Malware infection in XP

February 17, 2009 at 05:38:42
Specs: Windows XP

My Windows XP boots fine until the screen for the selection of the User account. When I select an account (doesn't matter which), the Taskbar/Desktop icons never appear.
But things seem to be working, though, as sometimes, some alerts from Panda Antivirus appear (but just advertisement. They don't reference any virus).

I can start the Windows Task Manager (via Ctrl+Alt+Delete) and I see that I have some malware processes running (e.g. 9129837.exe, xccef090131). I terminate them. I've also found that in the folder Windows/system32 there were some malware executables. I've also deleted them.

However, when I restart the computer, those malware processes/executables are created again.

I've also seen some messages saying that "msas2009.exe" and the application Utool has found some errors. These are also known malware.

Things I've tried: running Malwarebytes, but I can't install it. I go to Windows Task Bar -> File -> New Task (Run...) and try to run the setup for Malwarebytes, but nothing happens.
But, some executables I can run: I run the Command Prompt without any problems (via the same system).

I've also tried to terminate the explorer.exe process and re-running it. Still, no Taskbar appears.

Finally, I've run a full system scan with Panda Antivirus 2009... Nothing was found...

Anyone knows how I can remove this malware. Maybe by seeing the programs that are being run as Windows starts and eliminating some?

Help me, please.

NOTE: The same thing happens when I launch XP in Security Mode (by holding F8 at start-up).

See More: Malware infection in XP

Report •

February 17, 2009 at 07:44:27
This should have been posted in the Security/Virus Form. I'd recommend you PM Justin Weber and ask him to remove this post. Then repost in the other Forum. There's an expert over there who can help, but I don't think he checks this Forum.

"So won’t you give this man his wings
What a shame
To have to beg you to see
We’re not all the same
What a shame" - Shinedown

Report •

February 17, 2009 at 08:11:27
I've followed your suggestion. Thanks.

Report •

Related Solutions

Ask Question