Member Avatar for lonewolf999

my friends computer got infected with the Internet Security 2010 virus and when i when to try to remove it the virus put the computer into a log in\off loop once i fixed that the desktop freezes and the virus has disabled task manager. the cursor is the I beam you cant click on any icons and you get an hourglass when you hover over the taskbar. but when left on for a bit my antivirus started updating so it dosnt look like a complete freeze

  • 3 Contributors
  • 4 Replies
  • 124 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by lonewolf999

Dani AI

Generated

This thread shows a textbook rogue-AV infection: altered logon/startup behavior, disabled admin tools, and a partial desktop freeze. resolved the immediate lockout by using a PE environment to restore the affected logon/startup entries and then ran a scan from a secondary account to remove the rogue product. ’s Safe Mode suggestion and ’s pointer to the malware forum were both on point.

Post-clean verification and repair workflow that is still useful years later:

  • Run system-file and disk checks to detect corrupted system files and bad sectors:
sfc /scannow
chkdsk /f /r
  • Perform multiple full scans (one on-OS, one offline). Use a current rescue ISO/USB when the system cannot be trusted to run scanners natively. Run a second-opinion scanner (for example, an up-to-date anti-malware tool and an offline rescue scanner).

Startup and persistence cleanup:

  • Use an offline/autostart inspector (Autoruns) or a recovery environment to review all startup points, scheduled tasks, services and browser helpers. Remove entries that point to unknown or user-temp locations.
  • If Task Manager or other admin tools are disabled, restore the policy/registry settings from a recovery environment or Group Policy editor and back up the registry before editing.
  • Create a fresh administrative test account to confirm Explorer and shell behavior after fixes.

Aftercare and hardening:

  • Change all passwords and verify DNS/hosts settings to rule out redirection.
  • Fully update the OS and endpoints, enable System Restore/regular imaging, and keep multiple malware scanners for periodic checks.
  • If instability or unexplained corruption persists after thorough cleaning, a clean OS reinstall from known-good media is the safest long-term remedy.

Recommended Answers

All 4 Replies

Member Avatar for Dyed Purple

You've probably already tried, but can you boot into Safe-Mode?

Member Avatar for lonewolf999

i figured it out used bartpe with the registry plugin and changed the
hkey_local_machine\software\microsoft\windows nt\current version\winlogin changed the userinit key back to C:\WINDOWS\system32\userinit.exe,

Member Avatar for lonewolf999

i figured it out used bartpe with the registry plugin and changed the
hkey_local_machine\software\microsoft\windows nt\current version\winlogin changed the userinit key back to C:\WINDOWS\system32\userinit.exe,

oops that what i did before this happend the guest account was kinda working and got webroot to scan and it got rid of the virus

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.