What the Tech:
I have a PC that has been infected with the Systems Care AntiVirus virus. The PC is running XP Media Center SP3.
I tried to boot up in Safe Mode but I am unable to do so. When the computer is booting up I see "Boot from the CD" flash on the screen. I never remember seeing this before.
Any help in removing this virus would be appreciated.
Thank you in advance.
vdicaprio
LDTate
I do not think I have the XP CD to boot from but I will look for it. How should I proceed if I find it ?
I dont think the hard drive has crashed becasue the computer does boot up and seems to run but it is interupted by the System Care Antiviurs program. I see my normal desk top and can do some tasks. I just cant get into Safe Mode by tapping the F8 key during the boot cycle.
Also, if I dont find it, how should I proceed.
Thanks
Vdicaprio
If it boots in Normal Mode, lets not worry about a CD right now.
Disconnect from the internet and reboot
We are going to try System Restore to restore the system prior to the infection.
Windows XP
Step 1: Boot to Normal Mode
Step 2: Use ctrl/alt/del (keys) to get task manager opened
Step 3: choose file and create new task
Step 4: Then Navigate to:
C:\windows\system32\Restore and press Enter (double click rstrui)
Step 5: Restore Computer to Date you know you were virus free
LDTate
I am guessing that I will be able to do a system restore but I will not have a chance to get to it until late tonight. Once I do the system restore, what will be the next step?
Thanks
Vdicaprio
Please download DDS from the link below and save it to your desktop:
Note: Be sure to select Save as Type > All Types
http://download.bleepingcomputer.com/sUBs/dds.scr
*Disable any security software before running(excluding Malwarebytes)
*Steps to disable some common security applications(no need to disable Malwarebytes, it will not cause any issues): http://forums.whatthetech.com/index.php?showtopic=96260
Please double click dds.com to run the tool. (File name will be different if alternate download used).
Vista & Windows 7 users: You must right click on the file above and select "Run As Administrator" to run the tool.
A black window(DOS window) will open with some instructions/comments.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Please save using the default Notepad format,
DO NOT USE WORD or any other office type of software.
DO NOT COPY & PASTE the log, send it as an attachment.
Reply to THIS ticket, DO NOT create a new one.
We'll proceed based on the output of these files. Please do not reply until both logs are attached and ready to be sent.
Name of files to be attached into your next reply:
dds.txt and Attach.txt
2) Click on the following link:
http://www.eset.com/onlinescan/
3) Click on the "ESET Online Scanner" button.
4) Put a check in the box that says "YES, I accept the Terms of Use."
5) Click the 'Start' button just to the right of the checkbox.
6) Check the box that says "Remove found threats" (this is very important).
7) Click on "Advanced settings".
8) Put a check in the box that says "Scan for potentially unsafe applications".
9) Verify that "Scan for potentially unwanted applications" is also checked.
10) Verify that "Enable Anti-Stealth technology" is also checked.
11) Click the 'Start' button in the lower-right corner of the page, and it will begin downloading it's database, and then it will start scanning.
12) When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
13) Save that text file on your desktop, and then attach it to a reply for me.
14) Close the ESET online scan.
15) Re-enable your Antivirus.
I will take a look at the log, and let you know if anything needs to be removed.
LDTate
I ran into a problem trying to reactivate the Microsoft Essentials. When I tried to start it back up I kept getting an error.
I uninstalled the Microsoft Essentials and when I tried to reinstall I received the error code 0x80070643.
I tried uninstalling the .NET Framework that was running and installed 3.5 .NET Framework SP1. I still have the error 0x80070643 after doing this.
Vdicaprio
LDTate
The fixit tool didnt find any problems. Tried a few things and now the error code is 0x80070780 when I try to install MSE.
Sorry to be a pest.
Vdicaprio
LDTate
Still having the same problem.
I entered the items in your list and ran them as you suggested.
The third item on the list, mshtml.dll was loaded but the DLLRegisterServer entry point was not found so the file was not registered and the fourth item msjava.dll came back with a message that the specified module could not be found.
Windows update found an update for the .NET framework 3.5 so I loaded it and rebooted.
When I tried to install MSE I received the same error code, 0x80070780.
Thanks
vdicaprio
