Question re files found during Quick Scan

[Steveg722]

18Sep10 1158a edt

Good morning,

My main question here is about some files found during a Quick Scan most of which appear to be "OK files".

FYI, have included first some background re the swamp I've been in for a couple of weeks now.

Struggling to salvage a corrupted WINDOWS installation. Machine is a Dell Inspiron 6000 laptop that had been running XPSP3 with most updates installed (under C:\WINDOWS). Initial symptom on reboot was hal.dll missing or corrupt. Per Dell Tech, did a parallel installation of XPSP2 to C:\WINXP using XPCD. WINXP runs ok, allows me to see entire C:\ drive (and make manual chgs to WINDOWS), and has access to our home network and the internet.

Re C:\WINDOWS

In addition to numerous other things, have done ~5 REPAIR installations on WINDOWS using XPCD. Could only get to SAFEWITHOUTNETWORKING mode. Booting to either Normal Mode OR SafeWithNetworking modes resulted in the boot hanging OR more recently with a "A problem is preventing Windows from accurately checking the license for the computer. Error Code: 0x80090019" error msg after the the Welcome to WinXP came up.

Under SAFEWITHOUTNETWORKING mode, have gotten SYSTEMRESTORE app going but attempts to actually Restore to any of the few RestorePoints showing have all failed. SYSTEMRESTORE app does not show the opt to Save a new Restore Point.

Yesterday, I downloaded and ran the installer for XPSP3....that ran to the registering files point but aborted with a "Not Authorized" popup (KB docs suggest this relates to a problem with some security settings in registry).

I'm about to attempt a 6th REPAIR installation on WINDOWS but before doing decided to run a MalawareBytes scan.

After launching to WINDOWS in SAFEWITHOUTNETWORKING ran a Quick Scan using Malwarebytes' Anti-Malware 1.46 mode. The app reported two (2) KEYS and twenty (20) files as infected. While I have taken snap copies of the five Registry files and the System32 folder before letting the app make any changes, I'm puzzled by some of the files the app ID'd as "infected".

Would appreciate it if someone "in the know" could comment on the logfile from Quick Scan run on WINDOWS after executing mbam.exe /developer.

Have pasted the contents of mbam-log-2010-09-18 (09-45-38).txt below and as instructed attempted to attach a copy of mbam-log-2010-09-18 (09-45-38).zip to this post.

Look forward to your comments and suggestions.

Thanks

Steveg722

contents of mbam-log-2010-09-18 (09-45-38).txt below

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 7.0.5730.13

9/18/2010 9:45:38 AM

mbam-log-2010-09-18 (09-45-38).txt

Scan type: Quick scan

Objects scanned: 176215

Time elapsed: 6 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 20

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\Software\AntiMalware_ProNE (Rogue.Trace) -> No action taken. [561A0EF459D887469A6CACC0D41B1D14]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\{F9197A7E-CE10-458e-85F8-5B0CE6DF2BBE} (Trojan.Agent) -> No action taken. [95AEB77CD6147CCFE27DEB9502554FE9]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\DRIVERS\ltmdmntt.sys (Rootkit.Agent.H) -> No action taken. [E40CC8FA46CB9029B499E4720D6D20AC]

C:\WINDOWS\system32\DRIVERS\svchost.exe (Trojan.Downloader) -> No action taken. [0C7FF0DFAA71877077F75556585A2E64]

C:\WINDOWS\system32\DRIVERS\cisvc.exe (Trojan.Agent) -> No action taken. [6B8F0940134B39D8247CEC1068899FDD]

C:\WINDOWS\system32\DRIVERS\cmstp.exe (Trojan.Agent) -> No action taken. [3EF54ED854EA569283A6BDCC594975AA]

C:\WINDOWS\system32\DRIVERS\comrepl.exe (Trojan.Agent) -> No action taken. [2CB6E92866D569770CCC603F724E6B66]

C:\WINDOWS\system32\DRIVERS\logman.exe (Trojan.Agent) -> No action taken. [652C6228E278208922687F69C1314C83]

C:\WINDOWS\system32\DRIVERS\mstinit.exe (Trojan.Agent) -> No action taken. [D2A69DD735163B6C03E9D98371EA0AFC]

C:\WINDOWS\system32\DRIVERS\rsvp.exe (Trojan.Agent) -> No action taken. [1C31F2989034975B4850434EA90F2C47]

C:\WINDOWS\system32\DRIVERS\services.exe (Trojan.Agent) -> No action taken. [174D5E06767065BB6B8C4F6AB71AC13C]

C:\WINDOWS\system32\DRIVERS\winlogon.exe (Backdoor.Bot) -> No action taken. [13BC20931380421D543ADDA71EE38AC0]

C:\WINDOWS\system32\DRIVERS\csrss.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [4052004E5985601671D1FCBAF31AB64F]

C:\WINDOWS\system32\DRIVERS\ctfmon.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [DE8D4BED2038223C17462F02B98E70C9]

C:\WINDOWS\system32\DRIVERS\dllhost.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [F03D14281BCF8CFD0ADE8F8358A2BD12]

C:\WINDOWS\system32\DRIVERS\explorer.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [49635E14F9899F0197654E79F7142A4B]

C:\WINDOWS\system32\DRIVERS\lsass.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [2875D733981E73BDFAD359F0E3E66BF9]

C:\WINDOWS\system32\DRIVERS\msiexec.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [C0308230B1D0F95045056E536EC4A0A9]

C:\WINDOWS\system32\DRIVERS\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [5A32C817446474E5613810C48100AD8D]

C:\WINDOWS\system32\DRIVERS\smss.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [41E83D9B8188A4433728567E07A02B68]

C:\WINDOWS\system32\DRIVERS\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [837737DA25FE31611D9A3C012A5BC47E]

C:\WINDOWS\system32\DRIVERS\userinit.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [0A556900C77FF71B3E608D5934257DD8]

mbam_log_2010_09_18__09_45_38_.zip

[MAM]

Run a update, and make a full scan this Malwarebytes' Anti-Malware, and post log again here.

Current update is 4646.

MAM

[Steveg722]

Run a update, and make a full scan this Malwarebytes' Anti-Malware, and post log again here.

Current update is 4646.

MAM

18Sep10 221p edt

Reply to

MAM,

Understood you were suggesting I get an updated rules.ref file for the Malwarebytes' Anti-Malware program.

FYI, the Malwarebytes' Anti-Malware program I used for the logfile in my prior post was downloaded this morning from malwarebytes.org.

The program had been installed here under WINDOWs several years ago but I "reinstalled it" this morning using the mbam-setup-1.46.exe file I downloaded this morning. Not sure why a download from this morning would show v4052 vs v4646.

Since WINDOWS in SAFEWITHOUTNETWORKING mode (only opt I have now for WINDOWS) has no network or internet access, I can't use the automated feature to update the rules.ref file. So I used another computer, went back to malwarebytes.org, found a post with a link to download the current file for Manually updating rules.ref. What I got was a mbam-rules.exe file but properites show version as 1.4602.0.0 and file date of 9/12/2010. No idea how to get 4646.

From WINDOWS in SAFEWITHOUTNETWORKING, I clicked on that mbam-rules.exe file and installed the new rules. I then relaunched the Malwarebytes' Anti-Malware program and confirmed the rules version showing was 4602. Closed it.

Then executed the mbam.exe /developer command, the Malwarebytes' Anti-Malware program opened itself, and I initiated a "Full Scan on C:\". Expect it could take a while as its a 60GB HD.

I'll post again with the resulting logfile once it finishes.

Thanks,

Steve

[nosirrah]

Detections from an out of date database cannot be addressed.

If you are unable to update due to system stability issues we have not yet reached a point where evaluating a scan log is possible.

[Steveg722]

Detections from an out of date database cannot be addressed.

If you are unable to update due to system stability issues we have not yet reached a point where evaluating a scan log is possible.

18Sep2010 400p edt

Reply to

Mr Harrison,

I'm almost 2hrs into the scan using the v4602 rules I got by downloading mbam-rules.exe for Manually Updating.

Seems you're suggesting the results from that scan will have no value and/or nobody will comment on them for me.

Can you tell me how I can download (or get) a rule.ref file for the "current (v4646?) rules"?

Thanks,

Steve

[MAM]

A very strange forum here, some treats are deletet, i a,nger about this, the FIB is olso involdet!

MAM

[Steveg722]

Detections from an out of date database cannot be addressed.

If you are unable to update due to system stability issues we have not yet reached a point where evaluating a scan log is possible.

18Sep2010 659p edt

Re

Ok, the Full Scan completed vs V4602. Pasted the log output BELOW and attached as mbam-log-2010-09-18 (17-34-49).zip.

While there are a few items that appear trashable, many (esp the file items) look like legit system file names normally found under System32.

Meantime, I relaunched the same PC to the parallel WINXP installation. Then launched mbam-setup-1.46.exe file and installed Malwarebytes' Anti-Malware to a different directory under Program Files. Then launched it and had it do auto update (can't check right now but believe it updated to v4646? or v4649).

Presently only ~1hr into the scan. Since the last one took ~3.5hrs, it will be a while before this finishes.

Will repost with it when its done.

Should be interesting to see how those results compare to those using v4602.

In the meantime, my interest is in hearing from "those in the know" re cases to be made 1) why to or why NOT to delete any or which of the items ID'd as "infected" in these log files.

Thanks,

Steve

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4602

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 7.0.5730.13

9/18/2010 5:34:49 PM

mbam-log-2010-09-18 (17-34-49).txt

Scan type: Full scan (C:\|)

Objects scanned: 378440

Time elapsed: 3 hour(s), 29 minute(s), 36 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 33

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\Software\AntiMalware_ProNE (Rogue.Trace) -> No action taken. [561A0EF459D887469A6CACC0D41B1D14]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\{F9197A7E-CE10-458e-85F8-5B0CE6DF2BBE} (Trojan.Agent) -> No action taken. [95AEB77CD6147CCFE27DEB9502554FE9]

Registry Values Infected:

HKEY_CLASSES_ROOT\AppID\main.DLL\appid (Adware.DeepDive) -> No action taken. [2FE4E531BDFE2AE87C92D907D5384DDA]

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\DRIVERS\ltmdmntt.sys (Rootkit.Agent.H) -> No action taken. [E40CC8FA46CB9029B499E4720D6D20AC]

C:\Documents and Settings\Helen\My Documents\Jenna_Stuff\Spain\DSCN1233.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My DELL LAPTOP_GatewayPC\091013dl RegToolFree setup.exe (Rogue.Installer) -> No action taken. [447A70DB8499D83BAD9701E391AA6C68]

C:\Documents and Settings\Helen\My Documents\My Pictures\GREG_Nicole\Wedding\Wedding Pics\Wedding Pics\Wedding Pics_MyCamera\20061006_0018.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\GREG_Nicole\Wedding\Wedding Pics\Wedding Pics\Wedding Pics_MyCamera\20061006_0030.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Helen\butterflies2006_07_16\IMG_0487.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\HOLIDAYS\XMAS\Xmas06_NY07\20061225_0027.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\JENNA\Babies_Mar08\IMG_2236.jpg (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Steve\090419_canoncameradumpall_masterset\20090224_0087.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Steve\VT_Jan08\2008_01_27\IMG_2150.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Vacations\BI_2006\BICondo_2006_07_03\IMG_0395.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\_4sg_ALL\_4sg_arc080331\_4sg7_h\Photos_s_h\Crickets_Reservoir\20061029_0011.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\_4sg_ALL\_4sg_arc080331\_4sg7_h\Photos_s_h\pics_misc\20061014_0011.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\images\coloredpencils2.png (Extension.Mismatch) -> No action taken. [82D61B36026827EB15A43DA1734F155D]

C:\WINDOWS\system32\DRIVERS\cisvc.exe (Trojan.Agent) -> No action taken. [6B8F0940134B39D8247CEC1068899FDD]

C:\WINDOWS\system32\DRIVERS\cmstp.exe (Trojan.Agent) -> No action taken. [3EF54ED854EA569283A6BDCC594975AA]

C:\WINDOWS\system32\DRIVERS\comrepl.exe (Trojan.Agent) -> No action taken. [2CB6E92866D569770CCC603F724E6B66]

C:\WINDOWS\system32\DRIVERS\logman.exe (Trojan.Agent) -> No action taken. [652C6228E278208922687F69C1314C83]

C:\WINDOWS\system32\DRIVERS\mstinit.exe (Trojan.Agent) -> No action taken. [D2A69DD735163B6C03E9D98371EA0AFC]

C:\WINDOWS\system32\DRIVERS\rsvp.exe (Trojan.Agent) -> No action taken. [1C31F2989034975B4850434EA90F2C47]

C:\WINDOWS\system32\DRIVERS\services.exe (Trojan.Agent) -> No action taken. [174D5E06767065BB6B8C4F6AB71AC13C]

C:\WINDOWS\system32\DRIVERS\svchost.exe (Trojan.Downloader) -> No action taken. [0C7FF0DFAA71877077F75556585A2E64]

C:\WINDOWS\system32\DRIVERS\winlogon.exe (Backdoor.Bot) -> No action taken. [13BC20931380421D543ADDA71EE38AC0]

C:\WINDOWS\system32\DRIVERS\csrss.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [F8136510D1494BE1CEF539C3F27CB9CA]

C:\WINDOWS\system32\DRIVERS\ctfmon.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [547BB570BA9EA6E7E02D0A9744ACA58B]

C:\WINDOWS\system32\DRIVERS\dllhost.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [FEE14213E848FE1045C9D0F3F8752A33]

C:\WINDOWS\system32\DRIVERS\explorer.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [A3DE9FD1B6F2BFFF1FB4D5B0C6440AB7]

C:\WINDOWS\system32\DRIVERS\lsass.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [48F8625A5B2067ECABFD8D5DFA792743]

C:\WINDOWS\system32\DRIVERS\msiexec.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [2328EA9FFDE899FF3137DE3F0A440819]

C:\WINDOWS\system32\DRIVERS\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [A36D7C697BA7BB9210FAC3A0BD85F33E]

C:\WINDOWS\system32\DRIVERS\smss.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [EDA5E20CD8A25CDDFC7208C7C5D866E3]

C:\WINDOWS\system32\DRIVERS\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [9D9746E8CC9CC8A0656BFB138E14EFC8]

C:\WINDOWS\system32\DRIVERS\userinit.exe (Heuristics.Reserved.Word.Exploit) -> No action taken. [F1D90F6E832DE0C2815F620BC57CE1FD]

[Steveg722]

Detections from an out of date database cannot be addressed.

If you are unable to update due to system stability issues we have not yet reached a point where evaluating a scan log is possible.

18Sep2010 959p edt

Re

To Bruce Harrison

Vice President of Research

Bruce,

Full scan on C:\ running mbam.exe from WINXP on C:| using file.ref v4649 was completed (had done it prior but forgot to do mbam.exe /developer).

Resulting logfile pasted below and attached as mbam-log-2010-09-18 (21-34-02).zip.

Seems we have quite different collection of files listed as "infected" now using v4649 vs v4602. All of the .exe files from System32\drivers are now NOT THERE and the files left are all seem to be pretty recongnizable personal .jpg files (photos) and one coloredpencils2.png which seems like could just be some sort of "sample file" in the Program Files\HP\Digital Imaging folder

My interest is in hearing from "those in the know" re cases to be made 1) why to or why NOT to delete any or which of the items ID'd as "infected" in these log files.

My inclination is to presume they are all "false positives".

Thanks,

Steve

ps_wonder what the results would have been had I used v4646 as suggested by IMAM prior as the "current rule.ref file"?

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4649

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

9/18/2010 9:34:02 PM

mbam-log-2010-09-18 (21-34-02).txt

Scan type: Full scan (C:\|)

Objects scanned: 338910

Time elapsed: 1 hour(s), 43 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 13

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Helen\My Documents\_4sg_ALL\_4sg_arc080331\_4sg7_h\Photos_s_h\Crickets_Reservoir\20061029_0011.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\_4sg_ALL\_4sg_arc080331\_4sg7_h\Photos_s_h\pics_misc\20061014_0011.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\Jenna_Stuff\Spain\DSCN1233.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My DELL LAPTOP_GatewayPC\091013dl RegToolFree setup.exe (Rogue.Installer) -> No action taken. [447A70DB8499D83BAD9701E391AA6C68]

C:\Documents and Settings\Helen\My Documents\My Pictures\Steve\VT_Jan08\2008_01_27\IMG_2150.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Steve\090419_canoncameradumpall_masterset\20090224_0087.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Vacations\BI_2006\BICondo_2006_07_03\IMG_0395.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\GREG_Nicole\Wedding\Wedding Pics\Wedding Pics\Wedding Pics_MyCamera\20061006_0018.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\GREG_Nicole\Wedding\Wedding Pics\Wedding Pics\Wedding Pics_MyCamera\20061006_0030.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\Helen\butterflies2006_07_16\IMG_0487.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\HOLIDAYS\XMAS\Xmas06_NY07\20061225_0027.JPG (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Documents and Settings\Helen\My Documents\My Pictures\JENNA\Babies_Mar08\IMG_2236.jpg (Extension.Mismatch) -> No action taken. [AD453DC4FA448338632AF9FA8A18FBE0]

C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\images\coloredpencils2.png (Extension.Mismatch) -> No action taken. [82D61B36026827EB15A43DA1734F155D]

mbam_log_2010_09_18__17_34_49_.zip

mbam_log_2010_09_18__21_34_02_.zip

[noknojon]

091013dl RegToolFree setup.exe (Rogue.Installer)

Items such as tiese are infections to be removed - I would think that several of the files listed are infected and need to be cleaned -

Unless nossirah adds other instructions I would ask you to follow these directions and re post in the area noted in blue -

As we do not work on Malware removal or diagnostics in the general forums please follow these directions -

Please print out, read and follow What do I do now? , skipping any steps you are unable to complete.

The next step is post a New Topic Here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that

you're alerted when someone has replied to your post - Please allow at least 48 hours for a reply as the experts can get busy at times -

Also add a brief note to the experts as to your problems -

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or via This Link

Always use the ADD REPLY Tab at the bottom of the page when you reply -

Thank You -

EDIT - The experts will soon figure out the good and bad files and (if possible) repair your system -