Troubleshoot a suspected Malware infection

[TalinF]

I contain a trouble with my laptop, and suspect it might be malware. On boot, and then, I find terrible Image faults of the kind under:

1. mcuicnt.exe - Bad Image "C:\Windows\system32\ieframe.dll is also not intended to run on Windows or it has an error etc"
2. control.exe - Bad Image "C:\Windows\system32\ieframe.dll is also not intended to run on Windows or it has an error etc"

The majority of programs doesn’t work at all, or load and run with many of same type of error. E.g. cannot run Outlook, Internet Explorer and McAfee anti-virus etc. SP2 update is waiting on taskbar, but be unsuccessful on update due to these errors. It is possible that they started happening during I've run update effort. I be grateful for your time and would be thankful for any suggestions.

[Milton.J]

After you are prepared to eliminate Antimalware, you will have to make a selection. The initial way that you can find clears of the Antimalware program is by physically removing the files which are connected with the program itself. The next way is judgment a program which is intended to get rid of the Antimalware program. When you have to be the one to make the final choice, except you are fairly knowledgeable with program elimination, your best bet is to find a reputable security application that can help you eliminate it from your computer. Your best bet for Antimalware removal is to use dependable security software. “STOPzilla” by IS3 is my personal advice to remove this annoyance. There are, though, many programs out there that can help. Make sure you do your investigate before you invest in one. One time you decide a program which is right for you, download and install it on your computer drive. You will wish for to update it right away, and then be certain it executes a deeps can on your computer. It should automatically take away Antimalware from your computer system, as well as any other trouble programs. No matter which Antimalware exclusion method you prefer, make sure that you do eliminate this program from your system pose a security risk to your computer.
Delete following listed some Registry Entries:

1. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallAntiMalware
2. HKEY_LOCAL_MACHINESOFTWAREAntiMalware
3. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShell ExtensionsApproved "{5E2121EE-0300-11D4-8D3B-444553540000}"
4. HKEY_LOCAL_MACHINESOFTWAREActive Security
5. HKEY_CLASSES_ROOTCLSID{5E2121EE-0300-11D4-8D3B-444553540000}
6. HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "AntiMalware"

After deleting Registry files delete following Files:

1. antimalware.exe
2. uninstall.exe
3. C: Program FilesAntiMalware
4. amext.dll
5. AntiMalware Support.lnk
6. help.ico malw.db
7. Uninstall AntiMalware.lnk
8. C: Documents and SettingsAll UsersStart MenuProgramsAntiMalware%Temp%

[Spyrus]

There is software Malwarebytes Anti-Malware, Just download it. After downloading the software, just double Click on mbam-setup.exe to install it. Make certain a checkmark is located after that to Launch Malwarebytes Anti-Malware and Update Malwarebytes Anti-Malware, then simply clicks on Finish. If you found any update, then just download it and install the latest version. One time the program has loaded, select Perform Quick Scan’, and then click just on Scan. The scan may obtain a few times to complete, so please wait for a while. After the scan is complete, then simply click OK. Make certain that all is checked, and click Remove Selected. When disinfection is over, the log will open in Notepad and you can be provoked to Restart. Download ‘Combofix’, and yes it is vital that it is saved straight to your desktop.

1. Shut down any open browsers.
2. Close every antivirus and anti malware programs so they do not obstruct with the running of ‘ComboFix’.

[Snake08]

Please go behind the under steps if you think that you may be infected with a threat which your Symantec product is not spotting:

1. Make sure you have the latest virus descriptions by running ‘Live Update’.
2. Run a complete system scan, eliminating any malicious files which are noticed.

If, after following the over steps, no threat is originate, ensure for any newly created or doubtful files in the following locations:

1. C:\Documents and Settings\All Users\Start Menu\Programs\Startup
2. C:\Documents and Settings\[user name]\Start Menu\Programs\Startup
3. C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
4. C:\Documents and Settings\Default User\Start Menu\Programs\Startup
5. C:\WinNT\Profiles\All Users\Start Menu\Programs\Startup
6. C:\WinNT\Profiles\[user name]\Start Menu\Programs\Startup
7. C:\WinNT\Profiles\Administrator\Start Menu\Programs\Startup
8. C:\WinNT\Profiles\Default User\Start Menu\Programs\Startup
9. C:\Windows\Start Menu\Programs\Startup
10. C:\Windows\All Users\Start Menu\Programs\Startup

Check the ordinary loading point for one suspicious file using the ‘msconfig’ utility:
For Windows XP

• First click on Start- Run. You see a run window.
• In the run box, type ‘msconfig’ and just click OK. The System Configuration Utility shows.
• Then click on the General tab - Selective Startup - Startup tab.
• Scroll through the list of files.
• If you see a distrustful file, then just note down the name.
• After you are completed, click on Cancel to close the System Configuration Utility.

Check registry load points:

• Click Start - Run.
• In the run box, type’ regedit’ which opens the registry file, and then click OK.
• Browse to the following registry keys.

HKEY_CURRENT_USER\Software\Microsoft\Windows\currentversion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\currentversion\runonce
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\currentversion\runservices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\currentversion\runservicesonce

HKEY_CURRENT_USER\Software\Microsoft\Windows\currentversion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\windowsnt\currentversion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\currentversion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\currentversion\runonce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\runonceex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\currentversion\runservices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\currentversion\runservicesonce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windowsnt\currentversion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windowsnt\currentversion\Winlogon
HKEY_LOCAL_MACHINE\Software\Microsoft\windowsnt\currentversion\Windows\appinit_dlls
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\currentversion\Explorer\sharedtaskscheduler
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\Software\Microsoft\SharedTools\MSConfig\startupfolder
HKEY_LOCAL_MACHINE\Software\Microsoft\SharedTools\MSConfig\startupreg
I think this is enough for you to troubleshoot a suspected Malware infection