Cheat Engine

Rawss. · Posted: Sun Feb 27, 2011 5:10 pm Post subject: Strange virus

Okay so about an hour ago I got this pop-up message on my computer but when it came up I pressed 'enter' because I was sending a message so I didn't get a chance to read the message because when I pressed enter it started this programme called 'system tool'.

I've never seen this programme in my life and I really don't remember installing it or whatever, but it started scanning my computer and then I got a message saying that I had 8 viruses and I needed to delete userinit.exe

I tried opening my antivirus but it wouldn't let me open anything (even taskmanager) and I kept getting notifications which told me to start my antivirus and whenever I clicked them it took me back to this programme.

I checked online and it looks as if deleting userinit.exe is a bad move. I reset my laptop and the problems still there but I can open programmes now and I'm virus scanning just to see if it'll show up.

Also, like 20 minutes ago it changed my desktop background to the attached image.

I tried booting up in safe mode and trying to locate the programme and delete it but it doesn't seem to be installed anywhere, so I'm kinda worried. I have googled some stuff but it just confused me more and I couldn't find anything relating to Windows 7 so I was wondering if any of you knew what the hell I've done?

Choycolate · Posted: Sun Feb 27, 2011 5:46 pm Post subject:

Ok thats is a funny virus. U can try restoring u PC if its premade. Or u can just reinstall Ur OS. or http://answers.yahoo.com/question/index?qid=20080308115127AAtyOEM

Hero · Posted: Sun Feb 27, 2011 5:59 pm Post subject:

Get malwarebytes and scan. It normally removes weird shit like this. If you must, try scanning in safe mode.

Kardi · Posted: Sun Feb 27, 2011 6:48 pm Post subject:

Find out the process of the virus if you can. Often with this crao you need to delete shit even after malwarebytes.

InternetIsSeriousBusiness · Posted: Sun Feb 27, 2011 8:51 pm Post subject:

ZacTheSin · Posted: Mon Feb 28, 2011 5:32 pm Post subject:

Lol this virus.

I see it like 10 times a day.

Anywho, boot into safemode then run Combofix.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

DO NOT DOWNLOAD IT FROM COMBOFIX.ORG

The scan will take about 20 minutes max.

Rawss. · Posted: Wed Mar 02, 2011 1:31 pm Post subject:

Hey guys

Thanks for the feedback. I downloaded SAF but the problem I have now is that my laptop keeps shutting down, so I can't complete a scan. Do you know any way around this?

AhMunRa · Posted: Wed Mar 02, 2011 1:44 pm Post subject:

Under Startup and Recovery, under System Failure uncheck "Automatically Restart". Control Panel | System | Performance if it's hardware or software related should show you an error message before shutting down.

Haswell · Posted: Wed Mar 02, 2011 2:37 pm Post subject:

More details: http://www.bbc.co.uk/news/technology-12608651

You can try to boot into recovery mode and restore your system to an earlier time.

ZacTheSin · Posted: Thu Mar 03, 2011 3:06 pm Post subject:

Or you can just run the damn virus removal program I suggested.

D:<

AhMunRa · Posted: Sat Mar 05, 2011 7:40 am Post subject:

No need to run anything to clean it. You can if you like. My daughter got this on her computer Thursday night. I fixed it yesterday manually it took 10 minutes.

If your account is not administrator you can clean it in less than 10 minutes from SafeMode.

Boot to Safe Mode, run regedit under your user account. Navigate to HKCU\Software\Microsoft\Windows\CurrentVersion\Run Look for an entry that sorta looks like the word schizto. The virus is using Run32dll.exe to call a dll that is the actual virus. Removing this entry from the registry disabled it. The offending dll is located in C:\Users\<USER>\AppData\Local\djksjdlkajw.dll. Once it was deleted, rebooted into Windows ran complete scan, came up clean, no more pop up windows.

If you run an account that has administrator privies then you may need to reformat and reinstall. If administrator privilages are present it could propagate to every other user account. You would need to clean them all. And it could also affect other system exe's or dll's.

ZacTheSin · Posted: Mon Mar 07, 2011 4:16 pm Post subject:

AhMunRa · Posted: Mon Mar 07, 2011 7:01 pm Post subject:

I do, 2 days now and no further sign of infection.