Followed the 8 rules, but didn't work until..

By aoshater
Mar 5, 2009
  1. I'm writing this post for two reasons:
    1) I fixed my PC so it might help others.
    2) The pros here could maybe explain further how what I did helped.

    Well, to explain the problem:
    I have a C: drive and a D: drive. Lately, on startup I would find a strange cmd window opening automatically w/ a title like this:
    C:\windows\..\cmd C:\.X
    And Control Panel in the startup menu wouldn't appear. A CTRL-ALT-DEL won't bring up the task manager and opening any text file using notepad would always give " File is being used by another program". Registry Editor is restricted by administrator.

    Since I had nothing valuable on C:, I decided to carry out a clean FORMAT and re-install Windows. I did that twice. And right after installing windows, as soon as I perform my first reboot, the exact symptoms appear again.

    I followed the 8 steps to the point, but nothing would be found, neither on C: or D: drive.

    I ran ComboFix.exe but it would finish and reboot and no real change.

    I kind of followed around and got the hint that a process C:\.X.exe is the main culprit. But it was impossible to find it and delete it or kill it. The solution was by using a software called Unlocker. I went to C:\windows\system32\regedit.exe and found that .X process locking it. As soon as I killed the process .X, I could actually do everything. But upon restart, again, same symptoms. The trick was the combination of:
    1) Unlocking regedit in windows and deleting it.
    2) Unlocking notepad.
    3) Running ComboFix after that.

    After that restart, It was finally totally removed. That's it. Pros, your comment.
  2. kimsland

    kimsland Ex-TechSpotter Posts: 14,523

    I'm not sure on your definition of "Clean Format"

    But here is the process to cleanly install Windows XP

    Microsoft's Windows XP Professional Repair Install step by step (* Including Delete Partition)

    Microsoft's Windows XP Home Repair Install step by step (* Including Delete Partition)

    * Warning deleting the Partition will remove all User data and Windows system files


    But I'm pretty positive that HijackThis would have shown the entry for "C:\.X.exe" of which could have been removed from there, or using OTCleanIt would have got it ;)

    Best to always do this guide: UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions
    And submit the logs so as Malware removal specialists can advise you further removal steps, if required

    Anyway, glad you got it resolved :)
  3. aoshater

    aoshater TS Rookie Topic Starter

    In reply to your reply

    Clean Format : During the first phases of the Windows installation, it asks if I would like to carry out:
    1) Format partition NTFS (quick)
    2) Format partition NTFS
    3)Leave filesystem intact

    I go for the second option. My guess is that this virus is located on my D: drive.

    Regarding HiJackThis, yes, It showed the .X.exe entry, and i'd repeatedly say " Fix this" and then i'd run the scan again, and it's still there. I have another PC with the same exact problem! So i'll try the OTCleanIt.

    Thanks for the reply,
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...