[Resolved] Slooowww computer, keeps freezing - can't get it cleane

After the last thing you had me do - the PC froze again. I didn't do much else with it, but I will now. Here is the text: User name HelpAssistant Full Name Remote Desktop Help Assistant Account Comment Account for Providing Remote Assistance User's comment Country code 000 (System Default) Account active Yes Account expires Never Password last set 3/2/2010 6:07 PM Password expires Never Password changeable 3/2/2010 6:07 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 3/2/2010 6:07 PM Logon hours allowed All Local Group Memberships *Administrators Global Group memberships *None The command completed successfully.

Hi,

Please do the following:

You may want to write down or print the following for reference.

Please delete the copy of HelpAsst_Mebroot_fix.exe you currently have and replace it with this one

Close out all other open programs and windows.

Double click the file to run it and follow any prompts.

When the tool completes, click Start>Run and type the following bolded command, then hit Enter.

mbr -f

Now, please do the Start>Run>mbr -f command a second time.

Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.

Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !

When it completes, a log will open.

Please post the contents of that log.

OK - It took me about 4 reboots to get this done - so the answer to how is your computer behaving, is that it is still freezing. Also there is a new pop-up error window upon re-boot:

Netdrive.exe - Unable to locate component
This application has failed to start because RFHelper.dll was not found. Re-installing the application may fix this problem.

So here is the log you requested:

C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
Tue 03/02/2010 at 21:27:47.56

HelpAssistant account was found to be Inactive
termsrv32.dll found ~ attempting to remove
Remove on reboot: C:\WINDOWS\system32\termsrv32.dll
HelpAssistant profile not found in registry

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Tue 03/02/2010 at 21:49:46.23

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators
The command completed successfully.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x895912D0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x895912d0
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x894ea330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !


~~ HelpAssistant directories found ~~

HelpAssistant
HelpAssistant.FAMILYDELL

~~ EOF ~~

Thanks for sticking with me on this!

Hi,

Please do the following:

Pleas go to Start > run > type in msconfig > OK

click on the startup tab

scroll down till you find the WebDriveTray entry and uncheck it

it will ask you to reboot > click OK

then boot into safe mode.

Make sure you have McAfee totally disabled, as it is known to interfere with our fixes sometimes:

to do that

Open McAfee Security Centre

• Under Common Tasks click on Home
• Click Computer Files
• Click Configure
• Make sure the following are disabled by ticking the "Off" button.
  
  

  Virus protection
  Spyware protection
  System Guards Protection
  Script Scanning Protection (you may have to scroll down to see it)

• Next, select never for "When to re-enable real time scanning"
• and click OK.

Now boot into safe mode

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY repeatedly,
• this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode
• Then press the Enter Key on your Keyboard
• go into your usual account

Once in safe mode repeat the steps from the previous post

Close out all other open programs and windows.

Double click the file HelpAsst_mebroot_fix.exe to run it and follow any prompts.

When the tool completes, click Start>Run and type the following bolded command, then hit Enter.

mbr -f

Now, please do the Start>Run>mbr -f command a second time.

Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.

Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !

When it completes, a log will open.

Please post the contents of that log.

Upon reboot to normal mode, you will be greeted with a message window from the System Configuration Utility. Check the box not to use and don't show, then click OK., just reboot back into normal Windows.

Started the last set of instructions last night. FInished the first step and the computer froze - so I called it a night and went to bed. THis morning, the computer will not boot. Actually, it booted to the first page with the user selections - but then I remembered that I was suppose to go into safe mode, so I shut it down and chose restart and booted into safe mode - made the safe mode selection, and I got a lack screen that initially says: Invalid boot.ini file THen continues to : Windows could not start because the following file is missing or corrupt: \system32\hal.dll Please re-install a copy of the above file. I'm searching the basement for a boot CD, and am thinking that you guys can't help me anymore. Unless you can think of something? Ahh well.

Hi,

we need to boot into the Recovery Console:

Please do the following:

• Restart your computer
• Before Windows loads, you will be prompted to choose which Operating System to start
• Use the up and down arrow key to select Microsoft Windows Recovery Console
• You must enter which Windows installation to log onto. Type 1 and press enter.
• At the C:\Windows prompt, type the following bolded text, and press Enter:

CHKDSK /r

This will check for bad sectors on your harddrive and recover the data if possible.

Let me know how this goes and if you are now able to boot normally.


If no luck, we still have other options

I can't find the choice you are suggesting. The only OS choice is Windows. And if I choose that, it goes to the same errors mentioned in my last post. It wouldn't boot into safe mode, or last known good coniguration or debugging mode. These are all on the Windows advanced Options menu. I can get to the boot device menu - but I don' really know what to do once I am there. help? I'm losing hope!

when you ran ComboFix, it installed the Recovery Console on your computer when you first boot up the computer you have about 2 seconds to choose what to log onto Windows XP or Recovery console If the Recovery Console is not an option, then that indicates that your boot.ini is corrupted. You will need an installation CD to be able to boot into the Recovery Console so we can repair it. Were you able to find your CD?

the menu to choose the Recovery Console is right after choosing boot option at the Advanced menu (F8)

Nope - there is no Recovery COnsole coming up. After F8 menu - there is only a Windows choice - and then it loops into the same error message about the boot.ini. BUT - even though my basement is an absolute MESS - I found some CDs. 1. OS reinstallation CD 2. Drivers and Utilities - need to change the boot sequence? I think I saw this as I messed with the re-boots. 3. Application CD for Dell Tools System Software I'm tempted to mess with this myself - but I think I will wait for your instructions so that I don't screw up. Thanks for sticking with me on this.

All of the freezing and hard shut downs has had some effect on your boot.ini which now appears to be corrupt,

It can be fixed, but we need to be able to boot to the recovery console to do it.


Your OS installation CD will have the recovery console on it.


Here are very clear instructions from Microsoft for what you need to do now:

http://support.microsoft.com/kb/314477

Follow the instructions in Method 2

Please let me know how that goes.

I booted to the CD. boot cfg /rebuild resulted in an error message: Failed to successfully scan disks for Windows installations. This error may be caused by a corrupt file system. CHKDSK /r resulted in: This volume appears to contain one or more unrecoverable problems. Isn't this lovely.

Hi,

All is not lost.

I am conferring with one of our experts on this matter.


I hope you have access to a computer that can burn CD's.

I would like you to make a Hiren's Boot CD.

Once you have done that, we will be back with further instructions this evening

To make the Hiren's Boot CD, you will be required to download a file to burn, and an app to burn it with (very small and simple to use), unless the machine already has software capable of burning an ISO and you know how to create a bootable cd with it.


Please download the Hiren's BootCD v10.0 + Keyboard Patch iso image from the following link, then extract the contents to a folder of it's own.

http://www.hirensbootcd.net/

Next download and install the ISO Recorder version for your operating system (the operating system that will be used to burn the cd).

Once ISO Recorder is installed, insert a blank cd then right click the Hiren'sBootCD.iso file in the Hiren's folder.

Select Copy Image to CD from the right click context menu.
Leave all settings to default in the CD Recording Wizard that opens and burn the disc.


When complete, insert the cd into the infected computer and restart.
You should be presented with a boot menu.

Select Start Mini Windows XP

Let me know if it successfully loads.

*Please do not restart the computer, nor do any other browsing or run any other programs, until I've responded with further instructions. Running from the bootable cd is like God mode, and anything you do could be irreversible.

If it doesn't load, you may need to change the boot order in the system BIOS.
To do so, you will need to press a key after the initial beep upon starting the computer (as soon as you see something on the sceen).
The key to press varies from system to system, but is generally either, Enter, Delete, or an F* function key. (a lot of times it's F2)

Often on the boot screen you will see 'Press *(* denotes name of the key to use) to enter setup". That's the key to press if you see it.

There are many different BIOS configurations, so I cannot give you specific instructions for proceeding without knowing exactly what you have.
What you will be looking for is commonly shown as Boot Order or Boot Options.
There will be choices of Hard Drive, CD-ROM and Floppy disk, at least.
The first boot device should be CD-ROM - change it if necessary.
Second should be Hard Drive.
Once verifying the CD-ROM is set as the first boot device, exit setup, saving the changes.
The computer will restart and if the Hiren's disc is in the drive, and properly burned, it should boot to the cd where you will see the option to boot Mini XP.

*You should also be able to look up the manual for your computer online for specific instructions to enter setup and adjust the boot order, should the above not be helpful.

Let me know if you can successfully load the boot CD, then we'll be back with further instructions.

The infected PC is the primary workhorse here. I have a netbook. Slow, minmal, no CD at all. My husband has a work laptop - he will be home tonight, but may object to my "goofing" with his work PC. I do have an exernal DVD burner. That won't do it, will it? Is it very risky for me to make that boot disk on the other PC? Could I screw up his PC? BTW - in order to boot from the OS CD, I already had to change the boot order - it was F12 and pretty easy to do. I have a backup of this infected PC. How horrible would it be to wipe this hard drive and start over? Would I just be restoring the infection again?

Because the infection that you had infected the MBR it's hard to know if it would get restored, plus from what you are experiencing now, it appears to be more than just an infection, this appears to be related to all the freezing and hard shut downs, sectors of your harddrive appear to be corrupted. I will have to look into that and let you know. You can do no harm to the other computer at all by burning a Hiren's boot CD and having an ISO burner Utility is handy to have installed or it can easily be uninstalled once you are done.