Debugger 97 detected

[Nottas]

          I was surfing the net and clicked a link and yes wasn't paying attention to the site adviser I had just installed when I got one of those "YOU COMPUTER IS INFECTED" messages and a program installed on my PC. My Mcaffe virus scan caught the Trojan and blocked the program from sending info out. I had a time stopping the program and removing it but I did get the program out. It was called Windows Protector suite. But now everytime I click to run an application I get the Debugger detected(97) error and the application shuts down.
 Anyone ever seen this?
Thanks in advance

[Karnac]

A number of programs coded for older versions of Windows give this error message when they're run on Vista.

 http://www.justanswer.com/questions/z6o5-received-error-debugger-detected#ixzz0PgfabtTx


Try secunia to update your program versions and install patches.

Go to ......

http://www.computerhope.com/forum/index.php/topic,46313.0.html

Follow the instructions and post logs for steps 3,4 and 6.

[Nottas]

Malwarebytes Solved all my Problems!
Sumthin I thought I paid Mcaffy to do but hey as long as its fixed. Thanks for all your the help.

Malwarebytes' Anti-Malware 1.40
Database version: 2720
Windows 6.0.6001 Service Pack 1

8/31/2009 12:40:26 PM
mbam-log-2009-08-31 (12-40-26).txt

Scan type: Full Scan (C:\|)
Objects scanned: 376439
Time elapsed: 1 hour(s), 47 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.pox (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\pofile (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A14A8608-CF1C-4010-A348-7EA220C70305}_is1 (PUP.PerfectOptimizer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AntipPro2009_100 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (C:\Windows\system32\desote.exe "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Nexon\Combat Arms\Game\CShell.dll (Malware.Packer.T) -> Quarantined and deleted successfully.
C:\Program Files\Optimizer Easy\License.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Optimizer Easy\OptimizerEasy.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Optimizer Easy\SERepair.DLL (PUP.PerfectOptimizer) -> Quarantined and deleted successfully.
C:\Program Files\Optimizer Easy\SERes.DLL (PUP.PerfectOptimizer) -> Quarantined and deleted successfully.
C:\Program Files\Optimizer Easy\Update.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Optimizer Easy\UpdateWindows.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Windows\System32\desote.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Windows\System32\bennuar.old (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\sonhelp.htm (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\sysnet.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\ppp3.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\ppp4.dat (Malware.Trace) -> Quarantined and deleted successfully.

[Karnac]

You should run a HJT scan, to be certain, and run it through the process tool.

[smeezekitty]

that was a stupid mistake to worry about debuggers
making it so the program could be unuseable
anyway glad to see you fixed up

[mroilfield]

that was a stupid mistake to worry about debuggers
making it so the program could be unuseable

 

[bugkill33]

Hi Nottas,

I'm glad you were able to solve this problem. I was trying to use MBAM also, but could not figure how to get around the fact that my infected system would not let me run any EXE files. Care to share how you did that?

Thanks,

-BK33

[Wefro_froyas]

You must have the same problem as me but the programs called Windows Police PRo

[Nottas]

Policy pro yup that was the turd that got me.

You have to run ur .exe as admin to get anything to run. just save malware bytes then run the setup as admin. if after install wont launch right click shortcut and run as admin. I plan on following the rest of the steps when I get time to make sure my pc is totally cleared up but so far its working better than before.

[bugkill33]

Thanks for your reply, Nottas    It's scanning now. Hopefully, I can get into Windows normally afterwards without getting a blue screen, I've been working out of safe mode (fingers crossed).

[Slixie]

i can't even get malware to load, i get it loaded get to scanning and then it closes and i can't open it again.

it gives me an error saying "windows cannot access the specified device, path, or file. you may not the appropriate permission to access the item"

yet i run all my programs as admin, because i can't get it running.

[Wefro_froyas]

i can't even get malware to load, i get it loaded get to scanning and then it closes and i can't open it again.

it gives me an error saying "windows cannot access the specified device, path, or file. you may not the appropriate permission to access the item"

yet i run all my programs as admin, because i can't get it running.

We had the same problem I ran Unhackme in safe mode and we got more control over the PC back...

[Slixie]

yeah i even tried running unhackme and i got the same issue. I know windows police pro is the issue i have it, i see it uninstalled, but whatever i do it's not letting me remove it. Does anyone else have any advice or tips?

[bugkill33]

yeah i even tried running unhackme and i got the same issue. I know windows police pro is the issue i have it, i see it uninstalled, but whatever i do it's not letting me remove it. Does anyone else have any advice or tips?

Have you tried Malwarebytes Anti-Malware in Safe Mode? It worked for me so far as apparently detecting and deleting most of the offending files (except for svchasts.exe which I'm sure is a part of the problem). It doesn't seem to be a complete fix because of the files it did not detect and the fact that no amount of restoring will allow me to boot normally into Windows without getting a blue screen. I can now at least run EXE files in Safe Mode for diagnostics and removal tools.