2

This showed up on the family XP box today, with all MS security updates applied, along with free versions of ZoneAlarm and AVG running. If you need a culprit, it might be the young neighbor who installed some video-burning software, but I'm looking past that. Right now I've got a system where google searches are hijacked, IE is launched every few minutes, I can't launch regedit without restarting in safe mode, and in short the machine seems greatly compromised.

When I did launch in safe mode none of the expected entries showed up in the registry, nor in the main user's My Documents\New Folder folder. Before the reboot there were two separate setup.exe processes running -- that's going to be a treat to track down.

I'm considering backing up all the photos, kids work, email, etc and doing a full reinstall. Anyone have an alternative?

Improve this question

2 Answers 2

Reset to default
1

A full reinstall is the safest option - it's the only way you can be 100% sure the system will be clean.

But, if you're trying to avoid that, the most effective way to clean a system is to boot up a Live CD/USB, so the malware will not have the chance to run, and perform all the cleaning tasks from there. In which case I recommend this question as it provides some good options for Live CD's for that purpose.

Also, you might find this question to be useful as it discusses where the infection may have come from.

Improve this answer
3
  • Anyone have an answer to the first part of my question? The resources I found refer to files with names like "Antimalware Doctor.exe" and stupapp7070010000.exe", and reg keys based on HKCU\Software\Antimalware Doctor Inc", but I don't have either on my system. The dialogs that come up call themselves "Antimalware Doctor", but there's nothing like that in the task manager. I'm suspecting two tasks called "setup.exe" and "hexdump.exe" - if I was going to write a virus I'd use innocuous names like those, but we don't want to tip the bad guys off, do we? So my question is, what do I clean up?
    – Eric
    Aug 27, 2010 at 15:13
  • 1
    @MBraedley already suggested BleepingComputer, and so do I. Here is their specific link for removing this particular malware. BTW - if you're running the infected OS, remember the virus can change the system so just because you cannot see it doesn't mean it's not running. This is why the recommendation is to use a Live CD, because the virus doesn't run in the OS from the CD.
    – DMA57361
    Aug 27, 2010 at 16:44
  • I don't have "Antimalware Doctor.exe", I have an attack that's masquerading as it. I found a key file: c:/windows/iexplarer.exe (with an 'a'). Booting from the live CD is a good idea. I'm tempted to make that CD a Linux one, but no one else will appreciate it.
    – Eric
    Aug 27, 2010 at 20:06
0

BleepingComputer lists various ways of cleaning up malware infections, usually consisting of preventing services from starting with HijackThis and continuing with MalwareBytes and possibly some more powerful tools. However, removing malware by using a LiveCD environment is more likely to succeed, and the only sure fire way of completely removing it is with a wipe and reload.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .