[Resolved] will virtumonde ever go away?

hi. theres no start button, no explorer buttons, no files, nothing. its completely blank. the only thing i can work, is the task manager. is there a way to get to what you asked for through the task manager?

i have seen i can browse for things on my computer, through task manager. what would the system restore be under, if you had to look for it without a start button? i found out how to. but there is no restore point available under that.

Open taskmanager > at the top left, click File> New Task> copy paste this in or type it in:
C:\WINDOWS\ERDNT\subs\erdnt.exe
run it

Restart PC

thanks. ok, i just typed that in, and made 3000% sure it was correct and i run it. a registry restorer came up. i shut my computer down, and it is now logging back in. it says windows cannot find C:\WINDOWS\system32\CF19694.exe and the blue screen is back. nothing on it at all but blue…

Open taskmanager > at the top left, click File> New Task> copy paste this in or type it in:
c:\windows\system32\restore
double click on: rstrui.exe
run it

Restart PC

i typed that into the task manager. when i hit enter, the screen has a small flash, then the cpu usage goes up to about 30% and nothing happens at all

Can you get to this folder? c:\windows\system32\restore
Inside that folder look for rstrui.exe
double click on: rstrui.exe

Also in Taskmanager stop
* Any process with cfexe file extensions
* FindStr.exe
* Regsvr32.exe

files with the name like taskmanager.exe are fine right? i dont have any with cfexe on them. i am rebooting now to try again. thanks man. im sorry. ok update. i can get into the system restore point. heres the major issue. there are no restore points available. there is only a restore point of tonite, when i pasted that into the program and run it. does any of the programs i have used to try to rid my computer of this, have a restore point also? like before i did that? can we open up command and undo what i did?

files with the name like taskmanager.exe are fine right? i dont have any with cfexe on them. i am rebooting now to try again. thanks man. im sorry.

That's fine. Those are combofix files and I wanted to be sure they weren't running.
Were you able to do this?

Can you get to this folder? c:\windows\system32\restore
Inside that folder look for rstrui.exe
double click on: rstrui.exe

i can find that, and when i hit enter, it brings up a "restore point" of which is tonite, at the time i lost everything. theres no other restore points available. also, if this helps, i seem to be able to find ALL my things, its just gotta be done through the task manager. its like my desktop just died. i have a new highjacklog, but it would take me 3499 days to type it all in here. running processes: c windows system 32 smss.exe c windows system 32 winlogon.exe services.exe lsass.exe svchost.exe

try that restore point. It should be the one Combofix created. Maybe before all went bad

thats the one i have tried. i tried it again just now. it does nothing but bring up the dreaded blue screen. lol…..

In Task Manager, do you have Explorer.exe running?

If it's running, End process on it.

Open your Task Manager.(alt / ctrl /del) Click File and select New Task (Run…)

Then type explorer.exe to start it.


If you have DSL or Cable, follow these instructions:

1. Ctrl+Alt+Delete>File>New Task (Run…)

2. Type: ftp://ftp.f-secure.com/anti-virus/tools/shellfix.reg

3. Click Ok and it will prompt to download shellfix.reg file

4. Click "Run" or Open file. Do not save it on your desktop, or anywhere on the computer.

5. After it runs, reboot your computer and the problem will be gone

If you do not have DSL or Cable:

Follow these steps: ftp://ftp.f-secure.com/anti-virus/tools/shellfix.txt

The shellfix.txt repairs the corrupted explorer.exe

thanks. ok, i just typed that in, and made 3000% sure it was correct and i run it. a registry restorer came up. i shut my computer down, and it is now logging back in.

it says windows cannot find C:\WINDOWS\system32\CF19694.exe and the blue screen is back. nothing on it at all but blue…

i was looking through the highjackthis log, and i see a line that says this

04-HKLM\..\RUN: [Combofix] C:\WINDOWS\system32\cf19694.exe /c C:|Combofix\combobatch.bat


the above in bold, has the command that windows said it couldnt find when i first started up after combofix. this probably means nothing, but since i havent figured out how to make my computer go on internet to post the highjack and combo log, im just trying to help. thanks