System Security Virus - How to Copy Hijack this Log File

**cavengers** · **cavengers** on 18th July 2009, 12:08 am

I have the system security virius. I have run the hijack this and cannot copy the log files for posting. Thanks for the help.

**Origin** · **Origin** on 18th July 2009, 12:09 am

Hello, can you rename HijackThis to winlogon.exe and see if you can copy it here.

**cavengers** · **cavengers** on 18th July 2009, 12:15 am

that didn't help - the "notepad" file blinks for a second and then disappears

**Origin** · **Origin** on 18th July 2009, 12:20 am

Can you try opening it in wordpad? Right click on the text file-->Click on Open with-->Word pad, if its not once of the options select browse and find wordpad.

**cavengers** · **cavengers** on 18th July 2009, 12:23 am

That doesn't either - it just pops up for a second and disappears

**Origin** · **Origin** on 18th July 2009, 12:25 am

I see, please do the following:

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

**cavengers** · **cavengers** on 18th July 2009, 12:34 am

No luck - it will not even open when I click on it

**Origin** · **Origin** on 18th July 2009, 12:43 am

I see, rename Malwarebytes to winlogon.exe and see if it runs now.

**cavengers** · **cavengers** on 18th July 2009, 12:49 am

I know I begining to sound like a broken record, but no luck with that either

**Origin** · **Origin** on 18th July 2009, 12:54 am

Ok please do the following:

Please download Ice Sword from HERE

Download the zip to your desktop and extract it.
Open the Ice Sword folder and then launch IceSword.exe.
Then look in the left hand bottom of the program and press "Registry"
When the registry list opens, drag the line between the two windows so you can see which registry hive you need.
Next, open the HKEY_LOCAL_MACHINE, and navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Now look in the right side pane for two run values that are just random numbers.
Once you have found the value(s), right click it and press "Delete"
Okay the prompt and close IceSword.