Limited functionality!

I am working on a neighbor's HP Pavilion 6367c desktop. Unit has very limited functionality at this time as listed below - can hardly execute any program let alone any fix tools from this site Internet - not accessible from any browser (IE8, Safari) Malwarebytes - cannot run as Administrator, or in Safe Mode exeHelper.com - from this site does not run, renaming to .scr does not help DDS.scr - also from this site does not run Also can access Add/Remove Programs but cannot actually remove programs like McAfee Security Scan Plus, or the AV on this system Can ACCESS programs from Start Menu or Windows Explorer/My Computer but cannot execute or run any executable, even though User Account Control pops up and can click Yes to UAC request Going bald quickly on this one!! Help!!!!!

Hello Arbee322 and
I'm RedCar92 and my name is Bill, I'll be glad to help you with your computer problems.

• Please observe these rules while we work:
• Read the entire procedure
• It is important to perform ALL actions in sequence.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with me till you're given the all clear. Malware removal can be stressful but we will clean it.
• Remember, absence of symptoms does not mean the infection is all gone.
• Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperative and could require a full reinstall of your OS, losing all your programs and data.

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

Thanks, Bill, for your help. What to do next. Russ

OK Russ, Please be patient, as you may have noticed, I am still in training, all of my replies must be approved by an instructor.

Greetings Arbee322,
OK, here we go!

Let's try getting our programs running by using this one:
Print out these instructions as we may need to close every window that is open later in the fix.
It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.

Do not reboot your computer after running rkill as the malware programs will start again.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 3 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.

• rkill.exe
• rkill.com
• rkill.scr

Do not reboot your computer after running rkill as the malware programs will start again.

Next
The previous program should allow the next to run.

• Please download aswMBR to your desktop.
• Double click the aswMBR.exe icon to run it
• If asked, accept the AVAST virus definitions.
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Next
If the previous program ran and you did not reboot you should be able to run this now.
Right click dds.scr select Run as Administrator to run the tool.
When done, DDS.txt will open.
Save to your desktop.
Please include the contents of the following in your reply using Copy / Paste:
DDS.txt and Attach.txt

Logs to post:

• aswMBR.txt
• DDS.txt
• Attach.txt

Bill, Thanks for the instructions. I am working on this system in my spare time, sorry for delays. Downloaded all the tools to a USB drive (even DDS.scr - just googled it and got from www.techsupportforum.com) Seems like whatever is on this system has spread to the other systems in this residence I will run these tools and post logs hopefully later today. Does running them in Safe Mode matter? I will probably open a new topic for my neighbor's third system that is acting funny, too. Thanks again for your help, Russ

Best to run in normal mode if possible. Rkill should help with this. It is designed to stop all but necessary MS services, this should allow other programs to run. You should open a new topic for each different problem and or system and you can open any time. Just don't get confused between responses and systems.

Hello Arbee322, How is it going? Do you still need assistance.?

Bill, I have attempted to run the three tools you recommended/asked me to run, in Normal Mode and Safe Mode. NONE of the tools I have downloaded and attempted to run as Administrator will run on this system successfully. What next? Thanks, Russ

OK Russ, what message or error do you get when you try to run RKill.exe then RKill.com and RKill.scr?

Russ, do any programs run like calc.exe ot sol.exe?

Bill, Rkill.com/exe/scr return NO message when I attempt to run them, NONE whatsoever. Will check the apps you mention when I get home. Thanks, Russ

Bill,

The programs you asked about do work - Calc.exe, sol.exe, etc. from the Start/Programs menus.

I did notice there are numerous "other" games installed on this system, most likely installed by HP and/or possibly the user (though I don't think the user plays many games on this system.) When I tried to run any "non-default" games they did not run.

It appears that default Windows components/programs (mostly) run fine. Exceptions include browsers (IE, etc.), ANY antivirus or malware removal applications/tools, and most ANY other applications that were installed after Windows (just my opinion, observation).

This is a very nice system that has become an expensive paper-weight!

What other ideas might you have?

Thanks,
Russ

Bill, one more thing - I am prepared to back up the hard drive and reinstall Windows on this one. However, if there is ANY way to avoid that I would rather not have to do a reinstall!! Thanks, Russ

Greetings Arbee322,

You do have a toughie there.
Let's re-download rkill.exe and DDS.scr to a flash drive or CD.
Save-asrkill.exe to calc.exe and DDS.scr to sol.scr then copy them to desktop and try running them as posted before.