Browser F'd up after a malware infection.

[r896neo]

Hi i use primarily google chrome as a browser, i recently had the mis-fortune of getting the rouge malware anitvirus.net unto my comp.

After some safe mode and running various program like malware bytes spybot etc i have got rid of it but clearly there is some registry or similar damage left behind as the user profile that got hit by it still is having a few issues.

I uninstalled and re-installed Goggle chrome but it still will not work, also I get an error messge about C\:WINDOWS\msveart.dll everytime i log into this profile. I also get various shut downs of internet explorer at seemingly random points.

Can anyone offer any advice? Cheers

 

[inkypinky]

i found this URL when my computer was infected

http://www.bleepingcomputer.com/virus-removal/remove-personal-internet-security-2011

 

[r896neo]

Thanks for the tip, i ended up just going with a system restore which seems to have sorted it.

 

[inkypinky]

good things are sorted...

 

[dave.m]

Thanks for the tip, i ended up just going with a system restore which seems to have sorted it.

Once you are happy that everything is working fine, you must purge the system restore files to remove any possibility of doing a restore in the future and reactivating the Antivirus.net, then reset it to start making new restore points.


Purging System Restore

To remove all SR Points thus removing any contaminated ones:
Turn OFF System Restore then turn it back ON and then set a new restore point.

In XP:
Follow these instructions (method 2)
Then set a new restore point by following these instructions.


In Vista:
Follow these instructions.
Then set a new restore point by following these instructions


In Windows 7
Follow these instructions
Then set a new restore point by following these instructions

dave

 

[r896neo]

hey thanks for the reply.

Google chrome is working fine again but the one issue is everytime i log into any user account i get 2 dos prompt style windows open and i get a box saying

C:\WINODWS\system32\lv4st46n.exe
The NTVDM CPU has encountered an illegal instruction
CS:054a IP:0310 OP:db ff db ff f7 chose close to terminate the program

With the options being Close or ignore?

 

[EFCLee1]

Once your system has been compromised the only way to get fully recovered is to do a full Windows re-install, either from a full back-up using Ghost or Acronis, or any other similar program, it copies every single byte of information and saves it as 1 single file to a seperate drive or a partition of your current drive, using a windows install disk is also an option but is quite lengthy once you have the drivers installed then there the necessary apps to download etc......much more efficient to use a backup program like Acronis or Ghost

Takes 10 minutes to restore from a back-up then your back to day 1 or back to the point in time when you made the back-up, nothing worse than faffing round on the internet googling a random error message, simply wipe it and start again!!

 

[salem2000]

Have to agree. Start from fresh, then ghost the system (I use Norton Ghost) We have three PC's on our home network and I do a complete system backup once a month on all three to a secondary internal hard drive.

By doing this I can re-install all three PC's in less than an hour.

By having a secondary hard drive, all doc's, pics, emails and any other files I wish to save can be transferred to the secondary drive, and replaced/imported when needed.

 

[r896neo]

I really dont want to have to re install all the prgrams etc, is there any way to do this without reformatting?

 

[EFCLee1]

I really dont want to have to re install all the prgrams etc, is there any way to do this without reformatting?

But how long will it last until your next intrusion, or until your next random error message that you spend considerable time on trying to resolve

Your current situation may not warrant a complete wipe and re-install but its something to consider in future as best practice

To be ultra efficient 2 images could be made, 1st image when Windows has been installed with all drivers and fully updated with MS updates, 2nd when all apps have been installed, when you need to do a restore you may not need the same apps so you would restore the 1st image then install your currently used apps then re-create 2nd image

Its a lot easier than it sounds!!!