50 replies to this topic

[kptcomp]

Good Morning,

I am using MBAM to try and disinfect a computer and keep getting the error Run-time error "7": Out of memory (in normal and safe mode). The computer is running Windows XP Home with 256MB of RAM. Any suggestions on where to check?

Thanks!

[RubbeR DuckY]

When does this error occur?

[kptcomp]

RubbeR DuckY, on Aug 7 2008, 04:13 PM, said:

When does this error occur?

It happens after the scan while it is removing the problems. I noted that it was happening every time it tried to quarantine the same file.

I manually deleted the file before the next scan and that solved the problem.

The file was a .log file generated by one of the Rouge spyware apps.

Cheers!

[RubbeR DuckY]

Can you recall how large the file was?

[kptcomp]

RubbeR DuckY, on Aug 7 2008, 06:12 PM, said:

Can you recall how large the file was?

Unfortunately no. I will make a point to note it the next time.

[flamewalker]

I had this same issue a while back... the file was over 500mb uncompressed... it was a hacked software partially downloaded on a customer pc I was working on.

Rubber Ducky, have you had any time to fix that problem yet?

[RubbeR DuckY]

Yes, it has been fixed in the 1.25 release. This should be out in a few days.

[sandman512]

RubbeR DuckY, on Aug 11 2008, 09:08 PM, said:

Yes, it has been fixed in the 1.25 release. This should be out in a few days.

Hi,

Just came across this forum and have encountered the same problem as the OP. Any help would be appreciated. Here is the MBAM log. THANKS!
Malwarebytes' Anti-Malware 1.24
Database version: 1056
Windows 5.1.2600 Service Pack 2

8:40:08 PM 8/15/2008
mbam-log-8-15-2008 (20-39-58).txt

Scan type: Quick Scan
Objects scanned: 44070
Time elapsed: 9 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTBOOT (Backdoor.Bot) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\system\DRIVER (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\DAP (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\DAP\LOG (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\DAP\NTLOG (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\system\DRIVER\cygcrypt-0.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Bewitched.2005.DVDRip.XviD-ALLiANCE.tar (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\cygwin1.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Driver32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\New Text Document (13).txt (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\New Text Document (2).txt (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\ntauth.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Rebound.2005.DVDSCR.XviD-DiAMOND.tar (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Saw.2.TS.SVCD-WUF.tar (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\schost.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\servicelogon.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\servicesmgr.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\Stay.CAM.SVCD-RIDERz.tar (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\svchostlogon.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\tar.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\v (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\win32.dll~ (Trojan.Agent) -> No action taken.
C:\WINDOWS\system\DRIVER\winlogon.dll (Trojan.Agent) -> No action taken.

[RubbeR DuckY]

One of the files is way to large. This will be fixed in the next program version. For now, delete the entire C:\WINDOWS\system\DRIVER folder by hand.

[sandman512]

RubbeR DuckY, on Aug 16 2008, 01:40 AM, said:

One of the files is way to large. This will be fixed in the next program version. For now, delete the entire C:\WINDOWS\system\DRIVER folder by hand.

Thanks for the reply. I don't want to screw up anything else, I think I know how to do this, BUT would you mind walking me through it? THANKS!

[RubbeR DuckY]

Please click the start menu. Next, click on the Run button. Copy and paste the following in.

del C:\WINDOWS\system\DRIVER\*.*

Click OK. Now, run Malwarebytes' Anti-Malware and remove everything it finds. Let me know how it goes.

[dank]

RubbeR DuckY, on Aug 16 2008, 09:25 PM, said:

Please click the start menu. Next, click on the Run button. Copy and paste the following in.

del C:\WINDOWS\system\DRIVER\*.*

Click OK. Now, run Malwarebytes' Anti-Malware and remove everything it finds. Let me know how it goes.

So I have been using your software and have fixed multiple pc`s in the last wek. But this last one I was just at had 4600 infected files in the fonts folder alone. A lot of hkey etc... 5600 and change altogether. When trying to remove them I get a similar error but I think it say run time error 6 instead of 7. Should I tell the owner of the pc to delete the entire fonts folder in C windows and then run the scan? Or will the new release of malwarebytes be able to handle the huge number of infected files that this pc has?

The pc was redirecting to pages, slow etc....

[RubbeR DuckY]

Yes, it will be able to delete the files. However, it is not the fonts folder, it is a subfolder

C:\Windows\Fonts\'

Notice the apostrophe folder. That is what is holding all of the malicious files.

[dank]

RubbeR DuckY, on Aug 16 2008, 11:04 PM, said:

Yes, it will be able to delete the files. However, it is not the fonts folder, it is a subfolder

C:\Windows\Fonts\'

Notice the apostrophe folder. That is what is holding all of the malicious files.

Is this what I put in the start/run before I click ok?
del C:\WINDOWS\Fonts\'

[dank]

dank, on Aug 16 2008, 11:08 PM, said:

Is this what I put in the start/run before I click ok?
del C:\WINDOWS\Fonts\'

When I put this in the run all i get when i click ok is a warning that it cant find that file.

[RubbeR DuckY]

No, this is the command.

del C:\WINDOWS\Fonts\'\*.*

[dank]

RubbeR DuckY, on Aug 17 2008, 12:32 AM, said:

No, this is the command.

del C:\WINDOWS\Fonts\'\*.*

The pc with the problems says - cannot find del
when we run that command

[dank]

dank, on Aug 16 2008, 11:37 PM, said:

The pc with the problems says - cannot find del
when we run that command

Can I just manually go into the C://WINDOWS/Fonts folder and delete the whole folder and then run malwarebytes?

[RubbeR DuckY]

You will not see the folder, it is hidden from explorer.

[dank]

dank, on Aug 16 2008, 11:44 PM, said:

Can I just manually go into the C://WINDOWS/Fonts folder and delete the whole folder and then run malwarebytes?

I tried that command on my pc for hell of it, minus the del and it cant find that file on my pc says it may have been moved. But i have no infected files.