Jump to content

Explorer Crashes after Antispyware Soft infection


Recommended Posts

Hello,

Recently infected with Antispyware Soft. It got past Vipre ver 4...

I used Vipre for initial clean up. Vipre found 2 items.

Followed up with rkill.com and MBAM, which found a few more (5?) registry keys, which were cleaned.

Now, after a reboot, opening/running any program crashes explorer.

It only crashes once, then is OK.

I say OK, as Explorer doesn't crash again, but I've noticed at least one application not working correclty.

This is the Belkin Nostromo Loadout Manger - Game controller software, which allows keypress, and macros, to be used.

I've uninstalled and re-installed it. (I need to re-test to confirm whether it's not working correctly now)

Explorer still crashes after re-installing Nostromo software.

I initially thought that rkill was getting launched, as I'd left it on the desktop.

Deleted rkill with no change.

System restore to a restore point several days prior to the infection didn't help.

I hadn't yet set up ERUNT to backup the registry regularly... :)

Vipre and MBAM are both not finding anything else.

I don't see anything obvious in start up (msconfig and vipre tools - startup).

Due to the way that Antispyware Soft was intercepting and shutting down applications, I suspect that this behavior is left-over from the infection...

Something that seems odd...

I've opened regedit a couple of times from the Run prompt, and each time it's been on a xxvietnamese.xxvietnmese registry key.

I'm at work and didn't write it down while at home. It seems odd that key would be highlighted.

I thought that it opened to the last/previous highlighted key, and I closed all expanded keys when I exited regedit.

Has this been seen before? Suggestions/ideas? I didn't find anything using the search function...

XP SP3 All (most) updates. I passed on the one that was causing blue screens (KB977165, I think)

Thanks!

Link to post
Share on other sites

Hello dbb, :):)

Yes it seems there may be something left over.....

Please read the following so that you can begin the cleaning process:

We don't work on Malware removal in the general forums.

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

If you are a corporate customer please send an email to corporate-support@malwarebytes.org. (NOTE: An order number is required for corporate support.)

Also, when replying, please use the "ADD REPLY" button or erase what the person you are replying to said, as this makes the forum easier to read.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Thank you :P

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.