3 replies to this topic

[monster1999]

Hey guys.
I'm very new here, but have been a keen user of Malwarebytes for some time now.
I'm certainly no novice when it comes to PC's, but this one has me stumped.
I'm running WinXP Pro (fully updated) and seem to have obtained a virus (or possibly a few virii?!)

The 1st symptom, on opening an email from a known, reliable source (paypal) was (forgive me if I'm wrong here) AVClean popping up and telling me I'd been infected. (It may not have been AVClean, but it was certainly something with a similar name). This was 5 hours ago, and in my attempts to remove it, I've forgotten exactly what it was called.
Anyhow, I disabled it in 'processes', searched my hard-drive and registry for any traces, and removed them all. That seemed to have resolved that particular problem.

Now tho, I'm getting 'msa.exe' and 'b.exe' running. I can shut them down but they restart themselves a little later.
Also, in IE7 and Firefox, when ever I click on a link, I'm taken via a site called 'http://windowsclick.com/' which seems to be a total wrong turn.(I've blocked that site in my ESET Smart Security).

I've tried running Malwarebytes in normal and safe modes, but it simply will not run It's showing in 'processes', but nothing happens. Same with Spybot. I dl'd 'Combofix' and that has the same problem (it shows in processes but nothing happens).
AdAware shows nothing untoward. ESET scans, finds upto 3 infections, then the PC reboots on its own. I've also run ESET in safe mode with no apparent success.

So, can anyone help me out here? I'd really appreciate it!!

[SpySentinel]

Hi monster1999, Welcome to Malwarebytes

Please follow the instructions HERE and then post a log in the Malware Removal - HijackThis Logs Forum so we can help clean up your computer.

[monster1999]

SpySentinel, on Aug 10 2009, 11:57 PM, said:

Hi monster1999, Welcome to Malwarebytes

Please follow the instructions HERE and then post a log in the Malware Removal - HijackThis Logs Forum so we can help clean up your computer.

OK, done. It's here:
http://www.malwareby...showtopic=21322

Thanks for getting back to me so fast! I'll keep my fingers crossed!

[SpySentinel]

You're welcome.