Windows protection suite help?!?

Question

I realize I just asked this, but I want to rephrase it. Okay so I apparently got Windows Protection Suite on my computer. Well I downloaded Malwarebytes and I have the icon on my desktop, but when I double click it a Security warning from the protection suite that say "Application cannot be executed. The file mbam.exe is infected. Do you want to activate your antivirus software now?" I don't know what to do from that. I was following this websites instructions http://www.bleepingcomputer.com/virus-removal/remove-windows-protection-suite But if I can't even open that I can't follow the instructions. I don't know what to do. The Protection suite keeps popping up and telling me I have viruses when I know I don't... Well maybe now?? I don't know. But I'm not good with computers really, so can you please give me a lot of details?? Please help it is soooo annoying.

Answer 1

start the computer in safe mode with net working.



How to Start Computer in Safe Mode with Networking.

1. During BootUp process Press F8 continuously until selection appears.

2. Use Arrow Up+Down to select SafeMode with Networking on the selections menu.

3. Hit Enter to proceed.



Next run a scan with malwarebytes .

http://www.malwarebytes.org/



you can get malwarebytes here,

this is a direct download link

so you should have no trouble getting it.

click on this link ↓ and then select run.

http://www.malwarebytes.org/affiliates/2-spyware/mbam-setup.exe

INSTALL IT TO YOUR DESKTOP, update it,

then run a full scan and remove everything it finds.



some viruses will try to disable it

so if malwarebytes will not start up/install

save it to your desktop,

before you save Malwarebytes', rename it to something like XXXX.exe and then click on Save and save it to your desktop. Same thing after you install it. Before running it, rename the main executable file first



if it still will not install,

Right-click on the mbam-setup.exe file and change the .exe extension to .bat, .com, .pif, or .scr and then double-click on it to run.



If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files, right-click on mbam.exe and change the .exe as noted above. Then double-click on it to run..



after you have used malwarebytes then do this online scan.

to make sure you have nothing else hiding away.

http://www.eset.com/onlinescan/

preferably in safe mode with networking.







☼good luck.

Answer 2

2

Answer 3

Try starting task manager (CTRL + SHIFT+ESC ) Right after boot, then start a new task from it and enter full path to malwarebytes executable.

You can try killing these infected processes as well :

WI345d.exe

CLSV.exe

snl2w.exe

std.exe

WindowsProtectionSuite.exe

WI345d.exe

ppal.exe

are typical processes Windows protection suite uses

Answer 4

Locate and remove these files.



c:\ADWARE_LOG



c:\Documents and Settings\All Users\Application Data\345d567



c:\Documents and Settings\All Users\Application Data\345d567\285.mof



c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll



c:\Documents and Settings\All Users\Application

Data\345d567\sqlite3.dll





c:\Documents and Settings\All Users\Application

Data\345d567\WI345d.exe



c:\Documents and Settings\All Users\Application Data\345d567\WINPS.ico



c:\Documents and Settings\All Users\Application Data\345d567\working.log



c:\Documents and Settings\All Users\Application Data\345d567\WINSPSys



c:\Documents and Settings\All Users\Application Data\345d567\WINSPSys\vd952342.bd



c:\Documents and Settings\All Users\Application Data\WINSPSys



c:\Documents and Settings\All Users\Application Data\WINSPSys\winps.cfg



%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Protection Suite.lnk



%UserProfile%\Application Data\Windows Protection Suite



%UserProfile%\Application Data\Windows Protection Suite\cookies.sqlite



%UserProfile%\Application Data\Windows Protection Suite\Instructions.ini



%UserProfile%\Desktop\Windows Protection Suite.lnk



%UserProfile%\Recent\cb.sys



%UserProfile%\Recent\cid.dll



%UserProfile%\Recent\cid.tmp



%UserProfile%\Recent\CLSV.dll



%UserProfile%\Recent\CLSV.tmp



%UserProfile%\Recent\DBOLE.sys



%UserProfile%\Recent\ddv.dll



%UserProfile%\Recent\eb.sys



%UserProfile%\Recent\eb.tmp



%UserProfile%\Recent\energy.drv



%UserProfile%\Recent\energy.sys



%UserProfile%\Recent\exec.tmp



%UserProfile%\Recent\kernel32.drv



%UserProfile%\Recent\PE.drv



%UserProfile%\Recent\PE.tmp



%UserProfile%\Recent\ppal.exe



%UserProfile%\Recent\runddlkey.drv



%UserProfile%\Recent\snl2w.sys



%UserProfile%\Recent\tempdoc.dll



%UserProfile%\Start Menu\Windows Protection Suite.lnk



%UserProfile%\Start Menu\Programs\Windows Protection Suite.lnk



c:\Program Files\Mozilla Firefox\searchplugins\search.xml







Now try putting your computer in Safe Mode and running a scan with Malwarebytes.

Answer 5

soz im a wee bit tired but i simi scanned over ur topic and it sounds like you have scareware. restart your comp in safe mode then download this: http://www.2-spyware.com/remove-windows-protection-suite.html to remove it