Scanning E:\ Drive?

[DOB]

Hi, after using Malwarebytes free scanner to remove Malware from my computer during the last few weeks, I decided to purchase their "real time" protection module last night. While the free scanner was able to scan the C:\ and D:\ Drives of my computer, I noticed that after I purchased the real time protection, the scanner was now showing that it could scan an E:\ Drive as well. Is this a special feature for people who purchase the real time protection...being able to scan the E:\ Drive?

However, when I turned on my computer this morning, the scanner was only showing the C:\ and D:\ Drives, not the E:\ Drive anymore? Could someone please tell me why I can no longer see the E:\ Drive option with my scanner?

[mountaintree16]

Hi DOB, and welcome to the forums here at Malwarebytes.org

Maybe a silly question, but, when you found that it scanned E drive when it didn't before, had you JUST plugged in or enabled the E drive? Then this morning, had you by any chance unplugged/disabled the E drive?

Also, as a side note when replying, please use the "ADD REPLY" button at the bottom of the page.

[DOB]

Hey, thanks so much, you were correct. I didn't even realize all this time that when I turn on my printer, it will allow the scanner to scan the E:\ Drive. All this time, I was only scanning my C:\ and D:\ Drives. Thanks again!

[mountaintree16]

You're welcome DOB

So E:/ drive is your printer, then?

All this time, I was only scanning my C:\ and D:\ Drives.

So you want to scan your printer? Go ahead if you'd like, but, I don't think you really need to.

[mountaintree16]

Just one more thing I forgot to add, the paid version does not scan drives that the free version does not, or rather,

scanning of any drive is available whether or not you have the paid version.

[DOB]

OK, so I guess the free scanner was able to scan the E:\ Drive as well. Yes, it appears that my E:\ Drive is my printer, but what else can an E:\ Drive be? You can probably tell, but I am not a computer expert by any means and still don't know all the basics yet either, but I am trying to learn more everyday. Are you saying that Malware cannot hide/infect the E:\ Drive, like it can in the C:\ and D:\ Drives?

[marktreg]

If your printer has slots to take a memory card from a camera, Malwarebytes could detect that as a drive.

[mountaintree16]

DOB,

To add onto what marktreg said,

to check or confirm what E:/ drive is,

Open up My Computer. Plug in your printer, see what drive pops up in My Computer, then unplug it, and see if it disapears.

And like he said, if you do have a memory card in the printer, that could be accounting for whats being scanned.

[DOB]

I have an HP Photosmart C4250 All In One printer/scanner/copier...it's good for what it does, but it's a very small model. It does have slots for memory cards and all that, but I've never used them yet...the slots are empty. I have never used my Malwarebytes scanner to scan my E:\ Drive before, but I'll try it in the future if I have too, and see what happens. As of now, I am able to scan my D:\ Drive pretty quickly in under 3 minutes, but scanning my C:\ Drive takes me almost 4 hours...it's really time consuming. I'm sure that scanning the E:\ Drive wouldn't take too long at all though. What I am hoping now though is, that since I've taken the step to buy Malwarebytes "real time" protection, it will keep all this malware away from my computer and I won't even have to use the scanner anymore to hunt down and remove any infected files. However, does anyone recommend doing continued scans daily or weekly anyway, even if I haven't been infected in a long while? Right now, I have my moduled scheduled to download daily updates automatically, but I don't have it set to automatically perform any quick scans daily or weekly.

[YoKenny1]

Using Full scan is rarely required as about 99.8% of malware that is present in the system is on the C: drive.

I have Malwarebytes set to update daily when I know the system will be powered on followed by a Quick scan daily so that I know quickly if a malware item has attepted to infect my system over the last day of using the system.

[mountaintree16]

Yes, I back up what YoKenny1 said; you really only need a quick scan, the full scan is unnecessary the vast majority of the time.

As for scanning when you have the realtime protection, it is a good idea to run a quick scan once a week, just in case. I run a nightly quick scan. Only reason I do it nightly is because it takes under 10 minutes, so I figure why not?

If you do want to do a full scan, do it once a month. I do a full scan every few months, if that. I really only use the quick scan.

Hmmm. Did you do the little test I suggested to see what pops up as E:/ drive when the printer is plugged in, or anything else for that matter?

[DOB]

well, in the past, I found that doing a quick scan didn't always find the malware, that's why I started to do full scans. The C:\ Drive is the main one, and I have to admit, Malwarebytes did find and remove a few Trojan.fakes hiding deep in my C:\ Drive, but only after doing a complete full scan of C:\ Drive.

Hmmm. Did you do the little test I suggested to see what pops up as E:/ drive when the printer is plugged in, or anything else for that matter?

Yes, I did confirm that when I turn on my printer, the Malwarebytes scanner picked it up as my E:\ Drive. I don't have anything else plugged into that port, only my HP printer. Thanks for the advice about doing the scanning...I will definite continue to do scans once in a while.

Here's another question though - someone told me that if I continue to keep getting attacked by these Trojans, he suggested that I turn off my System Restore, then restart my computer, then turn my System Restore back on again. He suggested that some viruses/malware could be hiding in the System Restore, and that this is sometimes a difficult area for anti-viruses/anti-malware to find. He said that by doing this, it will clear the files in my System Restore and might wipe away any malware hiding in there? Is this all true, or would the Malwarebytes scanner always scan the System Restore anyway?

Now, I haven't been attacked since getting Malwarebytes Prof. 2 days ago, but I am bracing myself to see what happens in the next few days or weeks. If I am attacked by more Trojans, does Malwarebytes Prof. completely block them from entering my files this time?

One last question, as Malwarebytes customer service still has not answered my very simple question yet...but I paid $24.95 for the download and I paid another $9.95 for the back-up CD (I thought it might come in handy one day), but what I don't know is this...is my Malwarebytes Protection Module good for one full year? I don't think it tells you how long this subscription is for? Will I have to renew in a years time?

[YoKenny1]

You have not indicated what anti virus application you are running so please let us know.

Malwarebytes scans the System Restore files.

The $24.95 is good for one system and is a one time charge.

Activating the full version unlocks realtime protection, scheduled scanning, and scheduled updating. For consumers and personal use, it is a one time fee of $24.95.

http://www.malwarebytes.org/mbam.php

Stick around here and you will learn a lot.

[mountaintree16]

DOB,

Oh. What do you mean by not getting all the malware on a quick scan. Were you getting _systemvolumeinformation results or something similar in the full scan results, but that's it? If so, that is in your system restore and that malware CANNOT harm you UNLESS you use an infected restore point.

he suggested that I turn off my System Restore, then restart my computer, then turn my System Restore back on again

I think that this would be the correct thing to do, just to clear things out, but, I am going to double check with someone and get back to you - just want to make sure that I am giving you correct information. I have done this though on two computers that I have worked on for family and friends to clear out the system restore. Have you already cleared out your system restore or are you just asking about doing so?

As for your E:/ drive, I think Malwarebytes will probably pick up anything plugged in, flash drive, CD rom, etc. I'll test this myself later on when I am at my computer. I don't have a printer though really, so I can't test that.

It seems as though you are getting attacked a lot, is this correct?... do you have an anti-virus program installed as well as Malwarebytes? If not, you need one, and if you need some recommendations, I'd be more than happy to give you some and also some links to great free and paid Anti-Virus programs. Also, do you keep programs and plugins such as Adobe Reader, Flash, etc.. up to date? If you are not or are not sure what versions are current, I can certainly walk you through that and help you get get the updates you need, if any. Outdated programs and plugin's are a common source of malware infection as well.

If I am attacked by more Trojans, does Malwarebytes Prof. completely block them from entering my files this time?

Malwarebytes does block attack attempts, yes, but if you do get attacked and Malwarebytes blocks it (you'll need to hit quarantine when the protection module comes up asking you what you want to do), you should do a quick scan afterwards just to make sure it stopped everything.

As for your payment question, good question!

When you purchase a license for a home-use computer, it is for a LIFETIME license, it is NOT a yearly subscription. If you get a new computer down the road and don't want to use your license on the old computer, you can transfer the license, and I can give you directions for that as well if you'd like. If you want it on both computers, you'll need to purchase another license.

So in short, you're good to go, you do not have a subscription to Malwarebytes, it is a LIFETIME license

[DOB]

Thanks YoKenny 1 for the information. So I guess the $24.95 charge is a one time fee that's good forever. As for my antivirus, I have Norton Internet Security 2010. It's OK, but does not seem to stop any malware though. I've been using Norton on my computer for the last few years, but I've been told by many people that Norton really isn't so hot...it's more famous for the name at this point. I have to agree, it's fancy and nice, but doesn't seem to stop much other than tracking cookies and things like that.

[DOB]

Mountaintree16, thanks so much for the long reply, I appreciate it! Yes, I do have Norton Internet Security 2010, so I have always had antivirus protection of course. Many months ago I was attacked by a malware/spambot (whatever it's called?) that actually accessed my entire email contact list...and it sent out a bogus email to everyone on my email list...I was horrified! So, at that time, I decided to downloaded Malwarebytes free scanner to hunt for this malware - it found it and removed it, and I wasn't bothered again.

However, about 5 weeks ago I was attacked by that "You Need Antivirus Pro 2010" (or whatever it says?) and ever since then, I've been attacked by a Trojan.fake virus about once a week. I finally decided to purchase the Malwarebytes real time protection though 2 days ago, in hopes this thing will finally leave me alone.

Question...do these Trojans attack ones computer from the internet? I mean, even if I actually did a full system wipeout/restore...where I literally would wipeout my entire computer and start over again, could malware keep coming back, if it knows your computer code...could it keep attacking a specific computer from the internet? Or, would a complete system wipeout (where you need to reload Windows and the HP Drivers again afterwards) do the trick - eliminate the attacking malware for good? The reason I bought Malwarebytes real time protection in the first place though, is because I don't want to bother doing a complete system wipeout...it would be a real pain in the neck, it would take me many days to reload the computer from scratch again. I did it once many years ago, and I hope I never have to do it again.

Yes, please let me know if turning off the System Restore, then restarting my computer, than turning the System Restore back on, would help in any way? In other words...it wouldn't hurt to do this anyway, would it? The only thing I need to know though is, would turning the System Restore off and on again, delete or change any of my current settings? For example, would it wipeout anything...like my homepage (which is currently Yahoo), or would it revert my computer to an earlier time, where everything would be different? Could it also delete anything that's on my computer currently, like my documents, pictures, windows media player, etc? If not, than I have no problem trying this System Restore thing...

[DOB]

Mountaintree16, FYI - no, I haven't attempted doing this System Restore thing yet, so I will wait for you to get back to me with any additional specific information. By the way, were you suggesting that I probably do not have any Malware currently hiding in my System Restore...that all the Malwarebytes scanning I have done recently to remove the infected files, has done the trick, and removed everything that could be infected in my computer? However, you also suggested that if I restore my computer to an earlier time, that this earlier time could still be infected? Is this true? So, if I end up turning off my System Restore, then restarting my computer, then turning my System Restore back on again..what then...where do I reset the System Restore to make sure I'm OK once I turn it on again?

Oh...here's another interesting question...could Malware hide on a data CD? I recently backed up my documents, photos, etc...on a backup CD (because I had seriously thought that I had to wipeout my computer, but I have since changed my mind)...so could Malware actually reload itself back into a computer, if you use that Data CD?

[mountaintree16]

DOB,

Unfortunately I don't have the time to reply to everything you've replied to me with right now, but I just wanted to let you know that I did read it and will get back to you in about two hours.

[YoKenny1]

Please let us know what your operating system (OS) is as resetting System Restore is diffferent for each OS.

http://support.microsoft.com/kb/310405 <== XP

http://windows.microsoft.com/en-US/windows-vista/Turn-System-Restore-on-or-off <== Vista

I like to put that information in my signature as it makes it easy for the helpers to see what's on my system.

You can go to My Controls then in Personal Profile > Edit Signature

I have an old Brother MFC-240C All-In-One printer that can use Flash memory and if it has something in it then the malware can get on it.

I don't use CDs any more for storing data as I find USB Flash sticks much better and smaller.

[DOB]

YoKenny1, I have Windows XP. I found this link from Microsoft, scroll down and look at Method 2, is this info correct?

http://support.microsoft.com/kb/310405

[mountaintree16]

DOB,

You are very welcome

1) As for clearing System Restore, DO NOT do that yet, please. Leave it alone for now. I'll tell you why in part #3

2) Malware can't copy or write itself to a CD. However, if you burn ALREADY infected files to it, yes, a CD could be infected, and you could get infected if you access those infected files from the CD. So be careful when copying files to a CD, try to make sure that you aren't copying any infected files

3) These two items here (especially the second one)

Many months ago I was attacked by a malware/spambot

(very unfortunate by the way, that's awful. I hope none of your contacts got infected too )

and

However, about 5 weeks ago I was attacked by that "You Need Antivirus Pro 2010... I've been attacked by a Trojan.fake virus about once a week

tell me that you are currently infected. I cannot help you any further until you're clean. Once you are clean, we can pick up where we left off and I can advise you about updating your programs and such, if your helper doesn't do so (which they more often than not do).

As for why I told you not to clear System Restore, just in case your helper needs you to use a restore point at any point, any is better than none. So please only clear it if and when your helper tells you to.

Now please read the following so that you can get your system cleaned, and again, I am happy to have been able to help you and thank you for purchasing Malwarebytes

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you. Also, provide any other details as well as your log(s), such as the background information you gave me (your first attack, and then your fake AV attack about 5 weeks ago)...

Thank you

[DOB]

Mountaintree16, thanks again for all the information! However, I do not think that I am currently infected anymore, I believe my computer is clean now because the last few times I got attacked, I used the Malwarebytes scanner to find and remove them. As far as I know, none of my files are infected now. However, my question to you was simply this - if I continue to get attacked in the future or every few weeks, does this mean that somewhere in my computer there is still a hidden malware that is hiding out in one of my files and is evading the scans, or does it mean that this Malware is coming in from over the internet, and knows how to find my computer specifically? Now that I have Malwarebytes Pro, I am hoping that even if I get attacked again, it won't be able to do anything to my computer...so I am going to wait and see what happens. Hopefully, all will be quiet now though and I won't get attacked anymore, and I can certify my computer as all-clean, but only time will tell.

Don't worry, I won't try to do the System Restore thing either yet. As I said above, I first want to see how Malwarbytes Pro will protect my computer in the event of an attack. However, if I do get attacked again, even if Malwarbytes Pro stops it, I will ask for help from a Malwarebytes helper/expert, so I can try and end these attacks forever, but I think it's too soon to ask for this help yet. I want to see if I can get thru the next few weeks without any incident.

[mountaintree16]

DOB,

You're very welcome

The reason why I think that you should visit the Malware Removal Forum is because you said you were finding malware about once a week or so in your scans. You MAY have malware on your system that is causing re-occurring infections.

if I continue to get attacked in the future or every few weeks, does this mean that somewhere in my computer there is still a hidden malware that is hiding out in one of my files and is evading the scans, or does it mean that this Malware is coming in from over the internet, and knows how to find my computer specifically?

This could mean that you have some hiding Malware, yes. I don't think that Malware can find your computer specifically/from online UNLESS you have a data-stealing trojan and.or a backdoor Trojan and/or rootkit (which hopefully you don't).

This is why I want you to go and get your system checked in the Malware Removal forum, just in case Best to be safe than sorry.

Malwarebytes Pro will definitely help your computer out, but if you have something already hiding, it needs to be found & cleaned out.

If you really want to wait a few weeks to see how things go, then wait if you must, but I highly recommend getting your system checked out.

[DOB]

Mountaintree16,

The reason why I think that you should visit the Malware Removal Forum is because you said you were finding malware about once a week or so in your scans. You MAY have malware on your system that is causing re-occurring infections...

...just to clarify, I am not findng malware about once a week or so on computer when I do scans. When I do scans, it shows all clear...no infected objects. I only meant that, as of a week ago, I was experiencing a Trojan attack about once a week, and THEN, I would use the Malwarebytes scanner to immediately find and remove it. Again, I haven't been attack in a while and just want to see if it finally stops. Obviously if it doesn't stop, I will contact the Malwarebytes help forum to try and get to the bottom of this. In the meantime, now that I purchased Malwarebytes Pro, I just want to see what it does and how it works.

Question - I noticed that when the Malwarebytes scanner does find and remove malware (after an attack), it keeps it in quarantine and even has an option of restoring those files too??? Personally, I have been deleting these Trojan.fake malware from my quarantine, I mean, I am not comfortable leaving them in the quarantine at all, or else they could accidently be restored one day. Should I be leaving any malware that the scanner finds in the quarantine, or should each malware be deleted, once it has been found, removed and quarantined?

As a side note, how do you post "quotes" when sending as reply...I noticed you are able to isolate sentences and post the quotes?

Thanks.

[noknojon]

Hi DOB -

Our reply panels are set out to help to do this -

As a side note, how do you post "quotes" when sending as reply...I noticed you are able to isolate sentences and post the quotes?

First you cut and paste - Left mouse button to 'wipe' over an item you wish to quote, then hit CTRL + C buttons to "cut" an item - Then open the Fast reply or Add reply Panel - Next hit CTRL + V and it will "paste" the item in the panel (this part you may already know) - Next 'wipe the item you just pasted and at the top of our panels there are several icons - While the pasted item is Active (still blue) you hit the second icon from the right which will say "Wrap in quote tags" - Click on this and your Active quote will have

written at each end - The item can then be attributed to that persons former replies 'word for word' -

I hope this helps -