explorer.exe doesn't boot after combofix scan

Hi, When we started with this, when the computer was started, after the windows welcome page, I would get a blank screen. When I ran explorer.exe from the task manager, it would run normally, open the desktop and toolbars with no error messages. Now, when the computer is started I get the blank screen except for one minimised window which is "Computer" page from windows explorer and the task manager says that explorer.exe is running. I still have to restart explorer.exe to get it to run normally. Log from MBRCheck: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows 7 Home Premium Edition Windows Information: (build 7600), 32-bit Base Board Manufacturer: Hewlett-Packard BIOS Manufacturer: Hewlett-Packard System Manufacturer: Hewlett-Packard System Product Name: Compaq 615 Logical Drives Mask: 0x00000034 Kernel Drivers (total 231): 0x8321B000 \SystemRoot\system32\ntkrnlpa.exe 0x8362B000 \SystemRoot\system32\halmacpi.dll 0x80B9F000 \SystemRoot\system32\kdcom.dll 0x88C0A000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll 0x88C15000 \SystemRoot\system32\PSHED.dll 0x88C26000 \SystemRoot\system32\BOOTVID.dll 0x88C2E000 \SystemRoot\system32\CLFS.SYS 0x88C70000 \SystemRoot\system32\CI.dll 0x88D1B000 \SystemRoot\system32\drivers\Wdf01000.sys 0x88D8C000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x88D9A000 \SystemRoot\system32\DRIVERS\ACPI.sys 0x88DE2000 \SystemRoot\system32\DRIVERS\WMILIB.SYS 0x88DEB000 \SystemRoot\system32\DRIVERS\msisadrv.sys 0x88E2C000 \SystemRoot\system32\DRIVERS\pci.sys 0x88E56000 \SystemRoot\system32\DRIVERS\vdrvroot.sys 0x88E61000 \SystemRoot\system32\DRIVERS\isapnp.sys 0x88E70000 \SystemRoot\system32\DRIVERS\mpio.sys 0x88E94000 \SystemRoot\System32\drivers\partmgr.sys 0x88EA5000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x88EAD000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x88EB8000 \SystemRoot\system32\DRIVERS\volmgr.sys 0x88EC8000 \SystemRoot\System32\drivers\volmgrx.sys 0x88F13000 \SystemRoot\system32\DRIVERS\intelide.sys 0x88F1A000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS 0x88F28000 \SystemRoot\system32\DRIVERS\aliide.sys 0x88F2F000 \SystemRoot\system32\DRIVERS\amdide.sys 0x88F36000 \SystemRoot\system32\DRIVERS\cmdide.sys 0x88F3E000 \SystemRoot\System32\drivers\mountmgr.sys 0x88F54000 \SystemRoot\system32\DRIVERS\msdsm.sys 0x88F74000 \SystemRoot\system32\DRIVERS\nvraid.sys 0x88F93000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x88FB8000 \SystemRoot\system32\DRIVERS\pciide.sys 0x88FBF000 \SystemRoot\system32\DRIVERS\viaide.sys 0x8902C000 \SystemRoot\system32\DRIVERS\iaStorV.sys 0x89107000 \SystemRoot\system32\DRIVERS\atapi.sys 0x89110000 \SystemRoot\system32\DRIVERS\ataport.SYS 0x89133000 \SystemRoot\system32\DRIVERS\lsi_sas.sys 0x8914B000 \SystemRoot\system32\DRIVERS\storport.sys 0x89192000 \SystemRoot\system32\DRIVERS\msahci.sys 0x8919C000 \SystemRoot\system32\DRIVERS\HpSAMD.sys 0x8920F000 \SystemRoot\system32\DRIVERS\adp94xx.sys 0x89279000 \SystemRoot\system32\DRIVERS\adpahci.sys 0x892C5000 \SystemRoot\system32\DRIVERS\adpu320.sys 0x892EB000 \SystemRoot\system32\DRIVERS\djsvs.sys 0x892FF000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS 0x89325000 \SystemRoot\system32\DRIVERS\amdsata.sys 0x8933C000 \SystemRoot\system32\DRIVERS\amdsbs.sys 0x89379000 \SystemRoot\system32\DRIVERS\amdxata.sys 0x89382000 \SystemRoot\system32\DRIVERS\arc.sys 0x89398000 \SystemRoot\system32\DRIVERS\arcsas.sys 0x8942F000 \SystemRoot\system32\DRIVERS\elxstor.sys 0x894A2000 \SystemRoot\system32\DRIVERS\iirsp.sys 0x894B2000 \SystemRoot\system32\DRIVERS\lsi_fc.sys 0x894CC000 \SystemRoot\system32\DRIVERS\lsi_sas2.sys 0x894DC000 \SystemRoot\system32\DRIVERS\lsi_scsi.sys 0x894F6000 \SystemRoot\system32\DRIVERS\megasas.sys 0x89501000 \SystemRoot\system32\DRIVERS\MegaSR.sys 0x89593000 \SystemRoot\system32\DRIVERS\nfrd960.sys 0x895A1000 \SystemRoot\system32\DRIVERS\nvstor.sys 0x8963A000 \SystemRoot\system32\DRIVERS\ql2300.sys 0x89830000 \SystemRoot\system32\DRIVERS\ql40xx.sys 0x89885000 \SystemRoot\system32\DRIVERS\SiSRaid2.sys 0x89892000 \SystemRoot\system32\DRIVERS\sisraid4.sys 0x898A8000 \SystemRoot\system32\DRIVERS\vsmraid.sys 0x898CD000 \SystemRoot\system32\drivers\fltmgr.sys 0x89901000 \SystemRoot\system32\drivers\fileinfo.sys 0x89912000 \SystemRoot\System32\Drivers\PxHelp20.sys 0x89A2E000 \SystemRoot\System32\Drivers\Ntfs.sys 0x89B5D000 \SystemRoot\System32\Drivers\msrpc.sys 0x89B88000 \SystemRoot\System32\Drivers\ksecdd.sys 0x89B9B000 \SystemRoot\System32\Drivers\cng.sys 0x89A00000 \SystemRoot\System32\drivers\pcw.sys 0x89A0E000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x8991C000 \SystemRoot\system32\drivers\ndis.sys 0x897B9000 \SystemRoot\system32\drivers\NETIO.SYS 0x899D3000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x89C30000 \SystemRoot\System32\drivers\tcpip.sys 0x89D79000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x89DAA000 \SystemRoot\system32\DRIVERS\wd.sys 0x89DB2000 \SystemRoot\system32\DRIVERS\volsnap.sys 0x89DF1000 \SystemRoot\system32\DRIVERS\stexstor.sys 0x89C00000 \SystemRoot\System32\Drivers\spldr.sys 0x89C08000 \SystemRoot\system32\DRIVERS\sbp2port.sys 0x89800000 \SystemRoot\System32\drivers\rdyboost.sys 0x89C20000 \SystemRoot\System32\Drivers\mup.sys 0x89A17000 \SystemRoot\System32\drivers\hwpolicy.sys 0x89600000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x895C6000 \SystemRoot\system32\DRIVERS\disk.sys 0x89A1F000 \SystemRoot\system32\DRIVERS\AtiPcie.sys 0x893B0000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x89A27000 \SystemRoot\System32\Drivers\Null.SYS 0x89BF8000 \SystemRoot\System32\Drivers\Beep.SYS 0x89411000 \SystemRoot\System32\drivers\vga.sys 0x893CF000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8941D000 \SystemRoot\System32\drivers\watchdog.sys 0x899F8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x89632000 \SystemRoot\system32\drivers\rdpencdd.sys 0x897F7000 \SystemRoot\system32\drivers\rdprefmp.sys 0x893F0000 \SystemRoot\System32\Drivers\Msfs.SYS 0x89200000 \SystemRoot\System32\Drivers\Npfs.SYS 0x891AF000 \SystemRoot\system32\DRIVERS\tdx.sys 0x891C6000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x891D1000 \SystemRoot\system32\drivers\mfetdik.sys 0x88FC7000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8DA26000 \SystemRoot\system32\drivers\afd.sys 0x8DA80000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x8DA87000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8DAA6000 \SystemRoot\system32\DRIVERS\vwififlt.sys 0x8DAB7000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8DAC5000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x8DAD8000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8DAE8000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8DB29000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8DB33000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8DB3D000 \SystemRoot\system32\drivers\mfehidk.sys 0x8DB70000 \SystemRoot\System32\drivers\discache.sys 0x8DB7C000 \SystemRoot\System32\Drivers\dfsc.sys 0x8DB94000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x8DBA2000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8DBC3000 \SystemRoot\system32\DRIVERS\amdppm.sys 0x8EE05000 \SystemRoot\system32\DRIVERS\atikmdag.sys 0x8F31A000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8F817000 \SystemRoot\System32\drivers\dxgmms1.sys 0x8F850000 \SystemRoot\system32\DRIVERS\yk62x86.sys 0x8FE0A000 \SystemRoot\system32\DRIVERS\bcmwl6.sys 0x90071000 \SystemRoot\System32\Drivers\fastfat.SYS 0x9009B000 \SystemRoot\system32\DRIVERS\vwifibus.sys 0x900A5000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x900AB000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x900B5000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x90100000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x9010F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x9012E000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x90146000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys 0x9014F000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x9015C000 \SystemRoot\system32\DRIVERS\SynTP.sys 0x9018F000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x90191000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x9019E000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x901A2000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x901AB000 \SystemRoot\system32\DRIVERS\CompositeBus.sys 0x901B8000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x901CA000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x901E2000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8F8A0000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8F8C2000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8F8DA000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8F8F1000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x901ED000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8F908000 \SystemRoot\system32\DRIVERS\ks.sys 0x901EF000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8F93C000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8F980000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x8F991000 \SystemRoot\system32\DRIVERS\stwrt.sys 0x8F3D1000 \SystemRoot\system32\DRIVERS\portcls.sys 0x8DBD4000 \SystemRoot\system32\DRIVERS\drmk.sys 0x96216000 \SystemRoot\system32\DRIVERS\AGRSM.sys 0x96332000 \SystemRoot\system32\drivers\modem.sys 0x96770000 \SystemRoot\System32\win32k.sys 0x9633F000 \SystemRoot\System32\drivers\Dxapi.sys 0x96349000 \SystemRoot\System32\Drivers\crashdmp.sys 0x96356000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x96361000 \SystemRoot\System32\Drivers\dump_msahci.sys 0x9636B000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x9637C000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x8AC37000 \SystemRoot\system32\DRIVERS\snp2uvc.sys 0x8ADE5000 \SystemRoot\system32\DRIVERS\STREAM.SYS 0x8ADF3000 \SystemRoot\system32\DRIVERS\sncduvc.SYS 0x8AC00000 \SystemRoot\system32\DRIVERS\monitor.sys 0x969D0000 \SystemRoot\System32\TSDDD.dll 0x96600000 \SystemRoot\System32\cdd.dll 0x96620000 \SystemRoot\System32\ATMFD.DLL 0x8AC0B000 \SystemRoot\system32\drivers\WudfPf.sys 0x8AC25000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x96393000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x963D9000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x963E9000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x96200000 \SystemRoot\system32\DRIVERS\vwifimp.sys 0xA9036000 \SystemRoot\system32\drivers\HTTP.sys 0xA90BB000 \SystemRoot\system32\DRIVERS\bowser.sys 0xA90D4000 \SystemRoot\System32\drivers\mpsdrv.sys 0xA90E6000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xA9109000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xA9144000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xA915F000 \SystemRoot\system32\drivers\peauth.sys 0xA91F6000 \SystemRoot\System32\Drivers\secdrv.SYS 0xA9000000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xA9021000 \SystemRoot\System32\drivers\tcpipreg.sys 0xAA434000 \SystemRoot\System32\DRIVERS\srv2.sys 0xAA483000 \SystemRoot\System32\DRIVERS\srv.sys 0xAA4D4000 \SystemRoot\system32\drivers\MfeBOPK.sys 0xAA4DB000 \SystemRoot\system32\drivers\MfeAVFK.sys 0x77BC0000 \Windows\System32\ntdll.dll 0x47A40000 \Windows\System32\smss.exe 0x77E00000 \Windows\System32\apisetschema.dll 0x00150000 \Windows\System32\autochk.exe 0x77A20000 \Windows\System32\setupapi.dll 0x77D60000 \Windows\System32\oleaut32.dll 0x779A0000 \Windows\System32\comdlg32.dll 0x77900000 \Windows\System32\advapi32.dll 0x77850000 \Windows\System32\msvcrt.dll 0x777B0000 \Windows\System32\usp10.dll 0x77D00000 \Windows\System32\difxapi.dll 0x77750000 \Windows\System32\shlwapi.dll 0x76B00000 \Windows\System32\shell32.dll 0x769A0000 \Windows\System32\ole32.dll 0x76980000 \Windows\System32\sechost.dll 0x76940000 \Windows\System32\ws2_32.dll 0x76800000 \Windows\System32\urlmon.dll 0x767F0000 \Windows\System32\nsi.dll 0x76720000 \Windows\System32\user32.dll 0x76710000 \Windows\System32\lpk.dll 0x766F0000 \Windows\System32\imm32.dll 0x764F0000 \Windows\System32\iertutil.dll 0x764E0000 \Windows\System32\psapi.dll 0x76430000 \Windows\System32\rpcrt4.dll 0x76350000 \Windows\System32\kernel32.dll 0x76280000 \Windows\System32\msctf.dll 0x76270000 \Windows\System32\normaliz.dll 0x76220000 \Windows\System32\Wldap32.dll 0x76190000 \Windows\System32\clbcatq.dll 0x76160000 \Windows\System32\imagehlp.dll 0x76110000 \Windows\System32\gdi32.dll 0x76010000 \Windows\System32\wininet.dll 0x75FE0000 \Windows\System32\wintrust.dll 0x75EC0000 \Windows\System32\crypt32.dll 0x75E70000 \Windows\System32\KernelBase.dll 0x75E40000 \Windows\System32\cfgmgr32.dll 0x75DB0000 \Windows\System32\comctl32.dll 0x75D90000 \Windows\System32\devobj.dll 0x75D80000 \Windows\System32\msasn1.dll Processes (total 56): 0 System Idle Process 4 System 272 C:\Windows\System32\smss.exe 376 csrss.exe 452 C:\Windows\System32\wininit.exe 464 csrss.exe 508 C:\Windows\System32\services.exe 524 C:\Windows\System32\lsass.exe 532 C:\Windows\System32\lsm.exe 632 C:\Windows\System32\svchost.exe 704 C:\Windows\System32\winlogon.exe 752 C:\Windows\System32\svchost.exe 792 C:\Windows\System32\atiesrxx.exe 860 C:\Windows\System32\svchost.exe 920 C:\Windows\System32\svchost.exe 964 C:\Windows\System32\svchost.exe 1000 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\stacsv.exe 1164 C:\Windows\System32\audiodg.exe 1236 C:\Windows\System32\svchost.exe 1316 C:\Windows\System32\atieclxx.exe 1352 C:\Windows\System32\svchost.exe 1484 C:\Windows\System32\wlanext.exe 1496 C:\Windows\System32\conhost.exe 1612 C:\Windows\System32\spoolsv.exe 1660 C:\Windows\System32\svchost.exe 1692 C:\Windows\System32\svchost.exe 1852 C:\Windows\explorer.exe 1924 C:\Windows\System32\taskhost.exe 384 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\AEstSrv.exe 448 C:\Program Files\LSI SoftModem\agrsmsvc.exe 1100 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1288 C:\Program Files\Bonjour\mDNSResponder.exe 1788 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe 1932 C:\PROGRA~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE 1388 C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe 2132 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 2160 C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe 2240 C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe 2368 C:\Program Files\PDF Complete\pdfsvc.exe 2428 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2520 C:\Program Files\SiteAdvisor\6173\SAService.exe 3016 C:\Windows\servicing\TrustedInstaller.exe 3368 C:\Windows\System32\rundll32.exe 4008 C:\Windows\System32\taskmgr.exe 4088 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe 2504 C:\Windows\System32\svchost.exe 2736 C:\Program Files\Windows Media Player\wmpnetwk.exe 3364 C:\Windows\System32\SearchIndexer.exe 2252 WmiPrvSE.exe 2212 C:\Windows\explorer.exe 2640 C:\Program Files\Mozilla Firefox\firefox.exe 2416 C:\Windows\explorer.exe 1120 C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe 2008 C:\Users\Andrea\Desktop\MBRCheck.exe 3280 C:\Windows\System32\conhost.exe 1828 C:\Windows\System32\dllhost.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`12d00000 (NTFS) \\.\E: –> \\.\PhysicalDrive0 at offset 0x00000024`c3200000 (FAT32) PhysicalDrive0 Model Number: HitachiHTS723216L9A360, Rev: FC2OC60D Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979 Done! Regards doug61

Hi doug61,

We need to run Combofix again but we need to uninstall McAfee first. We'll be installing it later or go for another AV if you wish when we're through.

link

IMPORTANT: If your McAfee products were preinstalled by the manufacturer of your computer, ensure that you activate your McAfee subscription before uninstalling. Reinstalling from a CD or download only installs your McAfee consumer applications, but might not recover your paid subscription term information.

NOTE: Do not browse to any other sites other than those I request as you would be running without an Anti viurs.

• Click on Start > Control Panel and double click on Programs and Features.
• Locate McAfee Virus and Spyware Protection Service and click on the Uninstall button to uninstall it.
• Close Control Panel when done.

–Next–

Please download the Mcafee removal tool from
HERE

• Save it to your desktop
• Make sure all McAfee application windows are closed.
• Double-click MCPR.exe and the removal tool will start automatically.
• Note: Windows Vista / Win 7 users must right-click and select Run as Administrator.
  Once the removal tool is finished, you will be prompted to restart your computer. If you choose to restart later, your McAfee product will not be fully removed until you do.
• Wait for the computer to restart.

–Next–

• When the computer is restarting:
• Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
• When a list of menu appears, scroll to Windows 7 Safe Mode Option using the arrow keys then press Enter.
• Log in with an Administrator account.

–Next–

Run Combofix again, in Safe Mode. If it asks you to update, please do so. After finishing it's scan, it may restart your computer. Be sure to boot in Safe Mode again.

To post in your next reply:
1. How is it?
2. Combofix log.

Hi, It was much the same as the last time we ran ComboFix: ComboFix ran through its 50 stages Then a message System file is infected !! Attempting to restore "C:\windows\system32\userinit.exe" Rebooted in safe mode, exactly same as before, blank screen except for one minimised explorer screen (computer). Nothing at all in ComboFix log except creation of new restore point. Regards doug61

Hi, Sorry about this. Please bear with me on this one. Am having some of our experts look into this. Thank you.

Hi,

Please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Right-click SystemLook.exe then choose "Run as Administrator" to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  explorer.*
  userinit.*
  
  :reg
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Hi, Don't be concerned about how long this is taking, I'm glad for the help. Thankfully because the PC is still usable, all the important stuff is now backed-up, and there are other PCs in the house for people to use. SystemLook Log: SystemLook 04.09.10 by jpshortstuff Log created at 00:11 on 14/10/2010 by Andrea Administrator - Elevation successful ========== filefind ========== Searching for "explorer.*" C:\Qoobox\Quarantine\C\windows\explorer.exe.vir –a—- 2614272 bytes [14:58 27/01/2010] [05:45 31/10/2009] 9149DA52CC4CD537BE7E7F755F1391AB C:\Windows\explorer.exe –a—- 2614272 bytes [14:58 27/01/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf –a—- 190440 bytes [13:03 10/10/2010] [22:05 13/10/2010] CF22DD0FB2BFB2400B7E0418B7BE9072 C:\Windows\sv-SE\explorer.exe.mui –a—- 23552 bytes [01:12 10/09/2009] [01:12 10/09/2009] B75E618BE78589FCF4992DBEF8E2EB75 C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_eae4df6a1d236667\explorer.exe.mui –a—- 23552 bytes [01:12 10/09/2009] [01:12 10/09/2009] B75E618BE78589FCF4992DBEF8E2EB75 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe –a—- 2613248 bytes [23:41 13/07/2009] [01:14 14/07/2009] 15BC38A7492BEFE831966ADB477CF76F C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe –a—- 2613248 bytes [02:17 30/12/2009] [05:35 03/08/2009] B95EEB0F4E5EFBF1038A35B3351CF047 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe –a—- 2614272 bytes [14:58 27/01/2010] [05:45 31/10/2009] 2626FC9755BE22F805D3CFA0CE3EE727 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe –a—- 2613248 bytes [02:17 30/12/2009] [05:49 03/08/2009] 9FF6C4C91A3711C0A3B18F87B08B518D C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe –a—- 2614272 bytes [14:58 27/01/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\winsxs\x86_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_07f2d7df13d70dd0\Explorer.adml –a—- 3783 bytes [01:13 10/09/2009] [01:13 10/09/2009] 492CBE676A49756494ABAD49712DD36C C:\Windows\winsxs\x86_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_1590ffd752297581\Explorer.admx –a—- 3836 bytes [21:56 13/07/2009] [21:34 10/06/2009] AD131A834808E6AFF4A3918DE05BFCF6 Searching for "userinit.*" C:\ComboFix\userinit.exe.ND_ –a—- 14 bytes [00:03 13/10/2010] [00:03 13/10/2010] 81BF36FD4C7C4404E082EC48C920CFA1 C:\Qoobox\Quarantine\C\windows\system32\userinit.exe.vir –a—- 2614272 bytes [22:40 06/10/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\System32\userinit.exe –a—- 2614272 bytes [22:40 06/10/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\System32\sv-SE\userinit.exe.mui –a—- 3584 bytes [01:12 10/09/2009] [01:12 10/09/2009] F5047D045D887E0905A46C08DF3EFFE4 C:\Windows\winsxs\x86_microsoft-windows-userinit.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_74e2fe787bd42e39\userinit.exe.mui –a—- 3584 bytes [01:12 10/09/2009] [01:12 10/09/2009] F5047D045D887E0905A46C08DF3EFFE4 C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe –a—- 26112 bytes [23:34 13/07/2009] [01:14 14/07/2009] 6DE80F60D7DE9CE6B8C2DDFDF79EF175 ========== reg ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "ReportBootOk"="1" "Shell"="Explorer.exe" "PreCreateKnownFolders"="{A520A1A4-1780-4FF6-BD18-167343C5AF16}" "VMApplet"="SystemPropertiesPerformance.exe /pagefile" "AutoRestartShell"= 0x0000000001 (1) "Background"="0 0 0" "CachedLogonsCount"="10" "DebugServerCommand"="no" "ForceUnlockLogon"= 0x0000000000 (0) "LegalNoticeCaption"="" "LegalNoticeText"="" "PasswordExpiryWarning"= 0x0000000005 (5) "PowerdownAfterShutdown"="0" "ShutdownWithoutLogon"="0" "WinStationsDisabled"="0" "DisableCAD"= 0x0000000001 (1) "scremoveoption"="0" "ShutdownFlags"= 0x000000002b (43) "Userinit"="C:\windows\system32\userinit.exe," "LegalNotice Text"="" "SFCDisable"= 0x0000000000 (0) "System"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked] -= EOF =- Regards doug61

Hi,

thanks for your patience.

Please do the following:

Launch Notepad, and copy/paste everything in the codebox below into the new document. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as runme.bat.

@ECHO OFF
cd C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c
copy userinit.exe c:\userinit.exe
DEL %0

Locate runme.bat on your Desktop and right-click on it then choose "Run as Administrator".

–Next–

Restart your computer to Recovery Environment (RE) by doing the following:
To do this,

• Restart your computer.
• Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
• When a list of menu appears, scroll to Repair your computer using the arrow keys then press Enter.
• Confirm your keyboard input method (and language, if you have installed multiple-language support). Click Next to continue.
• Log into your installation. To enable access to the command prompt, select your user name from the pulldown menu.
• Enter your password then click OK to continue.
• The Recovery Environment menu opens.
• Scroll down to Command Prompt.

On the Command Prompt:

Type the following:

C:\Windows\system32\userinit.exe userinit.old

then press the Enter key.

–Next–

Type the following:

copy c:\userinit.exe C:\Windows\System32\userinit.exe

then press the Enter key.

–Next–

Type Exit

then reboot your computer in Normal Mode

–Next–

Run combofix again. If it asks you to update please do so.

Hi At the ComboFix stage in normal mode it was the same as before:"Rootkit Activity detected need to reboot" After reboot the usual blank screen, no further Combofix activity or log. Regards doug61

Hi, How about your explorer? Still having problems with it? Please run combofix in Safe mode. Thanks.

Hi, It was much the same as the last time we ran ComboFix in safe mode ComboFix ran through its 50 stages Then a message System file is infected !! Attempting to restore "C:\windows\system32\userinit.exe" then "Deleting C:\userinit.exe" then rebooted in normal mode, exactly same as before, blank screen except for one minimised explorer screen (computer). Nothing at all in ComboFix log Once explorer is run again from taskmanager everything runs as normal Regards doug61

Hi,

When you've run this command in RE:

copy c:\userinit.exe C:\Windows\System32\userinit.exe

Did it ask you to overwrite the existing file?

Let's check on those files again:

Please do the following:

• Right-click SystemLook.exe then choose "Run as Administrator" to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  explorer.*
  userinit.*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Hi, When I try command : copy c:\userinit.exe C:\Windows\System32\userinit.exe I get" file not found" Using explorer I also can't find c:\userinit.exe SystemLook.txt: SystemLook 04.09.10 by jpshortstuff Log created at 23:09 on 16/10/2010 by Andrea Administrator - Elevation successful ========== filefind ========== Searching for "explorer.*" C:\Qoobox\Quarantine\C\windows\explorer.exe.vir –a—- 2614272 bytes [14:58 27/01/2010] [05:45 31/10/2009] 9149DA52CC4CD537BE7E7F755F1391AB C:\Windows\explorer.exe –a—- 2614272 bytes [14:58 27/01/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf –a—- 350316 bytes [13:03 10/10/2010] [21:06 16/10/2010] C577F067D0B68810D0437709ACA4B355 C:\Windows\sv-SE\explorer.exe.mui –a—- 23552 bytes [01:12 10/09/2009] [01:12 10/09/2009] B75E618BE78589FCF4992DBEF8E2EB75 C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_eae4df6a1d236667\explorer.exe.mui –a—- 23552 bytes [01:12 10/09/2009] [01:12 10/09/2009] B75E618BE78589FCF4992DBEF8E2EB75 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe –a—- 2613248 bytes [23:41 13/07/2009] [01:14 14/07/2009] 15BC38A7492BEFE831966ADB477CF76F C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe –a—- 2613248 bytes [02:17 30/12/2009] [05:35 03/08/2009] B95EEB0F4E5EFBF1038A35B3351CF047 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe –a—- 2614272 bytes [14:58 27/01/2010] [05:45 31/10/2009] 2626FC9755BE22F805D3CFA0CE3EE727 C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe –a—- 2613248 bytes [02:17 30/12/2009] [05:49 03/08/2009] 9FF6C4C91A3711C0A3B18F87B08B518D C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe –a—- 2614272 bytes [14:58 27/01/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\winsxs\x86_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_07f2d7df13d70dd0\Explorer.adml –a—- 3783 bytes [01:13 10/09/2009] [01:13 10/09/2009] 492CBE676A49756494ABAD49712DD36C C:\Windows\winsxs\x86_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_1590ffd752297581\Explorer.admx –a—- 3836 bytes [21:56 13/07/2009] [21:34 10/06/2009] AD131A834808E6AFF4A3918DE05BFCF6 Searching for "userinit.*" C:\ComboFix\userinit.exe.ND_ –a—- 14 bytes [16:30 15/10/2010] [16:30 15/10/2010] A7F0D1F22EB2692CAE9B17EDB5CBFD48 C:\Qoobox\Quarantine\C\userinit.exe.vir –a—- 26112 bytes [21:22 14/10/2010] [01:14 14/07/2009] 6DE80F60D7DE9CE6B8C2DDFDF79EF175 C:\Qoobox\Quarantine\C\windows\system32\userinit.exe.vir –a—- 2614272 bytes [22:40 06/10/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\Prefetch\USERINIT.EXE-6D213C2E.pf –a—- 9188 bytes [00:20 15/10/2010] [00:20 15/10/2010] EF49BC63D6B037B30DB228CEA1EBCD43 C:\Windows\System32\userinit.exe –a—- 2614272 bytes [22:40 06/10/2010] [06:00 31/10/2009] C76153C7ECA00FA852BB0C193378F917 C:\Windows\System32\sv-SE\userinit.exe.mui –a—- 3584 bytes [01:12 10/09/2009] [01:12 10/09/2009] F5047D045D887E0905A46C08DF3EFFE4 C:\Windows\winsxs\x86_microsoft-windows-userinit.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_74e2fe787bd42e39\userinit.exe.mui –a—- 3584 bytes [01:12 10/09/2009] [01:12 10/09/2009] F5047D045D887E0905A46C08DF3EFFE4 C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe –a—- 26112 bytes [23:34 13/07/2009] [01:14 14/07/2009] 6DE80F60D7DE9CE6B8C2DDFDF79EF175 -= EOF =- Regards doug61

Hi,

This is rather putting up a tough fight.

Let's do some of the steps again as we need to fix your explorer before anything else.

Please do the following:

Launch Notepad, and copy/paste everything in the codebox below into the new document. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as runme.bat.

@ECHO OFF
C:\Qoobox\Quarantine\C\userinit.exe.vir
cd C:\Qoobox\Quarantine\C
copy userinit.exe.vir c:\
ren c:\userinit.exe.vir userinit.exe
DEL %0

Locate runme.bat on your Desktop and right-click on it then choose "Run as Administrator".

–Next–

Restart your computer to Recovery Environment (RE) by doing the following:
To do this,

• Restart your computer.
• Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
• When a list of menu appears, scroll to Repair your computer using the arrow keys then press Enter.
• Confirm your keyboard input method (and language, if you have installed multiple-language support). Click Next to continue.
• Log into your installation. To enable access to the command prompt, select your user name from the pulldown menu.
• Enter your password then click OK to continue.
• The Recovery Environment menu opens.
• Scroll down to Command Prompt.

On the Command Prompt:

Type the following:

ren C:\Windows\system32\userinit.exe userinit.old

then press the Enter key.

–Next–

Type the following:

copy c:\userinit.exe C:\Windows\System32\userinit.exe

then press the Enter key.

–Next–

Type Exit

then reboot your computer in Normal Mode

–Next–

We need to verify if the fix is successfull by doing the following:

• Right-click SystemLook.exe then choose "Run as Administrator" to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  explorer.*
  userinit.*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Try your explorer and see how it goes.

Please notify me in case there are any problems regarding the fix above. Thank you.

Hi,



Please do the following:

Open a new Notepad session

• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
• Copy and paste all of the text in the code box below into Notepad. Do not copy the word code.
  

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "combofix"=-
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
  "combofix"=-

• Click File, Save as…, and set the Save in to your Desktop.
• In the File name box, type fix.reg
• In the Save as type: box, choose All Files
• Choose a location to save. Preferably on your desktop.
• Click Save.

It should look like this: [external image: Posted Image]

Right click on fix.reg and choose "Run as Administrator", allow it to run, it should only take less than a second.

–Next–

Delete your copy of Combofix then download a fresh one from one of the links below:

Link 1
Link 2

Then run Combofix again. Thanks.