Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue error screen + random forced reboot


  • Please log in to reply
4 replies to this topic

#1 maksoka

maksoka

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York, NY
  • Local time:07:14 AM

Posted 18 August 2009 - 02:40 PM

Using Windows XP Professional 2002 SP 2

I made the mistake of letting someone else use my PC while I wasn't around to make sure they weren't going to do something unintelligent. Turns out, they clicked a link which forced Adobe Reader to open and install some kind of trojan. I instantly started getting random and fake "anti spyware" popups telling me I needed to buy such and such. I immediately ran malwarebytes, which found about 9 infected files, and deleted them. The popups stopped, but as soon as I rebooted I received a message, after the Windows boot up screen, but before the logon screen, that said wmiprvse.exe was not found, skipping Autocheck. I thought it was odd, but didn't think too much about it.

I noticed after that reboot that instead of the usual 4-5 svchost.exe 's that task manager picks up, I've been seeing between 7 and 8, with one or two running at a particularly high memory usage level. I thought that was odd too, but I wasn't sure what to make of it. Fast forward maybe 6 hours of normal usage, I got a sudden blue error screen for about 2 seconds, I didn't have any time to read what it said, but it forced my computer to reboot. This time, again after Windows boot up, but before the logon screen, I got an error message, but this time it said msln.exe was not found, skipping Autocheck. I've never seen either of these error messages before the virus so it's starting to get worrisome. I own up to date Norton Antivirus 2006, which is not picking up anything, and malwarebyte and adaware which are both up to date, and also not finding any errors.
The computer also will not boot up into safe mode now. I tried booting into safe mode but it simply won't let me, and reboots again when I try to enter in safe mode. I also noticed that after the 2nd reboot, I have about 1 GB EXTRA free space on my main HD now, which was VERY worrisome...but I can't for the life of me find what was deleted.

If anyone's got any ideas, I'd appreciate it much !

Edited by maksoka, 18 August 2009 - 02:42 PM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,546 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:14 AM

Posted 18 August 2009 - 03:37 PM

Worth reading, http://www.istorya.net/forums/software-and...-startup-2.html

I would think it worth a trip to the Am I Infested forum; I will suggest that this thread be moved there.

Louis

#3 Guest_The weatherman_*

Guest_The weatherman_*

  • Guests
  • OFFLINE
  •  

Posted 18 August 2009 - 03:46 PM

Moved from XP to a more appropriate forum. Tw

#4 maksoka

maksoka
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York, NY

Posted 19 August 2009 - 02:19 AM

Ran SUPER AntiSpyware as per the suggestion of a friend :
It picked up 18 infected files /regs that Norton AntiVirus 2006 and Malwarebytes weren't picking up, one of them being listed as a trojan.
It deleted these but could not delete one last infected file listed as adware.
Tried to reboot into safe mode to see if that problem was solved however my computer still will not allow me to boot into safe mode - when I try that option it just forces itself to reboot again and says it has encountered an error, defaulting to the "start windows normally" choice.
On normal boot up, after the Windows screen, I am still receiving the msln.exe not found, skipping Autocheck message.
:thumbsup:

#5 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:07:14 AM

Posted 20 August 2009 - 09:16 PM

Its not unusual to receive such an error after using specialized fix tools.

A "Cannot find...", "Could not run...", "Error loading... or "specific module could not be found" message is usually related to malware that was set to run at startup but has been deleted. Windows is trying to load this file but cannot locate it since the file was mostly likely removed during an anti-virus or anti-malware scan. However, an associated orphaned registry entry remains and is telling Windows to load the file when you boot up. Since the file no longer exists, Windows will display an error message. You need to remove this registry entry so Windows stops searching for the file when it loads.

To resolve this, download Autoruns, search for the related entry and then delete it.

Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click here if you're not sure how to do this.)
Open the folder and double-click on autoruns.exe to launch it.
Please be patient as it scans and populates the entries.
When done scanning, it will say Ready at the bottom.
Scroll through the list and look for a startup entry related to the file(s) msln.exe
Right-click on the entry and choose delete.
Reboot your computer and see if the startup error returns.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users