Member Avatar for bhnidan

My computer is going nuts. . .
When it turns on 2 pop ups come up saying "Windows cannot find C:\Windows\system32\rhhgmsb\winlogon.exe and then says it can not load / run C:\Windows\system32\rhhgmsb\winlogon.exe . .. After that there is 2 pop ups one says "Generic Host Process for Win32 services has encountered a problem and needs to close" which is followed by "Instructions at 0*745f2780 referrenced memory at 0 * 00000000. The * is a times sign. Then after proceed and click okay my computer just freezes up it is terrible please help ... I need to get a project done and cant cause mi computer is not working [IMG][/IMG]

  • 3 Contributors
  • 3 Replies
  • 233 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by bhnidan

Dani AI

Generated

This thread shows a classic Winlogon hijack pattern: Windows attempting to load a system DLL from a randomly named subfolder (the reported "rhhgmsb" path), followed by service crashes and a freeze. and correctly pointed toward malware, and ’s scan removed items—good first signs. Scanning alone, however, can miss persistence mechanisms, so a short verification checklist is useful.

Recommended verification checklist:

  • Boot into Safe Mode or use an offline rescue disk and run a full scan with a second reputable scanner (different engines catch different things). Quarantined items should be viewed and logged.
  • Inspect startup persistence: use Autoruns (Sysinternals) to find entries pointing to unfamiliar folders (any reference to "rhhgmsb" is suspicious). Check Services, Scheduled Tasks, and any newly created user accounts.
  • Verify Winlogon and related registry values; correct defaults are important. A quick registry check:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /v Shell

Userinit should normally be C:\Windows\system32\userinit.exe, and Shell should be explorer.exe. Export the key before making changes.

Repair and file checks:

  • Use System File Checker and disk repair to restore legitimate system files and catch filesystem corruption.
sfc /scannow
chkdsk C: /f /r

If winlogon.exe appears missing or is unsigned, avoid downloading executables from random sites—use sfc or a repair/install media to restore originals.

Post-clean actions and cautions:

  • Change all passwords, review sensitive accounts, and enable automatic updates and real-time protection. Make a clean image or rescue media once the system is verified clean.
  • Do not delete or replace system files like winlogon.exe manually without a verified recovery plan; incorrect changes can prevent Windows from booting.
  • If reinfection or system instability persists after these steps, a clean OS reinstall is the most reliable resolution.

Recommended Answers

All 3 Replies

Member Avatar for Keith Ritchey

Looks like it is a trojan. See for the description. Download spyware removal tool or do an online-check of your %windir%.

Member Avatar for digitalocksmith

Malware is a likely scenerio here, however in order to be sure you will need to get your system running in order to perform scans and post your logs!
Try starting the computer with the "last Known Good Configuration" setting. To do this, follow these steps:
1. boot your system pressing the f8 key to access the menu options.
2. When the Windows Advanced Options menu appears, use the ARROW keys to select Last Known Good Configuration (your most recent settings that worked), and then press ENTER.
3. If you are running other operating systems on your computer, use the ARROW keys to select the Microsoft Windows version required, and then press ENTER.

This should allow to get back up and running to follow Keiths advice and also post your logs for assistance (if need be) in the Malware forum!

Good Luck :cool:

Member Avatar for bhnidan

Hey Thanks a bunch I downloaded PrevX1 and It seems to have fixed the problem for now it found some harmful maleware and quarantined and deleted it. I think everything is good now

Thankz
Ben

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.