Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot Install/uninstall To Remove Virus


  • Please log in to reply
3 replies to this topic

#1 sizzla

sizzla

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:01:02 AM

Posted 14 July 2007 - 06:25 AM

I have a serious problem guys. My Toshiba Tecra A7 laptop has been attacked by malicious popups. The malware replicates a copy of each folder i open. I cannot install superantispyware or any other antivirus because it disables the intallation process as soon as it starts. What can i do?

BC AdBot (Login to Remove)

 


#2 rlprlp

rlprlp

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:02:02 PM

Posted 14 July 2007 - 07:02 AM

Just a shot in the dark to at least give you something to try until you get more experienced help.

Have you tried installing any of the scanners you mentioned while in safe mode?

Do any online scanners work, like BitDefender or Trend Micro?

I'm learning fast, but new. The only other thing that I would know to do would be to post a HJT log for the experts. But I wonder if you can't install that, either.

#3 buddy215

buddy215

  • Moderator
  • 13,196 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:02 PM

Posted 14 July 2007 - 08:28 AM

What are popups advertising?
Are the popups telling you you are infected?
Is it Virusprotectpro--ultimate cleaner, etc.--?

Try to download Hijack This from the link below. Once downloaded, right click on the file and rename it lastchancescan.exe
http://www.bleepingcomputer.com/files/hija...s-installer.php

Post the log in the Hijack This Forum. DO NOT post it in this forum. Forum link below.
http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#4 sizzla

sizzla
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:01:02 AM

Posted 16 July 2007 - 03:41 AM

Actually the pop up is a malicious virus which i beleive was written by some local university students (i live in Kenya). It advertises one of the presidential candidates in the upcoming 2007 election.

It has disabled the Windows Management Instrumentation Service so i cannot install/unistall anything even in safe mode. When i use command prompt attrib i can see an executable called camp.exe in my system32 folder. i did a hijack this log and it showed there is a malicious process called csrss.exe in addition to camp.exe.

When i try to kill the process using APT (Advanced Process Termination) it brings up the BSD (Blue Screen of Death) and shuts down Windows.

Edited by sizzla, 16 July 2007 - 03:45 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users