I have a virus that is continually stopping iexplore from running. Nothing is loading at boot, virus and spyware checks reveal nothing and it isn't a vundo.

Any ideas?

Rootkit ???

RootkitRevealer v1.71

Rootkit - Wikipedia, the free encyclopedia

Found it. It's called MusCDriverV32. Just need to get rid of the bugger now.

Found it. It's called MusCDriverV32. Just need to get rid of the bugger now.

Was it a rootkit ?

Don't know. I found it by other means. I can't install any apps anyway.

Edit: I thought it was worth a thanks though given that it was your first ever useful post :P

Edit: I thought it was worth a thanks though given that it was your first ever useful post :P

You cheeky barstweard

Still searching for any useful one's you've made :P MI

1/ What software detected it - do they have Tech help ? (say this cos I can't find anything specific on removing this MacV).

2/ Try downloading Process Explorer

Process Explorer v11.03

Run this - see if there are any untoward processes going on (ProcExplorer will let you see the path of such a process, and the DLLs it is using etc). You may be able to kill the process and then delete the offending little proggy.

Also download Autoruns

AutoRuns for Windows v8.73

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.

Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.

This may allow you to disable a process from auto-starting on XP / Vista bootup.

Everytime you use IE a small Puppy Dies..

Please use Firefox!!!

I do use Firefox :confused:

1/ What software detected it - do they have Tech help ?

Repair install, so the answer is no!

2/ Try downloading Process Explorer

Process Explorer v11.03

Won't run.

Also download Autoruns

AutoRuns for Windows v8.73

Won't run either. Bit of a bugger this one, can't even work in safe mode.

Re-installing (full) as we speak.

can't even work in safe mode.

Had similar, think the craftier ones disable permissions etc. when they install themselves:thumbdwn:

My desktops IE7 is playing up too. If you click a tab, it brings up the menu bar (the one with File, Edit etc on it), and hides it, re opens it, hides it, really really fast, rendering it a pain in the rectum to swap between tabs.

Answer:

Firefox:rofl:

This forum is good for tricky virus/spyware help

Bleeping Computer - Computer Help and Discussion

and they have an excellent tool for removing rubbish malware

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

HTH

If that file is a driver then it had kernel level privileges..

If that is the case as soon as you have done a format and reinstall go and change all your online banking passwords followed by any other passwords for things you use and wouldn't like others to get to (that includes any pr0n sites )

Potentially I would also give the bank a call and tell them your pc appears to have been compromised by a root kit, that you have reinstalled it and changed your password, but you would like them to keep an eye out for suspicious activity on your account.

If it has kernel privileges it had access to everything on the PC including all memory and so even data that you never typed in but was stored could be stolen.

Have you any idea where it came from?

I know it sounds a bit OTT, but these things are made so people can steal bank details etc.

It was a keygen.

I've run rootkit revealer but frankly I don't understand the results or whether any of the registry keys mentioned need to be deleted (the help file doesn't work).

I've had no problems following re-install over a month ago.