PCEU virus 1

[audiopro]

I have an XP box infected with the PCEU trojan virus.
A normal boot results in a screen threatening all kinds of stuff if I don't pay - blaa blaa and a locked up machine.
Safe mode boots the same as does safe mode with network support.
Safe mode with command prompt lets me in and I can run regedit from the command prompt.
Google advice points to registry entry WINLOGON and tells me to delete value and insert explorer.exe.
explorer.exe is already the value - what to do now be the cry.
Machine will not boot from Flash Drive - I think that is the age of the machine.


Keith

http://www.studiosoft.co.uk

 

[2ffat]

Mark Russinovich of Sysinternals fame writes about a similar problem in his blog on TechNet. You might find some help there.



James P. Cottingham
I'm number 1,229!
I'm number 1,229!

 

[goombawaho]

Look here:

http://www.tek-tips.com/viewthread.cfm?qid=1686883

 

[audiopro]

Thanks for the links although those articles pretty much repeat what I have read.
After much reading, I managed to get Hitmanpro to run via a flash drive. I had to run it several times before it detected a dodgy .dll and a .exe called wgsdgsdgsd.exe.
The other mystery was the number of processes removed by Hitmanpro increased each time I ran it and I wonder if something was being downloaded via the internet. Disconnecting the cable from the router, each time, until the Hitmanpro screen was visible stopped the increase in processes.

The PCEU lock up has now been removed and the computer boots into windows ok but a warning appears saying the wgsdgsdgsd.exe module could not run.

I did a registry search, a filename search and a file contents search for variations of the file name but found nothing.

Running Malwarebytes antimalware revealed 3 malicious files.

C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\runctf.lnk
C:\Documents and Settings\-user name-\Start Menu\Programs\Startup\runctf.lnk

I am hoping that this will have cured the problem and I will report back if further problems occur.



Keith

http://www.studiosoft.co.uk

 

[goombawaho]

I would still run the following to make sure things are clean. Many cleaners only find a certain percentage of malware. A second and third "opinion" will often find more. That error is probably where malware WAS trying to start up and now can't be found.

TDSS Killer, Rogue Killer, MalwareByte's Anti-Malware and a new one, Emsisoft Emergency Kit 3.0

 

[audiopro]

Thanks - I could not find the link which tried to launch the .exe, which is quite worrying but all seems fine now.
I have run a couple other malware detectors and they show up nothing.

I really don't ecer want to repeat the excercise.

The people who write these things really ought to be using the skills they were blessed with for the good of mankind.

Keith

http://www.studiosoft.co.uk