What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Slooowww computer, keeps freezing - can't get it cleane

55 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #61
Woo-Hoo! I ran a Combo-fix - and I think it might have really run well -

Here's the log:

ComboFix 10-03-10.08 - Sara Byron 03/11/2010 8:58.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1522 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\EventSystem.log

.
((((((((((((((((((((((((( Files Created from 2010-02-11 to 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-10 15:16 . 2010-03-11 15:12 ——– d—–w- c:\documents and settings\HelpAssistant.FAMILYDELL.000
2010-03-10 15:13 . 2009-10-23 15:28 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\documents and settings\Sara Byron\Local Settings\Application Data\Innovative Solutions
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\program files\Common Files\Innovative Solutions
2010-02-25 16:29 . 2010-02-25 16:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Innovative Solutions
2010-02-23 18:19 . 2010-02-23 18:19 ——– d—–w- c:\program files\ERUNT
2010-02-15 22:31 . 2010-02-15 22:32 ——– dc-h–w- c:\windows\ie8
2010-02-15 22:07 . 2010-02-15 22:07 ——– d—–w- c:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 15:08 . 2004-03-29 22:04 288 —-a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2010-03-11 15:08 . 2004-03-29 22:04 288 —-a-w- c:\windows\system32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
2010-03-03 04:23 . 2004-10-13 02:58 128728 —-a-w- c:\documents and settings\Madeleine Jeffers\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-28 15:59 . 2008-11-06 17:56 ——– d—–w- c:\program files\Windows Media Connect 2
2010-02-28 15:59 . 2004-08-12 00:01 ——– d—–w- c:\program files\Sierra On-Line
2010-02-28 15:59 . 2009-09-20 19:34 ——– d—–w- c:\program files\QuickTime
2010-02-27 00:58 . 2009-11-08 20:54 ——– d—–w- c:\program files\Palm-old
2010-02-27 00:58 . 2009-03-03 19:39 ——– d—–w- c:\program files\Palm
2010-02-27 00:58 . 2008-11-06 15:32 ——– d—–w- c:\program files\OverDrive Media Console
2010-02-27 00:57 . 2004-03-29 21:58 ——– d—–w- c:\program files\Modem Helper
2010-02-27 00:57 . 2005-11-01 21:34 ——– d—–w- c:\program files\Family Tree Maker 2005
2010-02-25 22:23 . 2009-04-29 15:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-25 21:26 . 2006-10-05 03:23 128728 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-25 16:50 . 2007-09-17 02:48 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-25 16:37 . 2006-03-15 00:31 ——– d—–w- c:\program files\Electronic Arts
2010-02-25 16:36 . 2004-08-22 19:44 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-25 16:31 . 2009-04-28 18:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-25 16:31 . 2004-10-24 02:21 ——– d—–w- c:\program files\Lavasoft
2010-02-25 16:29 . 2004-10-27 12:55 ——– d—–w- c:\program files\Innovative Solutions
2010-02-19 00:29 . 2004-10-02 20:51 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Aim
2010-02-19 00:11 . 2006-10-20 18:10 ——– d—–w- c:\program files\McAfee
2010-02-15 05:38 . 2007-09-17 02:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-15 04:25 . 2008-03-19 21:15 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-12 21:52 . 2005-09-13 02:57 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Canon
2010-02-03 15:26 . 2010-02-03 15:24 ——– d—–w- c:\program files\iTunes
2010-02-03 15:25 . 2006-07-01 13:37 ——– d—–w- c:\program files\iPod
2010-02-03 15:25 . 2007-07-31 14:46 ——– d—–w- c:\program files\Common Files\Apple
2010-02-03 14:22 . 2008-08-06 14:04 ——– d—–w- c:\program files\Safari
2010-01-25 04:15 . 2010-01-25 04:15 ——– d—–w- c:\documents and settings\Sara Byron\Application Data\Office Genuine Advantage
2010-01-07 22:07 . 2009-04-29 15:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 22:07 . 2009-04-29 15:55 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2002-08-29 11:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-24 01:32 916480 ——w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2009-02-22 14:50 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2002-08-29 11:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2003-08-27 20:19 . 2004-12-24 04:53 36963 -c–a-r- c:\program files\Common Files\SM1updtr.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WebDriveTray"="c:\program files\NetDrive\netdrive.exe" [2003-04-14 294912]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"pdfFactory Dispatcher v2"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" [2005-09-06 487424]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\documents and settings\Sara Byron\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2009-3-8 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-21 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\HP1006MC.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\SYSTEM32\\WBEM\\UNSECAPP.EXE"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"4883:TCP"= 4883:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3246:TCP"= 3246:TCP:Services

R0 MDPMGRNT;MDPMGRNT;c:\windows\SYSTEM32\DRIVERS\MDPMGRNT.SYS [7/20/2005 4:35 PM 24320]
R0 szkg5;szkg;c:\windows\SYSTEM32\DRIVERS\SZKG.sys [10/8/2008 1:27 PM 49664]
R1 MDFSYSNT;MDFSYSNT;c:\windows\SYSTEM32\DRIVERS\MDFSYSNT.SYS [9/13/2006 12:53 PM 213888]
R2 DVDAccss;DVDAccss;c:\windows\SYSTEM32\DRIVERS\DVDAccss.sys [12/3/2008 3:39 PM 29156]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/10/2008 1:18 PM 24652]
R2 WebDriveFSD;WebDrive File System Driver;c:\program files\NetDrive\rffsd.sys [9/23/2005 5:20 AM 67032]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys –> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S4 RFNP32;WebDrive Provider; [x]
.
Contents of the 'Scheduled Tasks' folder

2010-02-16 c:\windows\Tasks\Backup.job
- c:\windows\SYSTEM32\ntbackup.exe [2009-02-22 00:12]

2010-03-11 c:\windows\Tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:31]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://member.square-enix.com/na/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
FF - ProfilePath - c:\documents and settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\Madeleine Jeffers\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\Sara Byron\Application Data\Mozilla\plugins\npPxPlay.dll
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npImgCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 09:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A51DBD0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74a0852
\Driver\iaStor -> 0x8a51dbd0
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x894eb330
PacketIndicateHandler -> NDIS.sys @ 0xf788ca21
SendHandler -> NDIS.sys @ 0xf786a87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1117699391-305849530-2431133585-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:00,1f,6d,2a,7d,04,89,b0,89,2e,46,94,1d,9d,62,2c,73,d8,56,bf,a5,20,94,
c0,1a,48,61,33,a6,37,16,2d,47,8e,88,83,08,22,01,85,4a,b2,54,64,a5,4e,98,d4,\
"??"=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa

[HKEY_USERS\S-1-5-21-1117699391-305849530-2431133585-1008\Software\SecuROM\License information*]
"datasecu"=hex:a0,c8,a9,21,97,e1,5e,28,08,d0,73,37,5b,c9,5b,88,32,c4,d6,cb,f5,
10,12,ba,99,3e,c2,0f,8e,38,d7,b4,68,17,9d,74,cd,9a,8b,ab,f5,d6,36,07,01,a4,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(828)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll

- - - - - - - > 'explorer.exe'(2272)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Mediafour\XPlay\XPFPROT.DLL
c:\program files\Mediafour\XPlay\1033\XPFPROT.DL_
c:\program files\Mediafour\XPlay\XPDEVICE.DLL
c:\windows\system32\MACDRAPI.DLL
c:\program files\Mediafour\XPlay\1033\XPDEVICE.DL_
c:\program files\Mediafour\XPlay\XPIPOD.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\CTsvcCDA.exe
c:\program files\Intel\Intel Application Accelerator\iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
c:\program files\Photodex\ProShowGold\ScsiAccess.exe
c:\windows\system32\UAService7.exe
c:\windows\System32\MsPMSPSv.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
.
**************************************************************************
.
Completion time: 2010-03-11 09:28:08 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-11 15:27
ComboFix2.txt 2010-03-02 03:47
ComboFix3.txt 2010-03-02 02:00
ComboFix4.txt 2009-05-06 14:01

Pre-Run: 31,161,298,944 bytes free
Post-Run: 31,103,086,592 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 74EBD6529617A552B3DF068576268553
Post #62
Awesome!!

Now for the million dollar question:

Can you boot to the recovery console???????



Reboot your machine and when the Boot Menu flashes up - select "Microsoft Windows Recovery Console"
(you need to be very fast with the arrow key as you only have a couple of seconds before it defaults to the windows XP bootup)

[external image: Posted Image]

[external image: Posted Image]

When you get to the above screen, take note of the number that references your operating system.
If it's '1' like the picture above, type 1 and press Enter

[external image: Posted Image]

Next type FIXMBR

[external image: Posted Image]

If it ask if you're sure you want to write a new MBR, answer 'Y'

Then type EXIT to reboot the machine.


Let me know how that goes.


NEXT


Go to Start > run > copy/paste the bolded text into the open run box > hit OK


helpasst -mbrt


When completed a log should pop open for you - please post the resulting log in your next reply.
Post #63
Puke. It is hard to catch that console choice. But when I did get to choose it, here is the message that it gave me: NTLDR is compressed. (But I can't read my own writing, and it might say NTCDR.) What now?
Post #64 last edited
Hi,

Please do the following:

Boot back normally into windows,

Go to Start > Run > type in cmd to open a command window then copy/paste the following bolded text into the open command window, then hit Enter.

attrib -c %systemdrive%\ntldr


Close the command window,

Now run the HelpAsst_mebroot_fix.exe tool


shutdown the computer:


then upon restarting,

boot into the Recovery Console as per the previous instructions and execute the fixmbr command:


Reboot normally:

then run another status report

Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt


When it completes, a log will open.

Please post the contents of that log.
Post #65
Fail. Ran the cmd attrib -c %systemdrive%\ntldr and got an error message. Invalid switch - -c Did the Help_Assist anyway, reboot and got the same error message on the Recover Console: NETCDR is compressed.
Post #66 last edited
Hi,

My sincere apologies, that command actually is only available in the Recovery console


I think we need to make a recovery console disk and get into that recovery console to fix this


Please do the following:

This will allow you to burn a Recovery Console cd
  • Download the recovery_console_cd.zip from here file to your drive and unzip it to it's own folder.
  • Download the correct floppy disk setup package for your operating system from Microsoft and save it to the folder you extracted the zip to.
  • Rename the floppy disk setup package to Bootdisk.exe
  • Insert a blank cd into your burner.
  • Now just double click the RecoveryCD.bat file and follow the prompts to burn a cd that will allow you to boot to the recovery console.

Now boot to the CD you have just created
choose the operating system you wish (windows is generally choice #1)
you will be prompted to enter the password for the Administrator account. This is not your Administrative account but the true Administrator account. If you haven't set one just press enter, if you have - enter the password, then press enter

now you will be presented with a C:\windows prompt


at the prompt type the following commands one at a time, pressing enter after each command:

fixmbr

cd \

attrib -c ntldr

exit

Boot up normally then run another status report


Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt


When it completes, a log will open.

Please post the contents of that log.

(Note: If this is not successful we can revert to the Hiren's disk and use another utility)
Post #67
What's the difference between fastReply and Addreply? I have a quick question. My computer is XP Professional SP3. There is not a choice for the floppy disk set-up for SP3. Only original, SP1 & 2. There is a CD download for SP3 upgrades. (Windows XP Service Pack 3 - ISO-9660 CD ISO image) I don't want to do this all wrong and have to do it again - although I probably will be doing this more than once, the way things are going. Which one do you mean for me to use?
Post #68
Use the set up package for SP2 the difference between fast reply and add reply fast reply - small window with few editing features add reply - large window - full editing features
Post #69
I know that I replied to this last night. I'd bet that my computer froze upin the middle, and somehow it didn't get posted. The bad news is that I cannot completely remember what happened! I know that I downloaded the boot floppy disk files and created the recover console CD. I booted to it unsuccessfully three times. The recovery CD had three choices and none of them worked. I believe that the CD could not recognize any hard drive in the PC. I just found my notes from yesterday. Three choices were: * Set up Windows XP * Repair with Recovery Console * Quit Both choices 1 & 2 resulted in this message: XP Professional Setup did not find any hard drives installed in your computer. I didn't complete the rest of the tasks. Should we try the Hirens boot disk? Sara
Post #70 last edited
Let's go to Hirens


Please do the following:

Boot with the CD and select DOS BootCD

🖼Click to load external image (Posted Image)

At the Hiren's BootCD main menu, select Next and hit Enter.

🖼Click to load external image (Posted Image)

At the second menu select 1 MBR (Master Boot Record)Tools

🖼Click to load external image (Posted Image)

In the list of MBR Tools select 1 MBR Work 1.08

🖼Click to load external image (Posted Image)

This screen will show the hard drive configuration.

🖼Click to load external image (Posted Image)

Type 5 to Install standard MBR code then hit Enter
Type 1 to select Standard then hit Enter
Type Y then hit Enter to confirm
Type E then hit Enter to exit
Press Ctrl+Alt+Del to restart the machine normally



NEXT

Please delete the copy of HelpAsst_mebroot that you have on your desktop.

Please download a fresh copy from HERE



Please run HelpAsst_mebroot_fix but don't run the mbr -f command this time

then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Please post the resulting log
Post #71
Sorry that I've been gone so long. Very busy with St. Patrick's Day shows etc. I'm back now. Per last instructions, I booted to the Hiren's CD. The MBR Tools was version 1.07b, however, and not 1.08 as you specified. I proceeded anyway. Re-booted, but the link that you provided gave me a 404 error. I went to an old link to see if it would download and it was also a 404 not found error. I'll look for another spot to download from meanwhile.
Post #72 last edited
very sorry, the link worked when I posted it, we've just had a very recent change over. (glad you are still with me :))

Here is the new link: HelpAsst_mebroot_fix.exe

run the tool but make sure you don't run the mbr -f command this time


then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Please post the resulting log
Post #73
OK - here you go. Hope I did that right.

C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
Thu 03/18/2010 at 21:36:02.53

HelpAssistant account was found to be Active ~ attempting to de-activate

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators

HelpAssistant successfully set Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll present! ~ attempting to remove
Remove on reboot: C:\WINDOWS\system32\termsrv32.dll

~~ Checking firewall ports ~~

backing up DomainProfile\GloballyOpenPorts\List registry key
closing rogue ports

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list
"65533:TCP"=-
"52344:TCP"=-
"2479:TCP"=-
"3246:TCP"=-
"3389:TCP"=-
"1742:TCP"=-
"8708:TCP"=-
"3866:TCP"=-
"4024:TCP"=-
"3132:TCP"=-
"9272:TCP"=-
"4883:TCP"=-

backing up StandardProfile\GloballyOpenPorts\List registry key
closing rogue ports

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list
"65533:TCP"=-
"52344:TCP"=-
"2479:TCP"=-
"4883:TCP"=-
"3389:TCP"=-
"3246:TCP"=-

HelpAssistant profile found in registry ~ backing up and removing S-1-5-21-1117699391-305849530-2431133585-1007
HelpAssistant profile directory exists at C:\Documents and Settings\HelpAssistant ~ attempting to remove
~ All C:\Documents and Settings\HelpAssistant files successfully removed ~

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Thu 03/18/2010 at 22:31:09.06

Full Name Remote Desktop Help Assistant Account
Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x0DF83CBD
malicious code @ sector 0x0DF83CC0 !
PE file found in sector at 0x0DF83CD6 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll present!


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in List

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~
Post #74 last edited
Hi,

well looks like we are getting somewhere


Just need to make sure a file deletes on reboot.

Please reboot your machine then run the following


Start > run > copy/paste the following bolded command > OK


helpasst -reset


Now run the next command

Start > run > copy/paste the following bolded command > OK

helpasst -mbrt



Post the resulting log
Post #75
Good morning! My computer did not freeze up over night! You may be right that we are finally getting some where.

Here is the log:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Fri 03/19/2010 at 7:40:46.67

Full Name Remote Desktop Help Assistant Account
Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x0DF83CBD
malicious code @ sector 0x0DF83CC0 !
PE file found in sector at 0x0DF83CD6 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in List

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI