per your recommendations.

I run MBAM three times already and still showing some infected everytime I reboot and run MBAM again.

regards,

Paul

Malwarebytes' Anti-Malware 1.41

Database version: 3042

Windows 5.1.2600 Service Pack 3

10/27/2009 11:02:34 AM

mbam-log-2009-10-27 (11-02-33).txt

Scan type: Quick Scan

Objects scanned: 114403

Time elapsed: 29 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 4

Registry Keys Infected: 1

Registry Values Infected: 3

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\system32\mesekaho.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\nizefipu.dll (Trojan.Vundo) -> Delete on reboot.

c:\WINDOWS\system32\badufega.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\muwumadu.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{e835eb53-54fd-438e-8c57-eabe4acc1f0d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vajojerob (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{e835eb53-54fd-438e-8c57-eabe4acc1f0d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mavehubuj (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\mesekaho.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\mesekaho.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\mesekaho.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\nizefipu.dll (Trojan.Vundo) -> Delete on reboot.

c:\WINDOWS\system32\badufega.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\muwumadu.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\wapozevo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pekugedi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:10:12 AM, on 10/27/2009