completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have malware

jettmaster · Mar 11, 2009

My computer recently became infected. At first, my taskmanager and regedit were locked. Next, my desktop background was locked. I fixed these problems, but continue to be bombarded with malware in my running processes which regenerate upon rebooting. Eventually, I could not startup Windows. Once the Windows loading page was finished, my computer would restart. I upgraded to XP Pro, can now log on, but still have malware. Please help! Thanks for your time!

jettmaster · Mar 11, 2009

Re: completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have mal

Here is my MGTools.zip log. Thanks in advance for your help. Any addition info needed please let me know. Take care.

TimW · Mar 14, 2009

Re: completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have mal

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!
Click to expand...

IMPORTANT NOTE: Some if not many, of your Windows system files are infected. And many other non-Windows files could also be infected. Even if we attempt to fix these problems (which may not be easy to do unless you have an original Windows XP SP3 bootable CD), your system may be unreliable and untrustworthy.You may need to reinstall this system.
I suggest that you save all of your important files and data to a cd and do a complete format and re-install.

jettmaster · Mar 15, 2009

Re: completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have mal

Hey Tim. Thanks for the response. I knew something was seriously wrong, IEXPLORER.EXE won't go away in my processes. also, svchost.exe very often uses 99% of my CPU usage, i can close it, but it always comes back eventually. I have an original Windows XP Pro SP2 bootable CD, will that help anything? Thanks.

TimW · Mar 17, 2009

Re: completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have mal

Your system is infected with a polymorphic file infector called Virut, Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a clean reformat is the only way to clean the infection and it is the only way to return the machine to its normal working state.

Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (software, .exe files) and screensavers (.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, try to avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too.

Below is an article created specifically for this infection.
http://miekiemoes.blogspot.com/2009/02/vir...s-throwing.html

Log in or Sign up

completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have malware

jettmaster Private E-2

Attached Files:

SASlog.txt

MBlog.txt

CFlog.txt

jettmaster Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jettmaster Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

completed steps in "READ & RUN ME FIRST MALWARE REMOVAL GUIDE" and still have malware

jettmaster Private E-2

Attached Files:

SASlog.txt

MBlog.txt

CFlog.txt

jettmaster Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jettmaster Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches