Random 3 digit exe name virus on startup.

July 7, 2009 at 18:08:27
Specs: Windows XP, dual core Inter/2Gigs ram
I seem to have a Virus or Spyware embeded in my computer and it's not going away.

On Startup a random 3 digit exe program (###.exe) starts and tries to access an IP Address. My ZoneAlrm catches it and I prevent it from connecting then I Kill the process.

I ran Spybot but it didn't help. I did find out from Spybot that the program starts from Windows directory and the name it uses is crss.exe or altrc.exe and it uses a parameter called MAINBOARD.

This also created a HKLM entry in folder called "Run-" just like that,'Run' with negative sign after and this probably causes it to run on startup.

On one of the times I restarted my computer, when it was booting, a light blue screen with some install info came up. I'm thinking this probably installed something in the boot sector and this thing won't be easy to remove.

Has anyone heard of anything like this and what might I be able to do remove it?

Any tools I can use to at least find out more about this thing and maybe get rid of it manually?

Thanks you!

See More: Random 3 digit exe name virus on startup.

Report •

July 7, 2009 at 18:23:00
You may want to download, install, then update and run the Free version of "Malwarebytes' Anti-Malware" at the link below.



Report •

July 7, 2009 at 18:31:18
Thanks, trying now and also trying SuperAntiSpyWare.

Report •

July 7, 2009 at 18:40:51
SuperAntiSpyWare is another excellent program. Let us know how you make out after running those programs.

Good Luck,

Report •

Related Solutions

July 7, 2009 at 19:34:48
Well "Malwarebytes' Anti-Malware" did it!! It found a Backdoor.SdBot and killed it. All set now.

SuperSpy... did not find it but it cleaned out some cookie stuff that Malware didn't catch, however that wasn't the the issue.


Report •

July 7, 2009 at 19:40:56
ericblair, Glad to see that the problem is fixed & Thanks for posting back to let us know.

Keep MalwareBytes updated as they issue definition updates nearly every day.


Report •

Ask Question