Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 22 subscribers
  • Views 17432 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HPmal/Crusher-Y virus/spyware

khang le

Hi everyone,

    I have a problem today. the email:"

File "C:\Windows\System32\cmd.exe" belongs to virus/spyware 'HPmal/Crusher-Y': Process killed."  is sent every time when users login the computer. 

I need to research and find out causes and solutions for this problem.

I try to find the previous emails of these users which contains something like virus or spyware from flash drives, infected websites,... but I didn't see anything, just emails like that.

I search Google but the information I found is very common and I am not sure about them:

  • Downloads from questionable websites
  • Infected email attachments
  • External media, such as pen drive, DVD, and memory card already infected with HPmal/Kovter-A
  • Fake updates that trick you installing them
  • Programs posing as fake virus removal tools
  • Infected documents circulating on peer-to-peer (P2P) file sharing networks, torrent sites, and IRC channels

SO, anyone used to meet this problem, please tell me the main causes you found .

Many thanks,

Khang



This thread was automatically locked due to age.
Parents
  • +1

    Hello Khang,

    the detection is likely caused by the shell (cmd.exe) running an as yet unknown malicious script. The might be preceding somethings but these are not what cmd.exe runs as they would have already been blocked.
    As you say it's when users log in you should check what is run when they do - Sysinternal's AutoRuns should help to identify the offending file(s). Please submit a sample of you have found.

    Christian

Reply
  • +1

    Hello Khang,

    the detection is likely caused by the shell (cmd.exe) running an as yet unknown malicious script. The might be preceding somethings but these are not what cmd.exe runs as they would have already been blocked.
    As you say it's when users log in you should check what is run when they do - Sysinternal's AutoRuns should help to identify the offending file(s). Please submit a sample of you have found.

    Christian

Children
Unfiltered HTML