Spyware Guard 2008

[exile360]

Ok, it must be the malware itself blocking it. I guess you'll have to get rid of this nastiness before you'll be able to use it again. I hate malware, and I'm sorry you're having such a hard time with this, but fear not, once an expert assists you with removing this junk your system will be running normally again.

[ASF1nk]

Yeah, this was really bad and annoying. >:/

Well thanks for all your help, patience,(with this noob) and time. it is highly appreciated. =)

[exile360]

If you're willing to try, I do have one more tool for you. It's a download from microsoft: http://www.microsoft.com/downloads/details...;displaylang=en

Download it to your clean PC and copy the installer to your infected one, install it and then navigate to C:\Program Files\Windows Resource Kits\Tools and create this batch file and place it in that folder, you can call it reset.cmd:

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f

If that doesn't do it, then you'll need to head to our HijackThis forum to get fixed up.

[ASF1nk]

No, all methods I tried tell me the same "Another program is currently using this file." =/

[warman]

No, all methods I tried tell me the same "Another program is currently using this file." =/

I am sorry I wasn't able to try all your steps. I had some issues I have to fix before the holidays, then flying away to the Sun, Winter in Quebec is BRRRRRRRRRRRRR!!!! I'll try the steps on my return... Thanks for all your help I'll keep you posted... I have put my infected PC Off line,

Merry Xmas and Happy New Year

[exile360]

No problemo, I don't blame you, it's like 13 degrees here, and that's cold enough for me, I could only imagine how cold it must be there. As far as I can tell based on what I've tried with other users so far, your best bet is following the instructions here:

http://www.malwarebytes.org/forums/index.php?showtopic=2936

and posting your logs in a new topic here:

http://www.malwarebytes.org/forums/index.php?showforum=7

It seems this one requires an expert's know how to completely kill. I was up all night trying to help another guy remove it and everything we tried was a no-go so I believe manual removal is a must at this point. Enjoy your trip and may you have a safe flight. Oh yeah, and enjoy the sunshine.

[dumpav]

i just got hit with this same nasty warez b4 xmas, i don't even know how it slip into my system, i have install nod32 and use firefox, i thought that would eliminate most problem.

Now i try to remove that spyguard stuff from safe mode using software add and remove, now my window xp will shut itself down just b4 it boot into window xp desktop. Is there anyway i can save this machinen or reinstall is the last method?

thanks!

[exile360]

Greetings dumpav and welcome. Sorry to hear of your troubles. Please refer to this thread as it should give you some valuable info on how to get Windows to run again: http://www.malwarebytes.org/forums/index.php?showtopic=8706

If that is helpful, then please follow AdvancedSetup's instructions here: http://www.malwarebytes.org/forums/index.p...amp;#entry35969

Then please follow the instructions here:

http://www.malwarebytes.org/forums/index.php?showtopic=2936

and post your logs in a new topic here:

http://www.malwarebytes.org/forums/index.php?showforum=7

Please be sure not to install any software or use any removal/scanning tools exept those that you are

instructed to by the expert who will be assisting you as doing so can make their job much more difficult.

I hope I was helpful. If you need any more assistance let me know. Good luck.

[mcg]

Greetings, and welcome warman.

The following instructions assume you have a clean computer to work from.

Create a folder on the desktop of your clean computer and call it

"copy me to desktop" without the quotes.

Next, please download Malwarebytes' Anti-Malware from here:

http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html

Save the setup file in the folder you created previously.

Install the program on the clean computer by double clicking it and

run Malwarebytes' and update the definitions once installation completes.

Open notepad and copy the following text into it exactly as written

then save the file as prep.bat (make sure you select the drop down

box when saving the file that says "Save as type" and select "All Files":

copy "%AllUsersProfile%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref" "%cd%"

ren "%cd%\mbam-setup.exe" 12setup.exe

Now double click the prep.bat file you just created, the setup file should now be renamed

and you should now have a file called rules.ref in the folder with it.

Now, as before, create another batch file called install.bat and save it in the same folder:

copy rules.ref "%AllUsersProfile%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware"

ren "%systemdrive%\Program Files\Malwarebytes' Anti-Malware\mbam.exe" mscan.exe

"%systemdrive%\Program Files\MSCANNER\mscan.exe" /quickscan

Hi sorry for the rly long quote and sorry for the noob question but, when you say to copy the stuff in the box into notepad should i copy every last word in the box cause ive done all that you asked put it on my infected pc and when i try to execute the 12setup file, i cant get to the actual installation part same problem that your guide is supposed to fix.

Any help would be greatly appreciated

[AdvancedSetup]

Hello and Welcome to Malwarebytes.org

Please read and follow the instructions provided here: I'm infected - What do I do now?

Someone will be happy to assist you further with cleaning your system if required

During this scan and cleanup process you should not install any other software unless requested to do so.