Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


multiple infection

  • Please log in to reply
No replies to this topic

#1 mark wagner

mark wagner

  • Members
  • 1 posts
  • Local time:01:22 AM

Posted 08 January 2010 - 08:07 PM

xp pro
how it happened: got bumped to a bad site and avast fired off about 20 warnings.

got internet security 2010 bug at least, and I think some kind of rootkit. Avast wouldn't spot it. It disabled task manager, cmd, media player and completely uninstalled the system restore feature (along with deleting all of my restore points). I know the file smss32.exe was involved. It installed several startup processes that would regenerate, etc etc.

I received some help from another board (that shall remain nameless) which helped, but they have left me high and dry. It looks like you guys are a little more responsive.

they had me run combofix, which appeared to remove the rootkit. renamed a couple of dll's, and combofix removed the orphan registry entries. ran spybot to remove some lingering malware and avast found a few bugs.

Avast fired off another warning today, so I suspect that I still have some infection. 2010 bug is gone. Computer is running fine, but slow at startup. I noticed a directory named c:\cmdcons that doesn't belong there. directory was created on the date of infection. can't delete this file with explorer or at cmd. nothing in startup that appears out of the ordinary. a few running processes look "new and different" but it's hard to tell.

would like a fresh set of eyes to take a look and see if anything is amiss and help me get rid it. and that directory. I suspect it's filled with bad stuff.

There are also some infected files that avast locates in the system volume information directory. probably restore files. avast can't delete them. any help here is appreciated as well.


Edited by mark wagner, 08 January 2010 - 08:13 PM.

BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users