Infection: "system-check.com" [Solved]

Great, hang on a bit, be right back

Dean,

Insert your Windows CD into the CD Rom drive and you can hold the shift key down and it will prevent it from loading.

I am assuming your CD drive is D:, if its not than change this fix by replacing D: with the letter of your drive. Make sure to delete the other expand.bat that we created before


Copy all the Quoted text inside the Quote box and paste it into Notepad, save it as expand.bat , on the drop down list change it to All Files, save it to your desktop, then click on expand.bat to execute it.

expand D:\WINDOWS\I386\winlogon.ex_ c:\windows\system32\system32\dllcache\winlogon.exe
expand D:\WINDOWS\I386\svchost.ex_ c:\windows\system32\system32\dllcache\svchost.exe
expand D:\WINDOWS\I386\explorer.ex_ c:\windows\system32\dllcache\explorer.exe

At this point just let me know how it went

I ran expand.bat, and i got the same problem as before, the c:\ screen pops up with text flying… bottom-to-top this time… endless loop

Can you look on your CD and find the i386 folder?

Yep.. in it right now

is it: D:\WINDOWS\I386

No, it is D:\I386

Try it like this

Copy all the Quoted text inside the Quote box and paste it into Notepad, save it as expand.bat , on the drop down list change it to All Files, save it to your desktop, then click on expand.bat to execute it.

expand D:\I386\winlogon.ex_ c:\windows\system32\system32\dllcache\winlogon.exe
expand D:\I386\svchost.ex_ c:\windows\system32\system32\dllcache\svchost.exe
expand D:\I386\explorer.ex_ c:\windows\system32\dllcache\explorer.exe

At this point just let me know how it went

Same as before. Runs like an old BASIC program: 10 print "blah blah blah"; 20 goto 10 …if that helps…

That's pretty weird…

Lets try it another way.

Click Start > Run
Copy past this into the open window

expand D:\I386\winlogon.ex_ c:\windows\system32\system32\dllcache\winlogon.exe

Tap Enter.

I ran it, and it opened and closed very quickly before i could read it. ran it again, used a screenshot app to catch image before it closed itself again, and caught the text: Expanding d:\I386\winlogon.ex to c:\windows\system32\system32\dllcache\winlogon.exe. Can't open output file: \windows\system32\system32\dllcache\winlogon.exe.

Lets see if we can rename the existing ones Go to each locations and Right Click and the file, select Rename and rename to .Old Example: winlogon.old c:\windows\system32\system32\dllcache\winlogon.exe c:\windows\system32\system32\dllcache\svchost.exe c:\windows\system32\dllcache\explorer.exe Then try the expand again

If that didn't work, we'll need to run the expand from the command prompt.


Click Start, Run and type CMD.EXE

You'll need to type these in so note any spaces as they need to be there and tap enter after each line.

expand D:\I386\winlogon.ex_ c:\windows\system32\system32\dllcache\winlogon.exe
expand D:\I386\svchost.ex_ c:\windows\system32\system32\dllcache\svchost.exe
expand D:\I386\explorer.ex_ c:\windows\system32\dllcache\explorer.exe


That's the best I can do.
Ken will be back with you to help.

You can actually copy and paste each line in, let do one at a time from the command prompt expand D:\I386\winlogon.ex_ c:\windows\system32\system32\dllcache\winlogon.exe expand D:\I386\svchost.ex_ c:\windows\system32\system32\dllcache\svchost.exe expand D:\I386\explorer.ex_ c:\windows\system32\dllcache\explorer.exe

c:\windows\system32\system32\dllcache\winlogon.exe
c:\windows\system32\system32\dllcache\svchost.exe
c:\windows\system32\dllcache\explorer.exe

I have neither a system32 folder nor a dllcache folder within my c:\WINDOWS\system32 folder.

I do, however, have winlogon and svchost files in the c:\WINDOWS\system32 folder. Neither of these have flie name extensions, and I've noticed that a majority of .exe files I've used to try to fix this mess don't have visible file name extensions either.

there is no explorer file in the c:\WINDOWS\system32 folder though.


Just saw your last 2 posts, will try to do something with them… thanks!