Cheat Engine

kls85

After spending a few days of trying every solution possible, I've finally given up and decided to perform a reformat.

But I'm just curious if anyone of you had encounter this before and would like to know any method you guys have performed with success?

A few days ago a friend of my had a perfect working system and all of a sudden, tons of malware started to infect his machine. It got up to the point where nothing works, screen blanks out and a force restart was required.

After the machine restarted, a bsod occur saying winlogon is corrupted.
-Tried heading to safemode = no help
-Tried safemode with networking = does not work
-Tried safemode with command prompt = no help either
-Tried Last known good configuration = still don't work

I then had to do was perform a repair install of the entire OS.
After the OS installation is complete, Windows boots up and I was able to head into his desktop and finally perform a proper malware scan.

I fired up Malwarebytes Anti-Malware, did a update, and select Quick Scan.
The program will run about 3 seconds and close off. After the program close off, and I try to run again, it will say something alone this line

hcavolsdsadgadsg · Posted: Fri Sep 24, 2010 4:50 pm Post subject:

I've pretty much always managed to clear out almost everything once I get into safe mode, though I had an interesting one once where trying to get into safe mode would effectively crash and restart the computer while a regular boot wouldn't.

You could try the system internals stuff if you want to see what's going on.

But yeah, just reformat and get it over with.

Cryoma · Posted: Fri Sep 24, 2010 4:59 pm Post subject:

Back up important files, reformat.
It will save you hours of frustrating hair pulling.

shitposter · Newbie cheater Reputation: 5 Joined: 12 Nov 2008 Posts: 13

Notepad · Posted: Fri Sep 24, 2010 8:50 pm Post subject:

I'd personally boot up UBCD4Win and give it a scan with the AVs and Anti-Malware/Spyware programs it has.
Once scanning is finished you should be clear of all virus'.

Cryoma · Posted: Fri Sep 24, 2010 10:00 pm Post subject:

AhMunRa · Posted: Sat Sep 25, 2010 9:07 am Post subject:

For the record you could fix an infected winlogon file from repair console. It's as simple as copying the new one from the disk into the directory.

Winlogon no matter what you do will always run the viral code. If you try to hard power off, Winlogon is still sent the power off sig and will rewrite the file to disk before power off. I have fought this kind of malware before. It actually hooks into the logon process to detect power off/on the code if I'm correct doesn't even have an exe written to disk, it all stays resident in memory until shutdown, then it writes and creates the reg keys to startup once shutdown. Safe mode won't rid you of it because Winlogon is used in safe mode as well.

kls85 · Posted: Sat Sep 25, 2010 7:22 pm Post subject:

-All AV, malware, rootkit software I've tried shows the system is clean.
-Fixing the winlogon through recovery console was the very first thing I did, but that didn't fix the bsod, thus I have to perform a repair install.

The entire OS including the Administrator is controlled by that infection and I've checked online for solutions, there are some who had this problem which a HJT log shows it, for the system I was working on, it's a clean (fake) bill of health.

AhMunRa · Posted: Sat Sep 25, 2010 7:58 pm Post subject:

For an infection this deep I would not try an in place reinstall. Complete format and reinstall would be the safest solution. If you wish to save your data create a Linux boot disk and back up your data from linux to CD or shared folder before you perform the format.

kls85 · Posted: Sun Sep 26, 2010 12:39 am Post subject:

Since the OS can't be accessed, there is no way to tell how deep that infection was. Also it's very rare to actually get infected like that as most of the time you can get rid of these pests by a simple scan.

And as stated in my starter post, I had perform a reformat which of course means to wipe out the entire OS and start from scratch.

But it's better off to figure it out (you get to learn a thing or two) rather than take the easy* way.

*format at a last restore when all methods has failed

AhMunRa · Posted: Sun Sep 26, 2010 7:32 am Post subject:

That's the way to do it. Glad you got it sorted out. Would be nice if you knew where you got it from though.

kls85 · Posted: Sun Sep 26, 2010 10:53 am Post subject:

It's not my system, but my friend told me all of a sudden he saw a bunch of popups and then his desktop turn black with a message smack in the center that says "Your system is infected with spyware, blah, blah, blah".

Now those lots of time and it's rare you see those these days since they happen often in the past.

Now you get those fake AV which tells the uninformed to buy it and they fool for it.

Heard of Nortel Antivirus? Rolling Eyes

http://www.spywarevoid.com/remove-nortel-antivirus-nortel-anti-virus-removal-help.html