1 reply to this topic

[CADComputing]

After several attempts to install Malware Bytes, I had been unable to. A particular trojan/virus kept deleting mbam.exe as soon as it was installed/copied to the program directory. This is how I fixed it.

On Infected PC:
Download MB installer > Rename to Spaghetti (any single word will do)
Install Program > c:\Program Files\Spaghetti
Create Program group > Start Menu\Spaghetti

Installer completes and tries to run, but mbam is dumped immediately and wont run

On a second / Clean PC:
Download MB installer > Rename to Spaghetti (same as single word above)
Install Program > c:\Program Files\Spaghetti
Create Program group > Start Menu\Spaghetti
Open C:\Program Files\Spaghetti > Rename MBAM.exe to Spaghetti.exe
Double Click Spaghetti.exe > Update MB to newest database.

Optional: Run scan

Plug in external hard drive/flash drive to clean pc
Copy from clean pc: C:\program files\Spaghetti

Move external hard drive/flash drive to infected pc
Copy to infected pc: C\program files\Spaghetti

Check to ensure that desktop icon and start menu icon are named Spaghetti

Run Spaghetti and scan. It works!

The trojan does not affect the registry entries, just the program icon, and the ability
to run mbam.exe. by installing then copying spaghetti over the same directory
the program works and runs as Spaghetti.

Of course any random one word name would be good, as long as it doesnt refer to
a program name that is a common tool.

Ive removed 86 trojans with Spaghetti. Now for some nice Chianti to go with it.

:-D

Brian W
CAD Computing

[AdvancedSetup]

Hi Brian,

Thank you for your post. The issue is complex as it changes almost daily what and how the Malware operates. If you think you're clean and are satisfied that's great. If you're not certain and you'd like someone to help you take a look then please follow the directions below. Please be aware though that the site is very busy and it could be a couple of days or more before someone is able to respond.

Thanks.


Scan and post logs - read note at bottom in green
If you're having Malware related issues with your computer that you're unable to resolve.

• Please read and follow the instructions provided here: I'm infected - What do I do now?
  
• If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
  
• When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.