The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Malware infection in XP. Can't see Taskbar. How to solve this?

    Discussion in 'Windows OS and Software' started by arlab, Feb 17, 2009.

  1. arlab

    arlab Notebook Evangelist

    Reputations:
    15
    Messages:
    361
    Likes Received:
    0
    Trophy Points:
    30
    Greetings.

    My Windows XP boots fine until the screen for the selection of the User account. When I select an account (doesn't matter which), the Taskbar/Desktop icons never appear.
    But things seem to be working, though, as sometimes, some alerts from Panda Antivirus appear (but just advertisement. They don't reference any virus).

    I can start the Windows Task Manager (via Ctrl+Alt+Delete) and I see that I have some malware processes running (e.g. 9129837.exe, xccef090131). I terminate them. I've also found that in the folder Windows/system32 there were some malware executables. I've also deleted them.

    However, when I restart the computer, those malware processes/executables are created again.

    I've also seen some messages saying that "msas2009.exe" and the application Utool has found some errors. These are also known malware.


    Things I've tried: running Malwarebytes, but I can't install it. I go to Windows Task Bar -> File -> New Task (Run...) and try to run the setup for Malwarebytes, but nothing happens.
    But, some executables I can run: I run the Command Prompt without any problems (via the same system).

    I've also tried to terminate the explorer.exe process and re-running it. Still, no Taskbar appears.

    Finally, I've run a full system scan with Panda Antivirus 2009... Nothing was found...

    Anyone knows how I can remove this malware. Maybe by seeing the programs that are being run as Windows starts and eliminating some?

    Help me, please.

    NOTE: The same thing happens when I launch XP in Security Mode (by holding F8 at start-up).
     
    arlab, Feb 17, 2009
    #1
  2. Wishmaker

    Wishmaker BBQ Expert

    Reputations:
    379
    Messages:
    1,848
    Likes Received:
    35
    Trophy Points:
    66
    Download Malwarebytes and run it.

    Lets see what happens.

    Also,download this and run it.

    Paste the log here.

    Cheers.
     
    Wishmaker, Feb 17, 2009
    #2
  3. xTank Jones16x

    xTank Jones16x PC Elitist

    Reputations:
    848
    Messages:
    1,276
    Likes Received:
    2
    Trophy Points:
    56
    I think I remember having a Virus like this in my old Laptop. I believe I finally god rid of it, by running Hijack this, and searching for "I think it is called Dr. Webb", but I ran it, and it cleaned it.

    Sorry I can't be more specific, was a LONG time ago.

    Edit: Yes, I was right. The name of it is Dr. Web Anti Virus. I remember having to run it in Safe Mode.
     
    xTank Jones16x, Feb 17, 2009
    #3
  4. Baserk

    Baserk Notebook user

    Reputations:
    2,503
    Messages:
    1,794
    Likes Received:
    1
    Trophy Points:
    56
    When you've downloaded the MBAM installer, rename it to ABC.exe, then install ABC(MBAM).exe.
    Don't update the program yet but close it. Go to the MBAM folder and rename MBAM.exe to ABCD.exe, then run ABCD(MBAM).exe, update the program first and then do a full scan in safe mode.
    Cheers.
     
    Baserk, Feb 17, 2009
    #4
  5. Carrot Muncher

    Carrot Muncher Notebook Evangelist

    Reputations:
    71
    Messages:
    463
    Likes Received:
    0
    Trophy Points:
    30
    Baserk, just curious, why do you have to rename the .exe? Is it because the malware/virus will prevent you from running it and renaming it is to a get around?
     
    Carrot Muncher, Feb 17, 2009
    #5
  6. Baserk

    Baserk Notebook user

    Reputations:
    2,503
    Messages:
    1,794
    Likes Received:
    1
    Trophy Points:
    56
    Yep.
    Some malware will try to block installing AV/AS programs, some try to block updating virus/malware signatures and some will block running antimalware programs.
     
    Baserk, Feb 17, 2009
    #6
  7. arlab

    arlab Notebook Evangelist

    Reputations:
    15
    Messages:
    361
    Likes Received:
    0
    Trophy Points:
    30
    You were right. Renaming the executable, solved the problem. Thanks.

    I'm running Malwarebytes right now. It will take a few hours, though. I'll keep y'all updated.
     
    arlab, Feb 17, 2009
    #7
  8. Wishmaker

    Wishmaker BBQ Expert

    Reputations:
    379
    Messages:
    1,848
    Likes Received:
    35
    Trophy Points:
    66
    You should have done a quick scan first but no biggie ;).
     
    Wishmaker, Feb 17, 2009
    #8
  9. arlab

    arlab Notebook Evangelist

    Reputations:
    15
    Messages:
    361
    Likes Received:
    0
    Trophy Points:
    30
    Malwarebytes reported 53 infected files. I've removed them. Now (after rebooting), it can't find any more infected files, however, nothing seems to have changed (still no Taskbar/desktop icons).

    HijackThis's log is:

     
    arlab, Feb 17, 2009
    #9
  10. Wishmaker

    Wishmaker BBQ Expert

    Reputations:
    379
    Messages:
    1,848
    Likes Received:
    35
    Trophy Points:
    66
    Wishmaker, Feb 18, 2009
    #10
  11. Carrot Muncher

    Carrot Muncher Notebook Evangelist

    Reputations:
    71
    Messages:
    463
    Likes Received:
    0
    Trophy Points:
    30

    Thanks for the info. :)


    What about running super antispyware, I've noticed that sometimes it picks up stuff that malwarebytes doesn't.
     
    Carrot Muncher, Feb 18, 2009
    #11
  12. arlab

    arlab Notebook Evangelist

    Reputations:
    15
    Messages:
    361
    Likes Received:
    0
    Trophy Points:
    30
    My computer was infected with Virus.Win32.Virut.ce.
    The computer used to have Panda Antivirus installed. But since it proved inefficient and since Kaspersky recognized Virut (and could disinfect files infected by it), I uninstalled Panda and installed Kaspersky 2009. The installation went fine until I rebooted my computer.

    Besides only seeing the desktop. I couldn't access the Windows Task Manager. I couldn't run any program.

    So I ended up using a bootable CD to copy the files I wanted and reinstalled Windows.
    All is well now.
     
    arlab, Feb 27, 2009
    #12