Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Removed Nemucod, IE starts @ boot, right click is hijacked

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Removed Nemucod, IE starts @ boot, right click is hijacked

Unread postby clgunz » November 10th, 2016, 1:37 am

hello, all
i have a problem with a user who recently was infected with nemucod. i have run many anti (everything) and the system comes up clean. the problems are that when the computer starts IE also starts, and equally troublesome is that when i right click any application or file i get an termination message from hitman pro stating that it has terminated explorer 6.1 to stop it from doing something malicious.


here is the path it seems intent on getting at:
\\"server"\"serverdata"\virtualclonedrive\elbyvcdshell.dll

it give this process trace:
1 c:\windows\explorer.exe (4364)
explorer.exe
2 c:\windows\system32\winlogon.exe (4284)
winlogon.exe
3 c:\windows\system32\smss.exe (896)
\systemroot\system32\smss.exe 00000000 00000048


i can only think of wiping the system. any help would be appreciated.
clgunz
Active Member
 
Posts: 1
Joined: November 10th, 2016, 1:22 am
Advertisement
Register to Remove

Re: Removed Nemucod, IE starts @ boot, right click is hijack

Unread postby pgmigg » November 11th, 2016, 12:23 am

By posting just a description of your problems it is likely that your topic will be passed by and you will not receive the help you're looking for.

We need to know what's running on your computer so we can give you appropriate instructions.

May I draw your attention to THIS topic, which you should have read, and which tells you what we need you to post so that we can help you.

This topic will now be closed.

If you still need help, please start a new thread with:
  • FRST.txt
  • Addition.txt
  • Details of your problems.

If for any reason you can't run FRST, please let us know in your post.
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5457
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 138 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware