The current theory is that they are getting in via flash ads in banners.
- Use MalwareBytes AntiMalware
- VundoFix
- SmitFraudFix (CLI utility)
- ComboFix (CLI utility)
- Avira RescueCD
Maybe TDSS is blocking MalwareBytes?
There has been a rash of the TDSS malware that might be the culprit of not being able to install or run MBAM.
If it is then this solution below might help. If it does then start in Normal Windows mode and try to update MBAM and do a scan.
Then follow the directions above and post the requested information.
- Click on Start, click Run, and then type devmgmt.msc and click OK
- On the View menu click on Show hidden devices
- Browse to Non-Plug and Play Drivers and you should see something like TDSSserv.sys
- Highlight that driver and right click on it and select DISABLE
- Now RESTART your computer.
- Download a copy of Malwarebytes but DO NOT run it yet.
- Rename the downloaded installer file to any generic name such as your own name but keep the .EXE extension on the file and run it.
- Once the program is installed go to the UPDATE tab and try to update the program if you can.
- Then go to the SCANNER tab and run a Quick Scan and allow MBAM to fix anything found.
When I went through this process I got an error on reboot about checking consistency on drives. When windows came up it gave the "recovered from a serious error" message. However, the renamed Malware Bytes executable did install. Was able to run an update and do a scan and all was good.
Use this process at your own risk.
You may also have to do the following if you cannot see TDSSserv.sys:
- Open a command prompt.
- Run this: "set devmgr_show_nonpresent_
devices=1" - Run "start devmgmt.msc"
- View menu... Show non-plug and play drivers
- Kill TDSSsrv.sys (fully uninstall from Device Manager)
- Wash, rinse, but hopefully no need to repeat.
Other Ways to get MalwareBytes to install
Install Malwarebytes in Safe Mode with Networking
If it won't run after being installed
I would also add the recommendation to rename the mbam.exe file before executing it. rename it to whatever , I use remove.exe. Keep in mind that uninstalling MWB after may not remove all files from the machine.
If the the install process stops and does not finish try killing the processes mbam.exe from task manager (i.e. you didn't rename the mbam.exe file). This often allows the install to complete and lets you rename the mbam.exe and run your newly renamed executable.
On a side note, when MBAM fails (often due to other infections not found, you will likely find Superantispyware the soolution to your problems.
