Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I can't get rid of this thing


  • Please log in to reply
3 replies to this topic

#1 Cojirou

Cojirou

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:03 AM

Posted 16 January 2009 - 04:11 PM

Hi! I've recently had some problems with my computer. It's been running fine for years, but it was recently infected with trojans (Popups and restarting of the computer and such) and now I can't get rid of them. My antivirus programs no longer recognize them, so there's no way for me to get rid of them.

I found pcload.dll and frmwrk32.dll in my system32 folder. I deleted those, but the problem keeps coming back. I was browsing this site for information and these two threads described my problem almost exactly:
http://www.bleepingcomputer.com/forums/lof...hp/t187763.html
http://www.bleepingcomputer.com/forums/t/128698/infected-with-repeated-occurance-of-virtumonde/

I get messages at the top of my browser window saying things like "Too many errors and faults WERE found in your system. Possibly that IT WAS THE RESULT of virus attack.YOU MUST scan your system." Sometimes the whole browser page goes blank and shows the text, "ERROR! Connection was RESET by remote server.

This can be a reason for system faults, errors or critical data corruption. To prevent your critical data loss please do the full system scaning!"

A new message:
"Page cannot be displayed


Possible problems:

* No connection with Internet.
* Some problems with server.
* Your computer is being attacked by a virus.


Please scan your system:

Conection problems diagnostics."

Problem is, I can't get ComboFix or Malwarebytes to run at all. I get lots of error messages saying "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." (I managed to at least install the Malwarebytes program but it won't open or run correctly)

I'm on an administrator account, running Windows XP and Firefox if that helps at all. Please help me!

Also, I read a thread about "mscvhost.exe" or something like that. It looks familiar; I think it's been running in my task manager. Is it something to be worried about?

Edited by Cojirou, 16 January 2009 - 05:01 PM.


BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,314 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:06:03 AM

Posted 16 January 2009 - 06:02 PM

Try running MBAM in safe mode. If you were unable to install MBAM after downloading it, find the MBAM.exe and rename it.
Rename by right clicking on the .exe and choose rename. Name it something like sam.com and then click on it to install before rebooting into safe mode to run the scan.
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 Cojirou

Cojirou
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:03 AM

Posted 17 January 2009 - 05:49 PM

Okay, I was able to run MBAM after renaming it. It did a scan and found 46 infections. It gave me a message that said something about deleting some infections upon restart, so I restarted my computer.

Now I can't log on. It will start to log onto my account on the computer, but it will immediately sign off. (I'm using another computer to type this message) I can't even log in while using Safe Mode. Is there anything I can do? Help!

Edited by Cojirou, 17 January 2009 - 05:49 PM.


#4 buddy215

buddy215

  • Moderator
  • 13,314 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:06:03 AM

Posted 17 January 2009 - 06:10 PM

If you can't boot up I am afraid there is not much I can do for you.
Depending on your skill level, there are options other than wiping the hd, reformatting and reinstalling.
You could slave your infected HD to another computer and scan and remove the malware. You could put your infected HD in a cage and scan it with your computer that you have installed a new HD and OS on.
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users