Cannot delete findings

[anthonyq]

Hi all,

a friend is having problems with her Win XP PC. She is getting a green screen with the following warnings come up

[Firefox]

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then post back the MBAM log and a new Hijackthis log.

[anthonyq]

thank you for the reply, don't know just when I will be able to get over to her house again to try run another scan, the last time I tried I was unable to run Malwarebytes in normal Window, but managed to run the scan in Safe Mode just couldn't delete the results from the scan. You say in your posting,

"Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode". Shall I try a scan in Safe Mode?

[Firefox]

We do not recommend running in safe mode cause it could cause other problems.... if you had an expert working with you and he suggested you do that then it would be OK.... I for one have done scans in safe mode, but I am also a computer engineer and I know what to do if I mess things up....

If you do run it in safe mode, then its at your own risk.... your best course of action is to follow the instructions above, if that does not work then follow the instructions below:

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

[southjoey07]

I have scanned and did the removal process many times. I scan again, then the same two infected files are there. Here is the infected files from my log:

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.166.105 93.188.161.105 1.2.3.4 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49ed5f7e-ff5b-402f-9c3f-0eba312858f0}\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.166.105 93.188.161.105 1.2.3.4 -> Quarantined and deleted successfully.

It says it deletes it everytime but when i scan, its there again. Suggestions?

Thanks, Joey

[Firefox]

@ southjoey07

Hello, and welcome to Malwarebytes.org

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org