Need help with a virus/worm.
- Thread starter Pebkio
- Start date
Recommended Videos
C'mon, do better research - those tasks were already automated a few years ago. You don't need console for that.Tharwen said:
Okay so, time for another story:MRMIdAS2k said:
Once upon a time I decided to listen to people who had no idea how to actually do anything. Several of them gushed about this program... called Malwarebytes. So that's the program I got, installed and used. This program did indeed find a few registry entries and a file that was causing my settings to change back to a weak default, as well as ads to appear in paragraphs. Those are indeed gone (although I had to delete the file, MB wouldn't do it itself). But on this day, it was reinforced that none of you know much about the program you blindly follow. For now popups are severely frequent. After several hours, I found that MalwareBytes was constantly using my CPU to set up it's constant "protection", a good 75% of my CPU... constantly.
It then pretended to close when I told it to, and when I used task manager to end it's drain on my system, it proceeded to crash both task manager and explorer.exe, so I could no longer do anything. After a restart, I told Windows to no longer load it at startup and restarted a second time. Now here's where the twist is, kiddos, because it still has a script hiding in my registry to open anyway, and I still can't end it, because it'll just hose my system again.
Now, here we have everyone's favorite program... and it's WORSE THAN THE VIRUS I NEEDED TO GET RID OF! I'm going to have to hunt this thing like a virus, and it'll probably take safe mode to get it cleared off my system. See, now instead of my story from over five years ago, I now have this one as a good, very good, reason not to trust any programs you barf at me. Thanks. I wish I could've quoted every single one of you so you'd get this as a message. But I just had to choose the most insulting of you.
Interesting.Pebkio said:
Once, after some suspicious alerts and warning i replaced my AV software (it was Avira free) with something more powerful (either RegRun or Nod 32 - i don't remember) and it essentially broke my PC - new AV behaved like The Punisher teleported in the center of warzone. It detected viruses and suspicious behavior practically everywhere and tried to fight with everyone at once.
With not enough system resources, considerably weak processor the software that was supposed to guard my system made it unresponsive. Re-installation was the only solution at this point.
Point is : MalwareBytes shouldn't behave like that - it's quite amiable, solid app.
I suspect that either there's problem with your version of this app (you installed some cracked sh*t, or something that pretends to be MalwareBytes - the Internet is full of such "releases"), OR there's some heavy sh*t hiding in your OS.
I wouldn't blame that application.
Ockham's Razor suggests that it's better to consider your case "special one" than claim that all those happy Malwarebytes users are lying.
I would agree with you, except it's not finding anything. Ever-so-often, maybe every ten minutes, it'll shove out a pop-up saying "blocked suspicious contact with " (I've recorded up to ten so far)... but it won't tell me from where, or even quarantine the offending file/script. I mentioned that I was keeping track... and that's because this best AV program evar doesn't even keep a record of activity it's prevented. How can that be helpful?JesterRaiin said:Ockham's Razor suggests that it's better to consider your case "special one" than claim that all those happy Malwarebytes users are lying.
Incidentally, I did manage to stop the service and found that my settings were being reset again and adchoice ads were everywhere, so at least it's shown to me that whatever is happening, it's happening through streaming internet. But again, I have to point out that it hasn't found a single anything that even might be the cause of this. And why yes, the first thing I found to change was how it was ignoring peer to peer files. My trial leaves me with 12 more days of protection, which I'll just use to stop contact with these 11 (now) different IP addresses. In the meantime, it's set-up for a wiping.
Edit: No wait, I found the logs for the IPs it's been blocking... it was in the program event log with other as-important stuff such as "Program started successfully". So I guess I was wrong, it IS keeping track... kind-of...
PS. I can't hope for Malware Bytes to protect me from something it doesn't recognize, so it's out. My original question from the original post still stands. Does anyone know what file(s) might be causing this? I'm tired of wiping my machine whenever I run into this particular worm.
Easy.Pebkio said:I would agree with you, except it's not finding anything. Ever-so-often, maybe every ten minutes, it'll shove out a pop-up saying "blocked suspicious contact with " (I've recorded up to ten so far)... but it won't tell me from where, or even quarantine the offending file/script. I mentioned that I was keeping track... and that's because this best AV program evar doesn't even keep a record of activity it's prevented. How can that be helpful?JesterRaiin said:Ockham's Razor suggests that it's better to consider your case "special one" than claim that all those happy Malwarebytes users are lying.
You're expecting instant, wondrous solution for the problems created by none other than yourself.
Applications are TOOLS. They can help, but with the exception of very easy cases they won't make the job for you. Your input is still needed.
Let's see...
- Disconnect your machine physically from the Internet. Is there a difference ?
- Download and run <link=http://www.revouninstaller.com/download/revouninstaller.zip>Revo uninstaller and UNINSTALL MalwareBytes properly.
- Provide screenshots from msconfig ("services" and "startup" tabs with "hide all Microsoft services" checked). We shall see if something isn't overlooked.
- Later we'll try CFix and SDF - but first i'd like to see some screenshots.
My former suggestion stands still : consider using Linux in the future - there are numerous versions aka distributions and i'm sure you'll find some that suits your needs.
Just noticed this...xDarc said:
Welp, he has me there, I probably should have done that... well, if I had the money to actually get enough external space to image the harddrive of which I'm already using over 75%. I thought I mentioned I was on a budget of $1.23... if I didn't:
Good point, I would've done that but I'm a budget of $0.24 (I got a soda, and it was tasty).
Oh, did not know that. Now if only I had a pendrive, writeable CD... or even an SD... wait. I do! Wow, 2 gb? Glad I checked, I'm sure a simple version would fit there. I'mma go look into this.JesterRaiin said:
Edit: Oh wait, the download speeds of 10/kb a second... at best...
I hope someone will correct me if I'm wrong, but MMBAM doesn't offer real time protection without you paying for it. Sounds to me like you got an imitation rather than the real programPebkio said:I would agree with you, except it's not finding anything. Ever-so-often, maybe every ten minutes, it'll shove out a pop-up saying "blocked suspicious contact with " (I've recorded up to ten so far)... but it won't tell me from where, or even quarantine the offending file/script. I mentioned that I was keeping track... and that's because this best AV program evar doesn't even keep a record of activity it's prevented. How can that be helpful?JesterRaiin said:Ockham's Razor suggests that it's better to consider your case "special one" than claim that all those happy Malwarebytes users are lying.
What, MB doesn't come with a two-week trial to get you used to the paying service and then yanks it from you? Y'know, like every free AV service does? Also, wow, I got an imitation... from the site malwarebytes.org. That's a pretty spiffy imitation. Is it really on a site with, for example, a lot of numbers in the name? Ironically?MysticToast said:
You know what, screw it. You don't want help or advice if it contradicts with anything you've said in the thread. I was making an observation based on what I know about malware scanning programs and what information you've given us. And no, MBAM doesn't do that, and I haven't seen any AV do that to me. Go be a douche to someone elsePebkio said:
Different distributions, different sizes. <link=http://www.jolicloud.com/jolios/download>JoliOS weighs 700 Mb, <link=http://fedoraproject.org/en/get-fedora>Fedora around 600.Pebkio said:
Actually you could change that attitude a little. People are trying to help you here. It's not nice to treat them with Big Cake o' Irony just like that...Pebkio said:
Fine, I'll try to be nicer. But it IS hard to stay friendly in a thread where most people just insult me and then demand that I use a program that's mainly not fixed anything and caused me problems. And then he assumed I went and got an imitation... as if I downloaded it from rapidshare or something.JesterRaiin said:
It's like the assumption everyone has been making that I don't occasionally look into AV programs. So, okay, hold on...
I'm sorry, MysticToast, for getting angry at you and treating you the way I did. I will make serious, respectful, commentary about what you've just said. As a technicality, what you made was an assumption, not an observation. Maybe, and this is just a suggestion, you could refrain from assuming that anyone would be the type of person who would download the first program on filestube that had Malwarebytes on the name. I'm going to have to disagree with you directly, and I'm sorry for that, but MBAM does indeed offer a trial period of two weeks. Also, there are, in fact, a lot of AV, as well as other, free programs that offer a trial service, including much of NCH software suite and even winrar.MysticToast said:
When people are pissing you off...Pebkio said:
http://www.richard-bell.co.uk/images/poster/dubstep.jpg
You're correct. I did make an assumption. Thank you for showing you have a calmer side, it makes it easier for people to offer advice. Also thank you for correcting me on the trial. I must not have noticed the trial on MBAM because I've just been using it for so long. That's good to know.Pebkio said:
first off, unless you're running a 233 there is no way in hell Malwarebytes is using 75% of your processor.Pebkio said:
second of all, most virus' come with a re-installer, to put back what other programs delete, in this case, scan in safe mode.
thirdly, once you've got your computer clean, possibly after a re-install, try malwarebytes again. it won't act the way you've described, I guarantee it.