rrichey4430
Topic Starter
I've had an obvious malware infection related to "Outerinfo" popups, plus fatal errors running g4356cbvy63.exe and vedxg6ame4.exe. Right now, the only thing I can get the win2k computer to do is boot in safe mode. Normal boots and safe mode with networking give me a KMODE_EXCEPTION_NOT_HANDLED / blue screen of death at bootup with the folloping stop code: 0x0000001E, which according to MS knowledgebase article 294728, is related to certain viruses–which it would appear were downloaded by the malware to my machine shortly after infection. Anyway, I am a bit stuck, and cannot even get the machine to boot enough to run HijackThis and get a log of what is going on.
Any suggested avenues of attack?
The afore-mentioned KB article is not particularly helpful, as it does not seem to exactly match my situation, although it seems to be similar. I have no visible batch file that is initiating things, as it suggestes, nor do the indicated registry keys appear on my machine (at least when I am in safe mode). Perhaps I need to use the "Recovery Console," but without a bootable CD-ROM, I have not been able to make that work either.
UPDATE: I managed to get the computer to boot by disabling my network card while in safe mode. I then installed HijackThis from a floppy (because networking is currently off). I ran HijackThis, and had it do a scan and save, but it generates an application error dialog which says:
The instruction at "0x017411f3" referenced memory at "0x00000000". The memory could not be "read"
Then the application terminates when I press the OK button on the error dialog. .
If I try to only do a scan, it seems to scan fine, but then when I press the "save log" button, HijackThis terminates immediately with no error message, no saved log, nothing.
So, I am wondering if the malware is "HijackThis aware" and is somehow interfereing with its functionality. Does this ever happen?
Also, for what it is worth, I now have a red "X" icon in the lower right portion of my screen (the system tray?) which does not do anything when either right or left clicked, but when hovering over it, the message reads "your computer is infected". Early in the outbreak, I remember seeing somekind of popup solicitation to buy some kind of removal tool which was probably related to the infection, but I did not note exactly what it said at the time.
