Can't Find the Culprit

[KN4TX]

I've reached the end of my ability and am hoping someone in the forum has seen this and has some suggestions.

A friend asked me to look at his PC, which was running slow and acting erratic. I figured he was infected and I would run MalWareBytes and all would be good. I attempted to start the program, which I had installed the last time he got infected (ARGH!).

There would be a quick flash on the screen and then nothing.

He had McAfee installed, so I tried to bring up the ViruScan console, same thing, quick flash and nothing.

I figured I'd download MalWareBytes and reinstall but as soon as I entered the term in Google the browser (and all running copies) died. I tried this with FireFox, IE, Chrome and Safari. All same results. I could type MalWareBits and it would work but as soon as I clicked on a returned link, BAM. Dead again.

I've tried in SAFE mode with network, SAFE no network, SAFE with CMD prompt only. I've used MSConfig in the most basic mode and tried to identify the culprit but I don't see anything. I've been in the registry but only found a "MalWareBytes_is1" odd entry that I deleted but made not difference.

The ONLY programs I can get to run are SpyBot and ComboFix, altho ComboFix only runs in CMD prompt mode.

SpyBot found 80 items on first scan, included trojans and the various usual clutter. It cleaned them all and found nothing on next scan. After running SpyBot and cleaning, no change in behavior. MalWareBytes and McAfee still will not start or run.

I did rename MalWareBytes to Winlogon.exe and the program started and I was able to scan. Did a full scan... nothing found??? and even after scan I can not search for MalWareBytes without it killing any browser. Unfortunately, the version I used was an old one and the virus files were out dated. After the scan, I ran an update and but it won't update the "Winlogon.exe" version :-(

I tired RootRepeal but it found nothing out of the ordinary and the only file it flagged was the hibernate file.

LAST, but not least, I am using a thumb drive to copy programs from a good PC to my infected PC. Every time I insert, my copy of McAfee finds a trojan on the drive, coming from the infected one. I clean it every time but back it comes each time. I get the following

M.exe, with the following information:

generic!bg.gqq, Trojan, Application: C:\windows\explorer.exe

I think I've covered everything.

[KN4TX]

I've reached the end of my ability and am hoping someone in the forum has seen this and has some suggestions.

A friend asked me to look at his PC, which was running slow and acting erratic. I figured he was infected and I would run MalWareBytes and all would be good. I attempted to start the program, which I had installed the last time he got infected (ARGH!).

There would be a quick flash on the screen and then nothing.

He had McAfee installed, so I tried to bring up the ViruScan console, same thing, quick flash and nothing.

I figured I'd download MalWareBytes and reinstall but as soon as I entered the term in Google the browser (and all running copies) died. I tried this with FireFox, IE, Chrome and Safari. All same results. I could type MalWareBits and it would work but as soon as I clicked on a returned link, BAM. Dead again.

I've tried in SAFE mode with network, SAFE no network, SAFE with CMD prompt only. I've used MSConfig in the most basic mode and tried to identify the culprit but I don't see anything. I've been in the registry but only found a "MalWareBytes_is1" odd entry that I deleted but made not difference.

The ONLY programs I can get to run are SpyBot and ComboFix, altho ComboFix only runs in CMD prompt mode.

SpyBot found 80 items on first scan, included trojans and the various usual clutter. It cleaned them all and found nothing on next scan. After running SpyBot and cleaning, no change in behavior. MalWareBytes and McAfee still will not start or run.

I did rename MalWareBytes to Winlogon.exe and the program started and I was able to scan. Did a full scan... nothing found??? and even after scan I can not search for MalWareBytes without it killing any browser. Unfortunately, the version I used was an old one and the virus files were out dated. After the scan, I ran an update and but it won't update the "Winlogon.exe" version :-(

I tried RootRepeal but it found nothing out of the ordinary and the only file it flagged was the hibernate file.

LAST, but not least, I am using a thumb drive to copy programs from a good PC to my infected PC. Every time I insert, my copy of McAfee finds a trojan on the drive, coming from the infected one. I clean it every time but back it comes each time. I get the following

M.exe, with the following information:

generic!bg.gqq, Trojan, Application: C:\windows\explorer.exe

I think I've covered everything.

Followup, I was able to install the latest version of MWB. Found Trojan.BHO and Spyware.Onlinegames

[screen317]

Hi and welcome to Malwarebytes.

Do you still need help?