Member Avatar for babybomber10

So I have an xp that my family uses and well im having some hardcore virus problems that I dont know how to fix the first is my Desktop and start always dissapear this has been happening since yesterday also When i reboot my computer and go to the login screen theres a new profile that says LOG ME IN REMOTE USER!? also my internet has been fritzing lately i dont know how to send a file of my script or whatever so can some1 assist me or tell me whats wrong?

  • 3 Contributors
  • 2 Replies
  • 129 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by wulawula

Dani AI

Generated

Immediate actions first: disconnect the PC from the network (unplug Ethernet / turn off Wi‑Fi) to stop any remote control or data leakage. The new login named like "LOG ME IN REMOTE USER" is commonly created by legitimate remote‑access software (LogMeIn), but malware can create similar accounts — do not delete it until you confirm what created it. and are right to look for signs of infection; add the checks below before running any aggressive removals.

Quick triage you can do from Safe Mode (press F8 at boot) or from your current session if Task Manager still works:

  • Try restarting Explorer: Task Manager → File → New Task → type explorer.exe. If desktop/Start returns, note what disappears after a normal reboot.
  • List local accounts:
    net user
  • Check the Winlogon shell and userinit values (malware often changes these):
    
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit

If `Shell` is not `explorer.exe` or `Userinit` is not `C:\WINDOWS\system32\userinit.exe,` restore them only if you understand the change:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\WINDOWS\system32\userinit.exe," /f


Caution: changing or deleting accounts or registry values can break legitimate software (for example remote‑access hosts). If you see an account named `LogMeInRemoteUser`, first check Add/Remove Programs for LogMeIn or other remote tools before deleting the account.

Next steps: scan the machine from Safe Mode with a reputable anti‑malware scanner and consider an offline rescue disk if you suspect a rootkit. Use Autoruns (Sysinternals) to inspect startup items and Services (services.msc) to find unfamiliar services. Back up personal data to external media (do not copy executables), then consider a clean OS reinstall if core system files or remote‑access tools were installed without consent. When you reply, post the outputs of `net user` and the two `reg query` commands and note whether any remote‑access program is listed — that information will help pinpoint the next safe action for @babybomber10.

Recommended Answers

All 2 Replies

Member Avatar for gerbil

Some things to do, in this order....
==Download this temp file cleaner from http://www.atribune.org/ccount/click.php?id=1 --click in the download window to run it, and when ATF Cleaner opens go Select all, and then Empty Selected.
Next click Firefox [if you have that browser..] at the top, Select All again, and Empty Selected again. Follow that procedure also if you have Opera.
Close ATF. Run it in all other profiles, except for that new one...don't think of touching that one!
==Please use IE or Firefox to do an online scan at panda:- ?
-for the free online virus scan select the link Scan your PC, then Register [otherwise there will be no disinfection, merely detection] with a valid email and follow through.
Please ATTACH to your post the log it produces.
==Download this file to your desktop:
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.
..we can go from there.

Member Avatar for wulawula

Try HijackThis for a free scan. Post your scan log here or to the official HijackThis.de.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.