Yet another malware removal with a big problem

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

brian3163

Thread Starter
Joined
Sep 5, 2009
Messages
1
I have a clients computer with a particularly nasty problem.

It originated as a pro av scam program that was received.

My client is a franchise business and they are required to use I.E. so please do not simply tell me to switch to FF...

As on other threads,, you run a search in google yahoo etc.. and the links redirected to random sites that are irrelevant.

Installed HJT.. when it ran, it immediatly shut down and could no longer access the program unless installed into a different folder and it would start but immediatly crash..... not good... no log created

Installed and updated MBAM... started it tunning, It started to scan, It showed 5 keys were infected then shut down... no log created. Tried running again but was informed that it could not be accessed....re-intalled.. started to run then shut down.

Installed Superantispyware and updated... Ran the program in safemode and it shut down part way through scan,... no log created.

Are we getting the picture yet?

uninstalled and then re-installed the programs.

using msconfig... restarted in diagnostic mode.

Ran MBAM... it discovered and removed a bunch of stuff... don't have log here

superantispyware ran clean.

So I think GREAT... we got things back under control.

ran MBAM once again just to make certain after a restart in diagnostics mode, and it came clean. I was so happy.

Set it back to normal startup and went to IE... did a google search, and sure enough, it was redirected to some irrelevant random site.

BTW,,, when it does this, there is always this little green globe that appears in the address bar.

So I go to run MBAM and SuperAntispyware.. both shut down without completion and could not be accessed with out re-installation to a different folder.

Under loaded modules in the sysinfo, everything looks normal except this one entry... it has no information except the location of the module which is somehing I have never seen before...

\\globalroot\device\__max++>\df95db98.x86.dll

Ummmm... yeah like... where would this be?

Any help would be appreciated.

Brian
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top