Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

unknown malware


  • Please log in to reply
1 reply to this topic

#1 Urnsbay

Urnsbay

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 26 February 2010 - 10:09 PM

This is a friend's computer. He has already run many progs to try to fix - Malwarebytes, Adaware, Spybot Search & Destroy and others I believe, none of which have found the culprit. It apparently is progressively getting worse, as now we are unable to run almost anything. Most programs come up with the message "Application cannot be executed. The file xxx.exe is infected. Do you want to activate your antivirus software now?"

He has McAfee installed - however I just found out that it has not been updated in many months, and obviously we cannot do so now. I do not have his laptop online, I'm working from mine and using thumbdrives to move things back and forth.

Habit of the intruder: System loads normally to desktop, though very slow. Eventually on the taskbar an icon will appear that is the same shape as the Windows shield, however it is green. The label that appears upon hover is Antivirus Soft.

Soon a window will appear titled "Windows Security Center." It's the standard Windows options about firewall, automatic updates, etc. I either close it or ignore it.

I tried to follow your directions, by first running the defogger.exe file to disable cd emulators (I have no idea it he has any or not), however I got that same message of it being infected so I could not run it.

I was able to run Hijack THis earlier, and can send that logfile if it is of any use.

Thanks for your help.

More info:
This system is running XP Professional, service pack 3. It is a Dell Latitude, D620, 1.66Hz, 1 Gb of Ram.

I am able to go into Safe Mode and run programs. I was able to run defogger successfully. However I was not able to run the dds - it seemed to run but never did pop up any of the windows as described in your article.

If in normal mode, if I let the system just sit for a while, it will open IE attempting to go online to web pages such as adult.com. After a while it will open another tab and attempt to access another similar web site.

I am a retired software consultant - malware was one of my specialties. Normally my last resort would have been Hijack This, but this time it found nothing of interest, so I am quite stumped.

More info... the following site appears to match my situation:

http://www.bleepingcomputer.com/virus-remo...system-security

However, when I try to run the first program they recommend, Process Explorer, and then rename it as they suggest to explorer.exe, it will not work. I get the usual message of the file being infected, but then I also get a message stating that "The specified path does not exist. Check the path, and then try again." It does this whether I run it from the desktop or from my flash drive.

Edited by Urnsbay, 27 February 2010 - 02:12 PM.
Move to AII. ~ OB


BC AdBot (Login to Remove)

 


#2 Casey_boy

Casey_boy

    Bleeping physicist


  • Malware Response Team
  • 7,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:12:02 AM

Posted 03 March 2010 - 08:25 AM

Hi,

Sorry for the delay in responding to your post.

With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!

Casey

If I have been helping you and I do not reply within 48hours, feel free to send me a PM.


* My Website * Am I Infected? * Malware Removal Help * If you'd like to say thanks *





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users