Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!
  • Students Click Here

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here

PCEU virus

PCEU virus

PCEU virus

I have an XP box infected with the PCEU trojan virus.
A normal boot results in a screen threatening all kinds of stuff if I don't pay - blaa blaa and a locked up machine.
Safe mode boots the same as does safe mode with network support.
Safe mode with command prompt lets me in and I can run regedit from the command prompt.
Google advice points to registry entry WINLOGON and tells me to delete value and insert explorer.exe.
explorer.exe is already the value - what to do now be the cry.
Machine will not boot from Flash Drive - I think that is the age of the machine.


RE: PCEU virus

Mark Russinovich of Sysinternals fame writes about a similar problem in his blog on TechNet. You might find some help there.

James P. Cottingham
I'm number 1,229!
I'm number 1,229!

RE: PCEU virus

Thanks for the links although those articles pretty much repeat what I have read.
After much reading, I managed to get Hitmanpro to run via a flash drive. I had to run it several times before it detected a dodgy .dll and a .exe called wgsdgsdgsd.exe.
The other mystery was the number of processes removed by Hitmanpro increased each time I ran it and I wonder if something was being downloaded via the internet. Disconnecting the cable from the router, each time, until the Hitmanpro screen was visible stopped the increase in processes.

The PCEU lock up has now been removed and the computer boots into windows ok but a warning appears saying the wgsdgsdgsd.exe module could not run.

I did a registry search, a filename search and a file contents search for variations of the file name but found nothing.

Running Malwarebytes antimalware revealed 3 malicious files.

C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\runctf.lnk
C:\Documents and Settings\-user name-\Start Menu\Programs\Startup\runctf.lnk

I am hoping that this will have cured the problem and I will report back if further problems occur.


RE: PCEU virus

I would still run the following to make sure things are clean. Many cleaners only find a certain percentage of malware. A second and third "opinion" will often find more. That error is probably where malware WAS trying to start up and now can't be found.

TDSS Killer, Rogue Killer, MalwareByte's Anti-Malware and a new one, Emsisoft Emergency Kit 3.0

RE: PCEU virus

Thanks - I could not find the link which tried to launch the .exe, which is quite worrying but all seems fine now.
I have run a couple other malware detectors and they show up nothing.

I really don't ecer want to repeat the excercise.

The people who write these things really ought to be using the skills they were blessed with for the good of mankind.


Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members! Already a Member? Login

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close