Freeze during McAfee and Malwarebytes scan after removing WindowsRestore virus

[Chap]

Hello everyone,

I have recently removed a virus off my computer named WindowsRestore with a youtube guide. They told me, at the end of the video, that I should download and run Malwarebytes scan. So I downloaded it and when the scan is doing its job, the screen freezes after a while. This happens to the quick, full and McAfee scan. I succesfully deleted 3 other detection by stopping the malwarescan as soon as it finds one but it randomly freezes and there are more than 3. My mom noticed that the scan detected 4 (before I deleted the other 3). I also tried the sticky guide for freezing scans with McAfee but my version is newer and doesn't work that way. I hope that someone could help me out.

Sorry if my english wasn't correct but I'm dutch but I can easily understand replies in english.

Thanks in advance

[screen317]

Hi and welcome to Malwarebytes.

Where does MBAM stop? Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu), and try scanning again.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post DDS.txt directly into your reply.

[Chap]

Hi and welcome to Malwarebytes.

Where does MBAM stop? Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu), and try scanning again.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post DDS.txt directly into your reply.

When I do a quick scan in safe mode, the scan freezes at microsoft.net\framework\v2.0.50727\VsaVb7rt.dll

Ill edit this post later, when I got more information.

[Chap]

When I do a quick scan in safe mode, the scan freezes at microsoft.net\framework\v2.0.50727\VsaVb7rt.dll

Ill edit this post later, when I got more information.

Well I can't edit my old post but here is the log

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Acer at 16:52:48,39 on za 16-04-2011

Internet Explorer: 7.0.6002.18005

Microsoft

[screen317]

Hi,

Please go to VirusTotal, and upload the following file for analysis:

c:\programdata\XFPwmcpwlYCi.exe

Post the results in your reply.

Also zip that file and attach it to your reply.

What version of McAfee are you using?

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[Chap]

Hi,

Please go to VirusTotal, and upload the following file for analysis:

c:\programdata\XFPwmcpwlYCi.exe

Post the results in your reply.

Also zip that file and attach it to your reply.

What version of McAfee are you using?

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Uhm Virustotal's website doesn't load. Neither in IE or morzilla and I tried it on both pc's. Combofix found some windows restore files and deleted them.

McAfee SecurityCenter:

Version:10.5

build:10.5.227

McAfee VirusScan:

version: 14.5

buid: 14.5.130

McAfee firewall:

version: 11.5

Build: 11.5.141

Combofix:

ComboFix 11-04-20.01 - Acer 20-04-2011 20:05:53.1.4 - x86

Microsoft

Attach (2).zip

[screen317]

Hi,

Don't worry; that file is already gone.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317