system keeps rebooting from start-up - is-CLHID.exe cannot be foun

[kipg]

My computer was recently infected with a malware and I was able to get rid of
it. However a new problem has emerged. Now, upon start up, my computer begins
to re-boot repeatedly. When it finally stops this and my desktop appears, a
window appears that says something to the effect that
'C:\WINDOWS\is-CLHID.exe' file cannot be found. I then click "ok" and my
system reboots and the cycle begins all over again. The other button option
is to 'locate file,' but that seems pretty useless. Now to do anything on my
computer (as in posting this query), I am doing so in safe mode. I run MS
home XP, sp 3. Is it possible that I deleted this file off my computer when I
deleted the malware? Can anyone offer a clue - or provide me with a link to
download the missing .exe? Probably not that simple..... Thanks for your
help.

 

[Leonard Grey]

Is-CLHID.exe is not a Windows XP system file.

Either:

1- Your computer is still infected.
2- Removal of the initial malware is incomplete.

I suggest:

1- Ask for help from your malware-removing-program's technical support.
2- Try another malware detector.
3- Show the computer to a professional.

 

[Patrick Keenan]

My computer was recently infected with a malware and I was able to get rid
of
it. However a new problem has emerged. Now, upon start up, my computer
begins
to re-boot repeatedly. When it finally stops this and my desktop appears,
a
window appears that says something to the effect that
'C:\WINDOWS\is-CLHID.exe' file cannot be found.

This is good. It shouldn't be there.

I then click "ok" and my
system reboots and the cycle begins all over again.

This is bad, and indicates either further infection or system damage.

The other button option
is to 'locate file,' but that seems pretty useless. Now to do anything on
my
computer (as in posting this query), I am doing so in safe mode. I run MS
home XP, sp 3. Is it possible that I deleted this file off my computer
when I
deleted the malware? Can anyone offer a clue - or provide me with a link
to
download the missing .exe? Probably not that simple..... Thanks for your
help.

I agree with LG that this message is an effect of malware. The launcher
references are still in place, and must be removed manually; as well, there
are quite possibly other infected files still running. (If you can
identify them, you may not be able to delete them, but you may well be able
to *rename* them, and after rebooting delete them. I usually rename to an
extention of '.BAD', so it's easy to find them.


Yes, it's not only possible but likely that you deleted the file, and you
*should have*, because it is almost certainly malware. You do *not* want
to reinstall it.

Instead, you should start with clearing out the temporary internet files
and Temp folders (the free utility ccleaner works well for this) and also
run tools such as HiJackThis and Malware Bytes.

The rebooting issue is another story. This is likely and automatic restart
at a crash; right-click on My Computer, choose Properties, Advanced tab, in
the Startup and Recovery section click on Settings, then de-select
"Automatically restart". Choose OK and/or Apply back to the desktop, and
reboot.

This won't fix anything, but will let you see the error message associated
with the crash that's triggering the restart. With that information, you
can step towards fixing that problem.

If you can't reboot the system, start with attaching the drive to another
system and clearing the temp files from there, and scanning the drive with
up-to-date malware tools.

It may be that you need qualified help with this. Have them start with
taking a copy of your data files - this is easy to do once the drive is
attached to another system. You don't want to compound the problem by
losing data, and it's easy to prevent that.

HTH
-pk

 

[Gerry]

kipg

Can you check the name is-CLHID.exe.

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[kipg]

Leonard, Patrick and Gerry, Thank you all for your suggestions. I did a
registry search and deleted the .exe (I found it in 2 places) and I disabled
auto restart. Upon rebooting a blue window appeared with a stop message. I
rebooted and it happened again. With slight variations from the first stop
message, this last one read: 0xc000000ae (0xc0000005, 0xB86028D3, 0xF7A0B968,
0x00000000) then *** 00001099 - address B68028D3 BASE at B8602000, datestamp
49C97A84

I have no idea wtf this means, but upon restarting my system a third time,
it booted up and I then got a scheduled agent error window indicating that
'shell notification cannot create icon.' I clicked ok and so far it seems
things are back to normal. But I remain skeptical for some reason. If you
have no further enlightening suggestions, again, I thank you all. ~k

 

[Gerry]

kipg

Ouch!!!

Hacking at the Registry without knowing what an entry means is not the
right thing to do!


--


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Elmo]

Leonard, Patrick and Gerry, Thank you all for your suggestions. I did a
registry search and deleted the .exe (I found it in 2 places) and I disabled
auto restart. Upon rebooting a blue window appeared with a stop message. I
rebooted and it happened again. With slight variations from the first stop
message, this last one read: 0xc000000ae (0xc0000005, 0xB86028D3, 0xF7A0B968,
0x00000000) then *** 00001099 - address B68028D3 BASE at B8602000, datestamp
49C97A84

I have no idea wtf this means, but upon restarting my system a third time,
it booted up and I then got a scheduled agent error window indicating that
'shell notification cannot create icon.' I clicked ok and so far it seems
things are back to normal. But I remain skeptical for some reason. If you
have no further enlightening suggestions, again, I thank you all. ~k

If one place you found it was after the shell command and it looked
something like this:

Explorer.exe is-CLHID.exe

...then you needed to edit the entry to read:

Explorer.exe

Hopefully you won't have any more problems from it though.