W.32 Licum And Norton Antivirus Killed My PC

jry106 · 04-14-2006, 06:15 AM

My PC was infected with w32.licum. I installed norton antivirus, which 'sucessfully installed'. I had to restart my pc, now whenever i attempt to log on, it logs out straight away, whenever I attempt to do a system restore it blue-screens. HELP!!

~~whodat~~ · 04-14-2006, 06:25 AM

welcome

try to get in via safe mode..tap f8 a few times on first boot

try system restore

if you have a functioning computer, run the 5 step procedure in my sig

there are better options than norton when you are ready, just ask.

good luck

Jimmy Abel · 04-14-2006, 08:22 AM

i have always used norton... when i used AVG and panda antivirus i got loaded with infections and lost everything on my machine...
i have seen a problem like this before, when you log into windows does it load the blank desktop and then log you straight out again??
if so, its caused by a registry edit by a virus, a funner virus is the variation i removed but it could be the same in this situation...

edit: after reading about the licum worm i really don't think that is your problem... take a look at the funner worm (http://securityresponse.symantec.com...32.funner.html) and how to remove it, its pretty easy if you follow the steps... and im pretty sure thats your problem, correct me if im wrong

~~whodat~~ · 04-14-2006, 09:23 AM

well the consensus on this forum is that norton is a resource hog.. and a pain in the butt.

the issue at hand is to get the operating system back on.. hopefully in safe mode.

if that is accomplished, try and run the 5 step procedure in my sig. and the security analysts will guide you through the repairs.

jry106 · 04-14-2006, 10:10 AM

Quote:

Originally Posted by Jimmy Abel

i have always used norton... when i used AVG and panda antivirus i got loaded with infections and lost everything on my machine...
i have seen a problem like this before, when you log into windows does it load the blank desktop and then log you straight out again??
if so, its caused by a registry edit by a virus, a funner virus is the variation i removed but it could be the same in this situation...

edit: after reading about the licum worm i really don't think that is your problem... take a look at the funner worm (http://securityresponse.symantec.com...32.funner.html) and how to remove it, its pretty easy if you follow the steps... and im pretty sure thats your problem, correct me if im wrong

Yes, it does load a blank desktop and then a welcome screen, whenever i try to open windows in safe ,mode it does the same thing.

Jimmy Abel · 04-15-2006, 04:33 AM

from past experience with this virus, you cannot get into safe mode, because the virus renames a file called "userinit.exe" in the registry and calls itself "userinit32.exe" in its place... upon logging into windows the system loads this file but obviously cannot because it has been renamed, so it logs you straight out again... the only way i could get into windows is to use the recovery console to replace the file userinit.exe... but i cannot remember for the life of me what the code was

~~whodat~~ · 04-15-2006, 05:01 AM

moving thread to security

jry106 · 04-16-2006, 03:38 PM

I have tried to use recovery console but it just blue-screens.

**Horse** · 04-17-2006, 11:46 AM

Welcome to TSF

Please create a folder at C:\HJT or another permanent location of your choice and download. HijackThis to the folder you created. This program will help us determine if there is any malware on your computer.

Before going any further, follow the link in my signature to Microbell's 5 Step Process and carry out the instructions. Once you have completed the applicable steps -

Double-click on the file you just downloaded.
If it gives you an intro screen, Select - Do a system scan and save a logfile.
If you don't get the intro screen, Press Scan and then click on Save log.
Post the HiJackThis log file, including the header information, back into this thread.

_________________________________________________

04-14-2006, 06:15 AM	#1 (permalink)
jry106 Registered User Join Date: Apr 2006 Location: London, UK Posts: 3 OS: Mac OS10.4.3	W.32 Licum And Norton Antivirus Killed My PC My PC was infected with w32.licum. I installed norton antivirus, which 'sucessfully installed'. I had to restart my pc, now whenever i attempt to log on, it logs out straight away, whenever I attempt to do a system restore it blue-screens. HELP!! Last edited by jry106; 04-14-2006 at 06:20 AM.

04-14-2006, 08:22 AM	#3 (permalink)
Jimmy Abel Registered User Join Date: Apr 2006 Location: England Posts: 20 OS: WinXP	i have always used norton... when i used AVG and panda antivirus i got loaded with infections and lost everything on my machine... i have seen a problem like this before, when you log into windows does it load the blank desktop and then log you straight out again?? if so, its caused by a registry edit by a virus, a funner virus is the variation i removed but it could be the same in this situation... edit: after reading about the licum worm i really don't think that is your problem... take a look at the funner worm (http://securityresponse.symantec.com...32.funner.html) and how to remove it, its pretty easy if you follow the steps... and im pretty sure thats your problem, correct me if im wrong Last edited by Jimmy Abel; 04-14-2006 at 08:24 AM.

04-17-2006, 11:46 AM	#9 (permalink)
Horse General Manager (Administrator) Join Date: Oct 2003 Location: Durban South Africa Posts: 4,297 OS: WIN XP PRO My System Blog Entries: 1	Welcome to TSF Please create a folder at C:\HJT or another permanent location of your choice and download. HijackThis to the folder you created. This program will help us determine if there is any malware on your computer. Before going any further, follow the link in my signature to Microbell's 5 Step Process and carry out the instructions. Once you have completed the applicable steps - Double-click on the file you just downloaded. If it gives you an intro screen, Select - Do a system scan and save a logfile. If you don't get the intro screen, Press Scan and then click on Save log. Post the HiJackThis log file, including the header information, back into this thread. _________________________________________________ __________________ Know where you're going in life. You may already be there

04-14-2006, 06:25 AM	#2 (permalink)
~~whodat~~ Register user Join Date: Mar 2005 Posts: 5,931 OS: XP	welcome try to get in via safe mode..tap f8 a few times on first boot try system restore if you have a functioning computer, run the 5 step procedure in my sig there are better options than norton when you are ready, just ask. good luck

04-14-2006, 09:23 AM	#4 (permalink)
~~whodat~~ Register user Join Date: Mar 2005 Posts: 5,931 OS: XP	well the consensus on this forum is that norton is a resource hog.. and a pain in the butt. the issue at hand is to get the operating system back on.. hopefully in safe mode. if that is accomplished, try and run the 5 step procedure in my sig. and the security analysts will guide you through the repairs.

04-15-2006, 04:33 AM	#6 (permalink)
Jimmy Abel Registered User Join Date: Apr 2006 Location: England Posts: 20 OS: WinXP	from past experience with this virus, you cannot get into safe mode, because the virus renames a file called "userinit.exe" in the registry and calls itself "userinit32.exe" in its place... upon logging into windows the system loads this file but obviously cannot because it has been renamed, so it logs you straight out again... the only way i could get into windows is to use the recovery console to replace the file userinit.exe... but i cannot remember for the life of me what the code was

04-15-2006, 05:01 AM	#7 (permalink)
~~whodat~~ Register user Join Date: Mar 2005 Posts: 5,931 OS: XP	moving thread to security

04-16-2006, 03:38 PM	#8 (permalink)
jry106 Registered User Join Date: Apr 2006 Location: London, UK Posts: 3 OS: Mac OS10.4.3	I have tried to use recovery console but it just blue-screens.