msa.exe ... I don't know what to do

[kingrobert]

I get to work tonight and the computer is severely slowed down.

Checking task manager, I see there is about 40+ instances of msa.exe running. A quick google search on another computer shows this is a virus. I try to run spybot but the computer is so slowed down after 4 hours of scanning it had only gone through about 20,000 files, and had only picked up some spyware files so far.

I went to reboot in the hopes of shuting down msa.exe and getting a scan off before the whole computer slows to nothing.

When the computer boots back up, all I get is a black screen and a mouse cursor. ctrl+alt+del brings up task manager, which shows no msa.exe (although there was a b.exe once that seemed fishy), but I can't seem to run any other programs.

Starting up in Safe Mode is the same thing. It has the "Safe Mode" text in the 4 corners, but other than that its a black screen and a mouse cursor.

safe mode w/ command prompt brings up the command prompt, but I don't know it well enough to try and fix this. I did find msa.exe in the windows directory and deleted it through the command prompt, but it still starts up with the black screen and mouse cursor.

This is a work computer, half a dozen employees have access to it. I'm not sure where the windows CD is. I'm on another computer right now, even in safe mode all I can seem to access on the problem computer is the command prompt.

Any advice would be greatly appreciated.

-Robert

[Blade81]

Hi,

Please see our Before You Post (http://forums.spybot.info/showthread.php?t=288) topic:

The malware removal forum is set up to help those in need of assistance with their personal computers. This service is free and provided by volunteers.

If you are a computer business claiming to remove malware for your paying customers, our volunteers are not here to support such. Clients with infected PCs may be directed to this forum to receive free advice in the first person.

---------------------------------------------

Note:
When the infected computer in question is a company machine in the workplace, or you are an employee.


The intention of this forum is not to replace a company's IT department, nor can we anticipate alterations or configurations that may have been made to a business machine, or how it will interact with the tools commonly used in the removal of malware.

The majority of the tools used in this forum are only free for Home Users and only tested on Home machines, they may well change settings that are required for a Company network. Another consideration is that company information may show in the logs.

More than one machine could be at stake, possibly even the server. If sensitive material has been compromised by an infection, the company could be held liable.

To prevent any possible loss or corruption of company information, please inform your IT Professional or Supervisor when a workplace computer has been infected, immediately.

It's not that we don't want to help, but there are too many issues that could arise from a networked company machine that malware forum volunteers are not experienced in dealing with.

Thank you for your understanding.
--------------------------------------------
As Malware removal forum volunteers are unable to assist users with infected Corporate, Government, Small Business or Institutional machines, please contact our office support so they may provide direct assistance for your needs. Thank you. :)

Spybot S&D Corporate-Small Business Editions (http://www.safer-networking.ie/en/index.html)
For more information, please send an email to licenses(at)spybot.info

Regards.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.