MBAM not starting and "arumn.sys"

[zapp21]

I've found what I think is at least part of a nasty virus. So far, there is no way of removing it. MBAM will still run in Safe Mode, but doesn't even start up in Normal Mode. Below are things I've noticed about this problem:

-location: C:\Windows\System32\drivers\arumn.sys (may be a randomized name)

-size: 749 KB (766,976 bytes)

-created: ?Sunday, ?July ?25, ?2010, ??12:29:23 AM (a "virus scan" program started running while I was browsing and I couldn't stop the browser, I started MBAM but got blue screen as it was trying to run)

-no digital signature

-in its Properties, Security tab, "The requested security information is either unavailable or can't be displayed"

-Date Modified of arumn.sys always changes to current time, so it updates itself at least every minute

-cannot read or copyarumn.sys

-cannot delete arumn.sys ("Cannot read from source file or disk")

-arumn.sys not recognized by MBAM (I haven't been able to update it since)

-arumn.sys cannot be quarantined/removed by Avira or Sophos Anti_Rootkit

-killbox cannot remove arumn.sys

-arumn.sys still untouchable in Safe Mode

-all updates are blocked (MBAM, Avira Antivirus, DivX, etc)

[gtyhfy]

Hello zapp21,

As we don't work on Malware removal or diagnostics in this forum, please read carefully and follow the directions below so that a qualified expert helper will help you to clean those nasty malware for free at the malware removal forum -

• If you have already submitted for assistance at one of the other support sites on the Internet, then you should not post a new topic here and stay working with the helper from that site until the issue is resolved.
  
• Please print out, read, and follow the directions here, skipping any steps you are unable to complete.
  
• Then post a NEW topic here, remember to describe your problem along with the necessary logs (MBAM ,DDS, GMER) in that topic. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
  
• One of the expert helpers there will give you one-on-one assistance when one becomes available.
  
• After posting your new topic, make sure under options (top right of your topic screen), you select Track this topic and choose one of the Email options (prefer Immediate Email Notification) so that you're alerted when someone has replied to your post.
  
• Please be patient when waiting for an expert help as the expert helpers can get a bit busy.
  
• Please try not to post back (bump) your topic within the first 48 hours. Expert helpers will find the topics which has a zero post count first. If you bump your topic, expert helpers may think the topic is replied and jump to other posts.
  If there is no reply from any experts after 48 hours, you can reply the topic for asking help again or send a Private Message to a Moderator asking for assistance.
  
• Please do not alter the system (eg install or uninstall any software, conduct some fixes, use any removal/scanning tool) after posting unless it is told by the expert helper. Using these other tools often makes the cleanup task more difficult and time consuming.
  

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or via here for a prioritized support. Please remember to quote your cleverbridge Reference Number from the confirmation e-mail when requesting assistance.

If you're a Corporate or Technician Licensed customer seeking assistance please send an email to corporate-support@malwarebytes.org. Please quote your order reference number when you send the request.

NOTE: If for some reason you're unable to run some of the tools in the first link, then skip that step and move on to the next one. If you can't even run any tools in safe mode, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.

Thank You

PS Please use the "ADDREPLY" button at bottom of forum window instead of other ones when you start replying.