XP Pro Computer Infected - MB will not install

[bfordmn]

We have an XP pro desktop that is infected. I tried installing the latest MB from a thumbdrive, but it would simply start up the false AV warning page. I have tried renaming the exe and also tried installing through safe mode, but the same thing happens. I can see from the other tutorials that maybe running a variant of RKILL may solve the problem, but before going further I thought I would post here for advice. I have also seen in other threads where you recommend building a bootable CD, so I am guessing that is where I will be heading. Thanks for your help.

I did not mention it in my first post, but the malware I am infected with is XP Security 2012.

[LDTate]

Print out these instructions as we may need to close every window that is open later in the fix.

It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.

Do not reboot your computer after running rkill as the malware programs will start again.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)

There are 5 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Admin

You only need to get one of them to run, not all of them.

1. rkill.exe
   
2. rkill.com
   
3. rkill.scr
   
4. WiNlOgOn.exe
   
5. uSeRiNiT.exe
   

Do not reboot your computer after running rkill as the malware programs will start again.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select Perform quick scan, then click Scan.
  
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• 
  
• Then click Remove Selected .
  
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
  

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste". .

[bfordmn]

Just prior to your post with instructions, I was able to get MBAM installed on the infected computer by using a USB thumb drive and renaming the file as a COM. I could not update the definitions, but was able to run MBAM. Then after the first pass, I was able to update the definitions and fully wipe out what was left. Thanks, this case can be closed.

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!