Malwarebytes FAIL!

[technical.angel]

So, what do you guys do when you go to run MBAM on an infected computer... and it won't start?

Sometimes, I can go in and run it as administrator, and that works, but what do you do when you can't? The people (or, okay, the Angel) want(s) to know!

[LadyMage]

I generally kill it through task manager and run it again. I don't know why but that makes it run like butter.

[SteeleDragon78]

might also try renaming the exe to something else, if a bug knows the exe names for your tools renaming can sneak them in. or run it in safemode or full recovery mode via msconfig running only basic services. if that wont work i break out my kaspersky recovery disk and fight that way.

[MrSmiley]

Generally if there is something loaded that prevents you from running the software you need... then the system is compromised. It's actively fighting you to prevent you from using the tools you need.

My solution is always to fight back and prevent the problem from loading in the first place. Usually for applications, Windows Safe Mode (press F8 just before you see the Windows Logo'ed Startup Screen when you boot your computer) is good enough since it runs with minimal settings (including programs that are configured to startup, either by registry entries, startup menu in the start menu or windows services).

Other times the entire operating system is compromised and can't be trusted to boot in any form. Windows' Recovery Function (booting from the cd/dvd) can sometimes help, other times you need to boot into something different altogether (SystemRescueCD for instance, burn it from a friend's house) and fix the problem there just so that you can trust the environment that you're booting into.

[Eric the Grey]

There is also a UBCD (Ultimate Boot CD) for Windows:

http://www.ubcd4win.com/

You have to build it yourself, with your personal copy of XP, but there are tools on this that you can use to do some scanning. MalwareBytes is not part of the package, but there are a few notables included in the default build.

Edit: It DOES have MalwareBytes available. You need to update and enable it in the plug-ins section and it will copy the current definitions from your local machine (assuming it is installed) or download it.



Eric the Grey

[Geek King]

Just an addendum, but you can also sometimes run mbam.exe from a portable drive in safe mode and get around it. It depends on the bug.

Another tactic is to find a list of known files the virus installs and delete them manually, then run the virus killers. That's how I nailed the last virus that blocked Malwarebytes.

[technical.angel]

There is also a UBCD (Ultimate Boot CD) for Windows:

Thanks, Eric, playing with it now.