Hekp with clcr.exe

vanity | 12/19/2008 | vanity

[prisoner6]

Can someone help me with the clcr.exe virus? I usually don't have problems like this but this is on my oldest son's computer as well as some of the ones I use at work.

It won't allow hijackthis to run or trend micro. We can't download anti virus spyware. If we try to look up via CERT we get redirects.

ANY help or info is GREATLY apriciated.

THANKS!

prisoner6

[prisoner6]

I usually don't have problems like this but this one has me stumped. Hopefully I don't have to reformat the HD.

prisoner6

[Cementjungle]

http://answers.yahoo.com/question/index?qid=20070325044238AA6CYDF

[Walmartian]

http://www.bleepingcomputer.com/forums/index.php?showtopic=136075&hl=clcr.exe

[LiberConservative]

I’m afraid you are hosed. By the time the system is contaminated it most likely has buried itself deep into your system, making it impossible to remove. Reformat. Reinstall everything. Sorry.

[End Times Sentinel]

It won't allow hijackthis to run or trend micro. We can't download anti virus spyware. If we try to look up via CERT we get redirects.

You throw out the most complex, inside baseball, highly technical statement I've ever heard, and yet you need to ask others something about computers?

There must be a WHOLE lot more to computers than I ever thought...

Owl_Eagle

“When the stock market crashed,
Franklin Roosevelt got on the television
and didn’t just talk about
the princes of greed, he said,
‘Look, here’s what happened.’"
-Slow Joe Biden

[traderrob6]

http://forums.spybot.info/archive/index.php/t-14796.html

[an amused spectator]

What's your operating system?

And, can you get taskmgr.exe to run, in order to kill the process?

[AppyPappy]

Those are typical places to look for virus help.

[AppyPappy]

Boot into Safe Mode and go to Norton’s site. I think it has a web-based anti-virus scanner

[mysterio]

I would use Malware bytes. This program fixed my system from a couple other serious virus attacks. Make sure and click "update" befo0re you run it the first time.

[traderrob6]

“I’m afraid you are hosed. By the time the system is contaminated it most likely has buried itself deep into your system, making it impossible to remove. Reformat. Reinstall everything. Sorry.”

Bull.

[mysterio]

Nah, you can still fix most of the pretty bad viruses. It's a matter of having the right cleaner and running in safe mode.

If the virus redirects your browser links, surf the net through a proxy server just like you would use to get around an internet block at work.

I had to do this two months ago during a viral attack of my system.

[Eagle50AE]

f8 at boot up to safe mode

go to control panel , users , create a new user with administrator rights

reboot under the Additional new created administrator account

if you are sure of the name of the file and you cant delete it use unlocker avail at major-geeks

if your not sure run avast boot up scan or bitdefender scan
or a-squared scan or avg..

always be prepared to reformat /reinstall ,etc.. and take all advise (mine) as a suggestion, I would Not want to contribute to the trashing of your system, so obtain many suggestions and roll the dice...

[IYAS9YAS]

If the virus redirects your browser links, surf the net through a proxy server just like you would use to get around an internet block at work.

How does one do that?

[NRPM]

Sometimes the best way to get rid of a problem like that is to boot the computer off a cd. That way the virus isn’t running and you can just delete the files.

You can use a Windows XP install disk to do this if you go to the repair console. Or there’s BartPE, which you can use to create a live Windows CD. Or I use Puppy Linux, a nice small linux distro that boots off a cd or flash drive.

Good luck! Virus authors are evil.

[ScreamingFist]

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I removed this from a friends computer using ComboFix. Read all at the link and be sure you understand ComboFix isn't for beginners. Good luck.

[Beeline]

Its been my exp. that some of these viruses attach themselves
to windows systems procs and cant be deleted by standard
anti-virus programs , unless the anti-virus program has a reboot sequence and deals with it before windows fully loads.
If you’ve got inadequate anti-virus protection, whereas it recognizes the virus and deletes associated files while Windows is fully on,
then the virus reacts and creates new files with new names,
with every reboot. By the time you get a top-notch anti-virus
program installed, the virus may have done so many new file
iterations that the new and good Anti-virus program just isnt programmed to follow that deep into the file iterations. The good anti-virus program may only be programmed with the assumption that you are only dealing with relatively newly acquired virus’s, not ones that have been dealt with inadequately by an inadequate anti-virus program, have ‘burrowed’ repeatedly with new file names, etc.
Been there done that.
For instance MalwareBytes Anti-virus program would
be an inadequate anti-virus program for such a ‘burrowing’
virus that attaches to windows procs.
Try Kaspersky Anti-Virus/ Internet Suite.

As to the call of ‘Bull’.
Restrain yourself matador.

[waynesa98]

http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

this is a direct download link to a very good freeware anti malware program, When you install make sure to update the definitions(you can also update from the scan page, some times the update link on the mail page does not work)

http://security.symantec.com/sscv6/Setup.exe direct link to symantec’s antivirus scanner this is a program that scans but does not correct infections.

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html link to download hijack this. an excellent program for finding and getting various forums to help you kill infections.

[mysterio]

You have to be careful with free proxy servers, but last I checked, freeproxyserver.net was still on the up and up. You just type the URL you want and you view the site through a window. I would be careful about logging in to an email or account somewhere, though, because some of the proxy servers record login info and use your account to spam. I had that happen at a different site with my myspace. But like I said, I think the link I gave you is still pretty legit, and it works well for viewing sites that are blocked.

[traderrob6]

Perhaps you should take your own advice.