Folder being created

[killerwave7]

Hey guys,

This similar problem came up for me once I installed the free version in a folder on my desktop and whenever I restart the computer, it constantly creates a new folder (called Andrew's Folder) that contains this folder: "MALWAREBYTES ANTI-MALWARE" which has nothing in it. Everytime I try to delete this folder and restart the computer, it recreates it. Then I tried installing the free version under the program files directory and it does the same thing. So now I have two folders that are recreated, under the same name but in different locations. There is nothing in either of these folders and I am really confused as to why they are created everytime regardless of whether Malware is installed or not.

I need help trying to solve this problem so that these folders are never created again and that way I can just enjoy using the version of Malware under one folder and not scattered in different places.

Thanks in advanced for any help.

Computer Specs:

Toshiba Satellite A205

Windows Vista 32-bit

Intel Core 2 Duo CPU T5450

2GB RAM

[1PW]

Hello killerwave7:

Please download Oldtimer's latest OTL.exe to your Desktop.

To Download/Run OTL:

• Download the most recent OTL.exe from

here.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
OTL should now start. Change only the following settings:

Change Drivers to:

All

.

Change Standard Registry to:

All

.

Under File Scans, check that

File Age

is

30 Days

.

Click the

Run Scan

button. Do not change any other settings unless otherwise told to do so. The scan shouldn't take long.

When the scan completes, it will open two Notepad windows. OTL.Txt and Extras.Txt (first run only). These are saved in the same location as OTL.exe
Please attach these 2 files in your next reply.

Until specifically requested to do so, please do not uninstall/reinstall MBAM or attempt to take any other corrective measures unless directed. We would like to capture additional data regarding this situatiion. Thank you.

I am referring your problem to Malwarebytes' staff (Mainard). He will examine your log files and request additional data.

Please use the button instead of other ones when you start replying.

Thank you for your patience.

[Mainard]

Hello killerwave7,

In addition to the OTL log, please check your private inbox and respond there.

Thank you.

[killerwave7]

Here are the two log files that you requested 1PW.

Thank you and Mainard for helping.

OTL.Txt

Extras.Txt

[Mainard]

According to the logs you do not have MBAM installed.

Please do the following:

• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

Thank you.

[killerwave7]

Hi Mainard,

I had uninstalled MBAM when I tried to get rid of the two extra folders that are created everytime. I have followed your steps and the folders are still there. Would you like me to perform another scan and post the two log files here again?

Thanks for the help

[Mainard]

Created for User

[Mainard]

Please delete those folders. Run MBAM-clean.exe. Are the folders created on startup?

Thank you.

[killerwave7]

I deleted the folders. Then I ran MBAM-clean.exe

The folder that was created on my desktop no longer appears after restarting my computer but the folder in program files still appears. I have not reinstalled MBAM, should I do so now?

Thanks.

[Mainard]

Hello killerwave7,

Yes please.

After you install MBAM please Create an Autoruns Log:

• Please download Sysinternals Autoruns from here and save it to your desktop.
  
  • Note: If using Windows Vista or Windows 7 then you also need to do the following:
    
    1. Right-click on Autoruns.exe and select Properties
       
    2. Click on the Compatibility tab
       
    3. Under Privilege Level check the box next to Run this program as an administrator
       
    4. Click on Apply then click OK
       

  [*]Double-click Autoruns.exe to run it.

  [*]Once it starts, please press the Esc key on your keyboard.

  [*]Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures so that it is now checked

  [*]Click on the Options button again and this time uncheck Hide Microsoft and Windows Entries

  [*]Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.

  [*]When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.

  [*]Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder

  [*]Attach the Autoruns.zip folder you just created to your next reply

Thank you.

[killerwave7]

Followed the directions, here is the autoruns zip file.

AutoRuns.zip

[Mainard]

Hello Killer,

After you installed MBAM did you launch MBAM before creating the AutoRuns log?

If you have not please create another autoruns and attach it in your response.

I am looking for a file that is missing.

Thank you.

[killerwave7]

Here is the autoruns file when MBAM was run.

AutoRuns.zip

[Mainard]

Hello KillerWave7,

Please check your private message inbox and respond there.

Thank you (more private system data information requested).