Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Having virus problems. Possible malware?

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Having virus problems. Possible malware?

Unread postby Lothar » December 31st, 2009, 1:52 am

Hello. Mothers laptop is going nuts.

Dell Inspiron 1525
Windows XP Service pack 3

I noticed the problems this morning. Internet explorer would not pull up any webpages even though I had a good connection via ethernet cable (tested by successfully pinging yahoo.com through the CMD prompt).

Tried to run the installed anti-virus program Norton Internet Security. (Not sure what version. I'll try to find out). The program repeatedly failed to launch.

Rebooted labtop. Microsoft Application Error Reporting window pops up. Lists a program called 'Google Installer'. Also upon every reboot there is a Windows Genuine Advantage window. I cancel both.

Try to run internet explorer, norton, etc. System freezes.

Reboot, but no Windows. Just a black screen with mouse pointer stuck in the middle.

Reboot in safe mode.

So I do some Googling with a working computer and copy SpyBot and Malwarebytes anti-malware to a disc to use on the laptop. After installation both programs fail to launch.

I change the names of the .exe files of said programs and they finally launch. Both programs find problems which I delete.

Reboot normally into windows and it works. But still freezes up if I try to run any anti-malware/virus programs, which now run but freeze in the middle of their searches.

So it seems I have cleared some of the syptoms but haven't killed the bug yet. Any suggestions?

Here is the log from the Malwarebytes anti-malware program:

Malwarebytes' Anti-Malware 1.43
Database version: 3460
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

12/30/2009 7:56:59 PM
mbam-log-2009-12-30 (19-56-59).txt

Scan type: Full Scan (C:\|)
Objects scanned: 184370
Time elapsed: 18 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\settdebugx.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23094848483939484 (Rogue.GreenAV) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\21098746521098765 (Rogue.GreenAV) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Marilyn\Local Settings\Temp\settdebugx.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\BASH\Clone\BHCD9C.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\BASH\Clone\BHCD9D.tmp (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\BASH\Clone\BHCD9E.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\krl32mainweq.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Active Member
Posts: 11
Joined: December 31st, 2009, 1:05 am
Register to Remove

Re: Having virus problems. Possible malware?

Unread postby NonSuch » December 31st, 2009, 8:33 pm

We understand that you are having difficulty running certain programs, and that may include HijackThis. However, in order for us to help you it is necessary that you provide us with a HijackThis log, and it is possible you may be able to trick the malware into letting you do this. First, download HijackThis to a clean computer, then rename it from HijackThis.exe to any other name you want, using an .exe extension, for example... YourLastName.exe. Once you have done that, burn it to a CD (preferable to using a flash drive that may easily become infected) then transfer the renamed file to the infected computer and run a scan, then start a new topic and include your HijackThis log.

Please follow the guideline at the link below to start a new topic and post your HijackThis log, along with your Malwarebytes Anti-Malware log all in the same post. If you are unable to create and post a HijackThis log, then your only option may be to reformat your computer and reinstall the operating system. Please be aware, however, that a reformat is probably your best option as your system is infected with a particularly pernicious rootkit.

This topic is now closed. Please start a new topic by following the HijackThis Guideline posted here, just be certain you rename HijackThis: >Guideline for posting your HijackThis log<
User avatar
Posts: 27576
Joined: February 23rd, 2005, 7:08 am
Location: California

  • Similar Topics
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!

Who is online

Users browsing this forum: No registered users and 63 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware