[boboboob]

Okay I have a friend at work and her computer got work. She was having computer problems so me and my dad said we would look at it. We bought the computer home.

When we boot up normally it just gives us this and that is it.

We talked to her about when it started acting up and she said it would say things like you have illegal porn on your computer or something.

We can't do anything when we boot up. We can use the mouse but that is it. Cntrl alt delete alt f4 don't work.

So we boot up in safe mode and and it just stays at a black screen but with safe mode writen in the corners and xp sp2 thing at the top. We try using cntrl alt delete their and it says task manager has been disabel by your administer so we hit a dead end their.

After that I boot up in safe mode with command prompt and I typed task list in the command prompt and I looked at the few commands their and I saw wmsdkns.exe and could tell that it was obviously fake looked it up and it was. So uhhhh not exactly what to do here. I can tell that wmsdkns.exe is the problem but not sure how to get rid of it.

Ohhh one more thing I it has a fake scanner to that ays it has some viruses it looks like. Called windows security center or something.

Any one have any ideas besides formating it?

So thanks for any help if you have any suggestions . This site seems nice also.

Edited by boboboob, 15 May 2008 - 04:47 PM.

[Advertisements]

has been disabel by your administer so we hit a dead end their.

This makes me think it's a corporate machine. (Belonging to the work.)
If this is the case. I suggest you take it to the IT Department at work.

If this is not the case. Then I Suggest you take your log to the malware doctors found in this forum.
Please make sure that you read this before posting anything in the malware forum.

If you're still having problems after the malware doctors declare your log clean feel free to post back here and we'll help you to the best of our knowledge!

Regards,
Olrik

[Artellos]

has been disabel by your administer so we hit a dead end their.

This makes me think it's a corporate machine. (Belonging to the work.)
If this is the case. I suggest you take it to the IT Department at work.

If this is not the case. Then I Suggest you take your log to the malware doctors found in this forum.
Please make sure that you read this before posting anything in the malware forum.

If you're still having problems after the malware doctors declare your log clean feel free to post back here and we'll help you to the best of our knowledge!

Regards,
Olrik

[bdesmond -MVP-]

Get the PID of the suspicious processes and use taskkill to kill them. See if that helps.

[ScHwErV]

Please follow the directions from Artellos and post your information in the Malware Removal forum.

ScHwErV

[boboboob]

has been disabel by your administer so we hit a dead end their.

This makes me think it's a corporate machine. (Belonging to the work.)
If this is the case. I suggest you take it to the IT Department at work.

If this is not the case. Then I Suggest you take your log to the malware doctors found in this forum.
Please make sure that you read this before posting anything in the malware forum.

If you're still having problems after the malware doctors declare your log clean feel free to post back here and we'll help you to the best of our knowledge!

Regards,
Olrik

Sorry to mislead you :0. It isn't a corporate machine it is her own personal computer (uses xp pro and we are using the admin account) and sorry I also forgot to mention this but my dad went to college for it and has a degree in it and he runs a home business repairing and building em but I help him every now and then on challenging problems like this one.

Ohhh And I am sorry about not making it clear enough that we can't install anything or run any programs because the virus prevents us even in safe mode. Only thing we can do is use the command prompt.

After viewing it has a rouge anti-virus also called windows security center (not the real one it looks very different). We saw it when in safe mode with command prompt because it popped up all of the sudden.

Get the PID of the suspicious processes and use taskkill to kill them. See if that helps.

I would but task manager has been disabled. Unless their is a way to disable exe's using the command prompt.


Anyways I think this one is looking like a format... ugh and I really wanna know what is the root cause.

Edited by boboboob, 17 May 2008 - 12:39 AM.

[Artellos]

Just post in the malware forum explaining all this. I'm pretty sure our malware experts will be able to help you.

Regards,
Olrik