Tech Tip of the Day: How to download and run Chameleon by Malwarebytes

** THIS POST HAS BEEN UPDATED **

Malwarebytes Chameleon is a tool that was developed in order to get Malwarebytes Anti-Malware running when blocked by an active infection on a user's system.

It accomplishes this in several ways, but in order to run, Chameleon itself must be able to run in spite of the infection as well.  That's where the filenames come in and is the reason you'll find files like 'svchost.exe', 'winlogon.exe' and 'iexplore.exe' among others within the Chameleon folder.  Those are actually just renamed copies of the main Chameleon executable, mbam-chameleon.exe.  The reason that we do this is because infections, particularly rogue/fake antivirus programs, will often block processes from launching simply based on their file or process names, or they will only allow certain 'whitelisted' processes to run.  These whitelisted processes are often a user's internet browser (hence the use of names like 'firefox.exe' and 'iexplore.exe') or critical system processes (hence 'svchost.exe', 'winlogon.exe' and 'rundll32.exe').

There are several methods for launching Chameleon itself, depending on the situation that the user is dealing with.  Malwarebytes provides a help file called 'chameleon.chm' which is accessible via the START menu under All Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk'.  This is the best and simplest way to use Chameleon as all the user has to do is open the help file and follow the instructions.

Unfortunately, launching the help file is not always possible, so Malwarebytes does provide other methods to get Chameleon running.
 
If Malwarebytes Anti-Malware is already installed but the Chameleon help file will not open, the user may attempt to launch the Chameleon executables manually by browsing to their Malwarebytes Anti-Malware program folder under 'Chameleon' and double-clicking on the executables located there one by one until they find one which is able to launch which will be indicated by a command prompt window providing instructions on what to do next to run Chameleon.

Once Chameleon is up and running, it will attempt to update Malwarebytes Anti--Malware's database, kill all malicious processes running in memory, and then initiate a scan with Malwarebytes Anti-Malware.  Upon completion of the scan, the user may remove the infections from their system, rebooting if required, and their system should be running normally again, free of infection.

If Windows Explorer is not running, the same method can be used to launch the help file or executables by using Windows Task Manager and simply browsing to the location of the files and trying to open them one by one that way.

Now, if Malwarebytes Anti-Malware is not already installed, Chameleon can get it installed for the user.  Malwarebytes has provided Chameleon as a separate download available here on their website: http://www.malwarebytes.org/products/chameleon

All the user needs to do is download that file, extract it to a new folder in a convenient location such as their desktop, and then attempt to use the included help file (Chameleon.chm) to run Chameleon.  If the help file will not open, then the user should proceed with the same method applied above by double-clicking on each of the provided Chameleon executables one by one until they find one that opens.

Upon opening, the user should follow the onscreen instructions and Chameleon will proceed to download and install Malwarebytes Anti-Malware for the user and then will proceed to run through the same process as described above (updating the database, killing malicious processes and performing a scan).

*All information provided by Samuel E. Lindsey of Malwarebytes Corporation

Tech Tip of the Day: How to download and use Malwarebytes

Malware is shorthand for "malicious software" and is used to describe an entire group of programs that includes advertising, tracking, key-logging, ID or credit theft or that cause other bad or undesirable activity. Malwarebytes specializes in fighting malware.

(including Free, Trial, or Retail versions)

1. Go to www.malwarebytes.org. Follow the download link to download.cnet.com and click on "Download Now" icon (not the "Start Download" buttons - which link to other stuff.) Alternatively, purchase a full version of Malwarebytes in the software aisle or Service Department at Micro Center. The full version includes a LIFETIME subscription and active background monitoring.
   

2. Run Malwarebytes Installer. If installer does not work, there may be a virus present which is interfering. In that case, complete the following, but after restarting the system in "Safe Mode with Networking"
   To start windows in Safe Mode, do the following.
   1. Tell windows to Shut Down (not sleep or hibernate).
   2. Press power button
   3. Continually tap F8 until the Windows Start Menu appears (black screen with white text).
   4. Use Up/Down arrow keys to select "Safe Mode with Networking", press enter
3. Make sure there is an active internet connection.
4. Start Malwarebytes by double clicking the icon on the desktop or from the Start, Programs list.
5. Click on Update tab. Click on "Check for Updates" button. Malwarebytes will search for updates, download and install them.

If you have a network connection during the installation, Malwarebytes should update automatically, otherwise, check for updates before starting a scan.

6. Click on the "Scanner" tab. Select "Perform full scan" (this takes the most time, but is recommended for the first time scan on an infected system), or "Perform quick scan". Click on the "Scan" button to start.

A Full Scan can take anywhere from 10 min. to 2 hrs. Malwarebytes will highlight in red details of infected files found.

7. When scan finishes, click "Show Results" button. A list of viruses, security issues, or any malware found will appear.
8. If the items are not selected, do so, and then click "Remove Selected" button. The malicious files or registry issues will be removed.
9. Restart the computer in normal windows mode. If Malwarebytes detected and removed threats in Safe Mode, it is recommended to repeat the scan process in normal mode to look for additional threats.

For more assistance contact Technical Support here.

Virus ALERT: Palladium Pro and System Tool

The "Palladium Pro" and "System Tool" are the latest versions of more fake anti-virus programs similar to  "Security Tool". Both programs pretend to operate as a virus scan, but in effect, install a computer virus which takes over your system’s processes.

Palladium Pro Program

The Palladium Pro virus works by launching a bogus Microsoft Security Essentials alerts and stating that the system requires a virus scan. Once the virus scan is initiated, Palladium Pro installs the malware onto your system. To remove the Palladium virus, you will need to terminate the application’s process and install Malwarebytes to remove the program.

To Remove Palladium Pro:

1. Start the Windows Task Manager by clicking Ctrl, Alt, Delete together.
   
   
   
   
   
2. Click on the Processes tab.
3. Locate the Palladium program named “palladium.exe”.
4. Select the palladium.exe process and click End Process. This will suspend the Palladium Pro software.
5. In the Windows Task Manager, go to File » New Task.
6. Type in “explorer.exe” in the Open field, then click OK. This will open your Windows desktop.
7. Download a copy of Malwarebytes software here » http://www.malwarebytes.org
   
   
   
   
   
   
8. Follow the instructions to run a system scan and file removal.

System Tools Program

The System Tools program is associated with the same family of fake anti-virus programs as Security Tool. This software floods the system with false virus alerts and instructs the user to run the virus scan.

To Remove System Tools:

1. Start the Windows Task Manager by clicking Ctrl, Alt, Delete together.
2. Click on the Processes tab.
3. Locate the program file. It is usually represented by a set of random characters followed by the ".exe" extension.
4. Download a copy of Malwarebytes software here »http://www.malwarebytes.org
   If your computer prevents you from downloading the file, you can download Malwarebytes from another system and copy the file to your infected system to install. Or, you will need to update the Internet Options in Internet Explorer by modifying the default LAN settings to NOT use a proxy server for your LAN settings.
5. Follow the instructions given by Malwarebytes to run a system scan and file removal.

IMPORTANT: Never install any program or run a virus scan without verifying the source. If you suspect that your system is infected, use industry-approved programs such as ESET, McAfee, Symantec or Webroot. If you need further assistance, contact Micro Center Tech Support at www.mctsol.com.


Reference:
Bleepingcomputer.com. Palladium Pro Removal
http://www.bleepingcomputer.com/virus-removal/remove-palladium-pro

Bleepingcomputer.com. System Tool Removal
http://www.bleepingcomputer.com/virus-removal/remove-system-tool

Microsoft Support Forum. Palladium Removal.
http://social.answers.microsoft.com/Forums/en/msescan/thread/6e837554-4374-4709-8e51-e878ac8817e1

Microsoft Support. Microsoft Windows Malicious Software Removal Tool.
http://support.microsoft.com/kb/890830

Virus ALERT: Security Shield

There is another rogue anti-virus program called "Security Shield" that infects computers by using bogus security warnings in lure users into downloading the malware. This virus is one of a suite of known malware programs by Virus Doctor. Security Shield or any other Virus Doctor freeware can cause a variety of issues including blocking the system’s ability to connect to the Internet and slow down other system processes.

Security Shield Program

Only use established anti-virus program manufacturers to scan and remove malware from any computer. ESET NOD32, Symantec Norton Anti-Virus, McAfee Anti-Virus and Webroot are all industry-approved programs that will monitor and remove viruses from your system.

If your system is infected with the Security Shield virus, there are solutions available from Symantec and Malwarebytes.

For Symantec:
1. Download the latest Rapid Release definitions.
2. Reboot the system in Safe Mode.
3. Run Disk-Cleanup to remove temporary files.
4. Perform full system scan. Follow the instructions to remove any detected threats.

Click here for more information on the Symantec solution »


For Malwarebytes:
1. Download Malwarebytes program here.
2. Install the program "mbam-setup.exe".
3. Use the default settings during the setup process. Check "Update Malwarebytes" and "Launch Malwarebytes".
4. Once installation is complete, begin scanning the system.
5. When scanning is complete, review the Scanner report. Check any files that are marked at malware and click "Remove Selected".

Malwarebytes Site

Click here for more information on the Malwarebytes solution »

Reference:
BleepingComputer.com. Remove Virus Doctor.
http://bit.ly/fCmYTG

Malwarebytes.
http://www.malwarebytes.org/

Symantec. Security Forum.
http://bit.ly/fQD3LU