Winlvh32.rom

BlackEdelweiss · 28-12-2010 9:10am #1

I have a brand new(1 month old) Toshiba laptop and for the past few weeks when I start it up I get an error message saying "There was a problem starting Winlvh32.rom". What does this mean and what can I do about it. I havent downloaded anything since I got the computer apart from a game from a trusted website last night and this would not run either as it said certain files were missing on the computer. It crashed the last night when I connected one of the kids presents to it to install software.I just feel it is not very stable overall. Any suggestions?

Hissing Sid · 28-12-2010 9:24am

You've got Virtumondo malware.
Get some malware removal software like spybot to remove it.

BlackEdelweiss · 28-12-2010 9:52am

I am running spybot but it keeps flashing up messages saying important registry entries have been changed. It asks do I want to allow or deny changes, which do I do?

Hissing Sid · 28-12-2010 9:56am

Deny the changes.
Run the updates.
Run the scan and allow it to fix any problems it encounters.
Then run the scan again.
Hopefully that will clear it.

BlackEdelweiss · 28-12-2010 10:25am

Spybot found 42 problems and has fixed all but 1 which it says I need to run a scan as an administrator but my account is already set up as administrator. The problem file is Win32.autorun.tmp. What next?

bhickey · 28-12-2010 10:44am

BlackEdelweiss wrote: »

Spybot found 42 problems and has fixed all but 1 which it says I need to run a scan as an administrator but my account is already set up as administrator. The problem file is Win32.autorun.tmp. What next?

Does it say what the problem is with the file, i.e. does it identify a specific virus/malware?

You should probably reboot into 'Safe Mode with Networking' and run Spybot that way. Also while you're at it, try the instructions here. The instructions do refer specifically to Virtumondo but they are generic enough to apply to many other infections too.

BlackEdelweiss · 28-12-2010 11:09am

How do I reboot into safe mode? I had to do it with my last laptop but I just cant remember which button to press.

bhickey · 28-12-2010 11:19am

BlackEdelweiss wrote: »

How do I reboot into safe mode? I had to do it with my last laptop but I just cant remember which button to press.

Keep tapping the <F8 > key as soon as the computer starts to boot.

Alanstrainor · 28-12-2010 11:20am

Moved to virus and malware removal.

BlackEdelweiss · 28-12-2010 11:35am

Sorry I was in the wrong section. I rebooted in safe mode ran spybot, it fixed the win32 problem but I still get the original winlvh32 message when I start up.

bhickey · 28-12-2010 11:38am

BlackEdelweiss wrote: »

Sorry I was in the wrong section. I rebooted in safe mode ran spybot, it fixed the win32 problem but I still get the original winlvh32 message when I start up.

Run 'msconfig' and look in the Startup section to see if something is starting it there. Also, for a second opinion, dowload, install, update and run Malwarebytes in 'Safe Mode with Networking' .

What antivirus software is on the machine and is it up-to-date?

BlackEdelweiss · 28-12-2010 12:19pm

I dident know what I was looking for in msconfig but I dident see anything that looked like win32. I ran malaware bites in safe mode and it found a thing called backdoor.bot which it removed. I then ran spybot after i restarted and am still getting the win32 fault, it does remove it now but it is there straight away when I run spybot again. The anti virus stuff that came with the laptop is McAfee but I have never installed it or done anything to it so I dont know if it is on or not. I was always told not to bother with antivirus software as they were not up to much anyway.

bhickey · 28-12-2010 12:31pm

BlackEdelweiss wrote: »

I dident know what I was looking for in msconfig but I dident see anything that looked like win32

I suppose really you're looking for anything that looks odd. If you download and run DDS, you can post the Attach.txt and DDS.txt files that it generates. They will provide more information on what's running on your system.

I ran malaware bites in safe mode and it found a thing called backdoor.bot which it removed. I then ran spybot after i restarted and am still getting the win32 fault, it does remove it now but it is there straight away when I run spybot again.

Can you download the Bitdefender Rescue CD, burn it to a CD and then boot from it? It will allow you to scan the computer without loading Windows and that helps catch some of the infections that hide themselves when Windows loads.

The anti virus stuff that came with the laptop is McAfee but I have never installed it or done anything to it so I dont know if it is on or not. I was always told not to bother with antivirus software as they were not up to much anyway.

I'd uninstall McAfee and install MSE (Microsft Security Essentials) instead.

BlackEdelweiss · 28-12-2010 12:37pm

Thanks for all the help. Is this something that is going to get worse if I dont sort it out now or can I just ignore it?

bhickey · 28-12-2010 12:39pm

BlackEdelweiss wrote: »

Is this something that is going to get worse if I dont sort it out now or can I just ignore it?

Any infection is bad 'cause you can never be sure what it's doing. You need to remove infections as soon as you are aware of them and then make whatever changes are necessary to reduce the chances of getting infected in the future. Yes it would almost certainly get worse if you don't tackle it now.

Winlvh32.rom

Comments