44 replies to this topic

[jorgitso]

I didn't want to proceed because there are several error messages while running the program.

I attached the screenshots with the error messages.

 

In the screenshot named as roguekscreen2.bmp what the window says is ''The unit is not ready to be used; it might be that the door is open. Check unit A: and make sure that the disk is inserted and the unit door is closed''

Attached Files

•  roguekscreen1.bmp   211.55KB   244 downloads
•  roguekscreen2.bmp   302.71KB   268 downloads

Edited by jorgitso, 03 November 2014 - 08:12 AM.

[jorgitso]

Also, the program I downloaded from the link you posted isn't quite the same as the one of your screenshots, mine doesn't have the shorcutsfix button.

 

I attached a screenshot.

Attached Files

•  rogue.bmp   1.51MB   279 downloads

[jorgitso]

got some good news!, I installed the avast free antivirus!

[Tomk]

Yeah.  The program has been updated a time or two since the pictures were made that I posted.

 

Seeing as how you got AVAST! installed, please run it and see what it finds.

[jorgitso]

Avast found lots of infected files in my PC, and I read that mostly all was infected by Win32:Sality, Win32:Kukacka, Win32:SalirCode and Win32:Mobogenie

 

I attached some screenshot of avast while cleaning

Attached Files

•  computer threats scanned by avast2.bmp   1.17MB   247 downloads

[jorgitso]

but also while fixing, it was saying it had several errors, maybe we can try all the programs that I couldn't download before, so we can get the pc fully clean?

[Tomk]

Virtually everything AVAST! found is/was related to sality.  That's the bad news.  The good news is that nothing found is currently "live".  All traces are either in quarantine or only traces found in your restore points.  Current versions of AVAST! can "kill" sality.... but "healing" the system is iffy.

 

Please try to download and run SalityKiller again per post #27.  Let me know if it finds anything.

[jorgitso]

sure

[jorgitso]

here is the result

 

 

Attached Files

•  salitykiller result.bmp   647.84KB   235 downloads

[jorgitso]

so, what now?

[Tomk]

Let's run a tool that does some checking for scrambled files... just in case there is something that sality manipulated.

 

Download Windows Repair (All in One) from this site

Install the program then run it.

NOTE 1. In Windows Vista, 7 and 8 right click on the program, click "Run As Administrator".
NOTE 2. Disable your antivirus program before running Windows Repair.

Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:





Once that is done then go to Step 3 and allow it to run System File Check by clicking on Do It button:




Go to Step 4 and under "System Restore" click on Create button:




Go to Start Repairs tab and click Start button.

Leave all checkmarks as they're.
NOTE for Windows 8 users. Reset Registry Permissions is NOT checked by design.

Click on Start button.



Post Windows Repair log (_windows_repair_log.txt) which is located in the following folder:
64-bit systems - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
32-bit systems - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs

 

Also, please let me know how the system seems to be running.

[jorgitso]

Windows Repair Log

 

 

 

Tweaking.com - Windows Repair v2.10.1

--------------------------------------------------------------------------------

 

System Variables

--------------------------------------------------------------------------------

OS: Microsoft Windows XP

OS Architecture: 32-bit

OS Version: 5.1.2600

OS Service Pack: Service Pack 3

Computer Name: despacho

Windows Drive: C:\

Windows Path: C:\WINDOWS

Program Files: C:\Archivos de programa

Current Profile: C:\Documents and Settings\george

Current Profile SID: S-1-5-21-861567501-152049171-725345543-1005

Current Profile Classes: S-1-5-21-861567501-152049171-725345543-1005_Classes

Profiles Location: C:\Documents and Settings

Profiles Location 2: C:\WINDOWS\ServiceProfiles

Local Settings AppData: C:\Documents and Settings\george\Configuración local\Datos de programa

--------------------------------------------------------------------------------

 

System Information

--------------------------------------------------------------------------------

System Up Time: 0 Days 00:06:32

 

Process Count: 40

Commit Total: 313.37 MB

Commit Limit: 4.57 GB

Commit Peak: 386.10 MB

Handle Count: 10769

Kernel Total: 59.80 MB

Kernel Paged: 43.24 MB

Kernel Non Paged: 16.56 MB

System Cache: 710.80 MB

Thread Count: 581

--------------------------------------------------------------------------------

 

Memory Before Cleaning with CleanMem

--------------------------------------------------------------------------------

Memory Total: 3.24 GB

Memory Used: 474.20 MB(14.2909%)

Memory Avail.: 2.78 GB

--------------------------------------------------------------------------------

 

Cleaning Memory Before Starting Repairs...

 

Memory After Cleaning with CleanMem

--------------------------------------------------------------------------------

Memory Total: 3.24 GB

Memory Used: 368.21 MB(11.0969%)

Memory Avail.: 2.88 GB

--------------------------------------------------------------------------------

 

Starting Repairs...

   Started at (11/5/2014 8:58:00 AM)

 

Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...

Total Missing 'InstallDate' Fixed: 74

 

01 - Reset Registry Permissions 01/03

   HKEY_CURRENT_USER & Sub Keys

   Start (11/5/2014 8:58:03 AM)

   Running Repair Under Current User Account

   Done (11/5/2014 8:58:08 AM)

 

01 - Reset Registry Permissions 02/03

   HKEY_LOCAL_MACHINE & Sub Keys

   Start (11/5/2014 8:58:08 AM)

   Running Repair Under System Account

   Done (11/5/2014 8:59:29 AM)

 

01 - Reset Registry Permissions 03/03

   HKEY_CLASSES_ROOT & Sub Keys

   Start (11/5/2014 8:59:29 AM)

   Running Repair Under System Account

 

The current repair has failed to start for over 30 sec.

Trying Again....

 

   Running Repair Under System Account

   Done (11/5/2014 9:02:07 AM)

 

03 - Reset Service Permissions

   Start (11/5/2014 9:02:07 AM)

   Running Repair Under System Account

   Done (11/5/2014 9:02:58 AM)

 

04 - Register System Files

   Start (11/5/2014 9:02:58 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:05:40 AM)

 

05 - Repair WMI

   Start (11/5/2014 9:05:40 AM)

 

   Starting Security Center So We Can Export The Security Info.

 

   Exporting Antivirus Info...

   avast! Antivirus Exported.

 

   Exporting 3rd Party Firewall Info...

   No 3rd Party Firewall Products Reported.

 

   Running Repair Under Current User Account

   Done (11/5/2014 9:08:11 AM)

 

06 - Repair Windows Firewall

   Start (11/5/2014 9:08:11 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:08:24 AM)

 

07 - Repair Internet Explorer

   Start (11/5/2014 9:08:24 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:11:12 AM)

 

08 - Repair MDAC/MS Jet

   Start (11/5/2014 9:11:12 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:11:22 AM)

 

09 - Repair Hosts File

   Start (11/5/2014 9:11:22 AM)

   Running Repair Under System Account

   Done (11/5/2014 9:11:24 AM)

 

10 - Remove Policies Set By Infections

   Start (11/5/2014 9:11:24 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:11:27 AM)

 

11 - Repair Start Menu Icons Removed By Infections

   Start (11/5/2014 9:11:27 AM)

   Running Repair Under System Account

   Done (11/5/2014 9:11:29 AM)

 

12 - Repair Icons

   Start (11/5/2014 9:11:29 AM)

   Running Repair Under Current User Account

   Done (11/5/2014 9:11:30 AM)

 

13 - Repair Winsock & DNS Cache

   Start (11/5/2014 9:11:30 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:11:43 AM)

 

15 - Repair Proxy Settings

   Start (11/5/2014 9:11:43 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:11:46 AM)

 

17 - Repair Windows Updates

   Start (11/5/2014 9:11:46 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.

   Done (11/5/2014 9:12:28 AM)

 

18 - Repair CD/DVD Missing/Not Working

   Start (11/5/2014 9:12:28 AM)

   iTunes not found, not applying UpperFilters iTunes Reg Key

   Done (11/5/2014 9:12:28 AM)

 

19 - Repair Volume Shadow Copy Service

   Start (11/5/2014 9:12:28 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:15 AM)

 

21 - Repair MSI (Windows Installer)

   Start (11/5/2014 9:13:15 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:21 AM)

 

23.01 - Repair bat Association

   Start (11/5/2014 9:13:21 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:25 AM)

 

23.02 - Repair cmd Association

   Start (11/5/2014 9:13:25 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:28 AM)

 

23.03 - Repair com Association

   Start (11/5/2014 9:13:28 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:31 AM)

 

23.04 - Repair Directory Association

   Start (11/5/2014 9:13:31 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:34 AM)

 

23.05 - Repair Drive Association

   Start (11/5/2014 9:13:34 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:37 AM)

 

23.06 - Repair exe Association

   Start (11/5/2014 9:13:37 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:40 AM)

 

23.07 - Repair Folder Association

   Start (11/5/2014 9:13:40 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:43 AM)

 

23.08 - Repair inf Association

   Start (11/5/2014 9:13:43 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:46 AM)

 

23.09 - Repair lnk (Shortcuts) Association

   Start (11/5/2014 9:13:46 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:49 AM)

 

23.10 - Repair msc Association

   Start (11/5/2014 9:13:49 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:52 AM)

 

23.11 - Repair reg Association

   Start (11/5/2014 9:13:52 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:55 AM)

 

23.12 - Repair scr Association

   Start (11/5/2014 9:13:55 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:13:58 AM)

 

24 - Repair Windows Safe Mode

   Start (11/5/2014 9:13:58 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:14:01 AM)

 

25 - Repair Print Spooler

   Start (11/5/2014 9:14:01 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:14:16 AM)

 

26 - Restore Important Windows Services

   Start (11/5/2014 9:14:16 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:14:23 AM)

 

27 - Set Windows Services To Default Startup

   Start (11/5/2014 9:14:23 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:14:34 AM)

 

   Skipping Repair.

   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

   Current version: 5.1

 

   Skipping Repair.

   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

   Current version: 5.1

 

   Skipping Repair.

   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

   Current version: 5.1

 

31 - Repair Windows 'New' Submenu

   Start (11/5/2014 9:14:34 AM)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (11/5/2014 9:14:37 AM)

 

Cleaning up empty logs...

 

All Selected Repairs Done.

   Done at (11/5/2014 9:14:37 AM)

   Total Repair Time: 00:16:38

 

 

...YOU MUST RESTART YOUR SYSTEM...

[jorgitso]

also when I try to do the disk check thing, it says that the system will restart and start the process but when I proceed and it automatically restarts my pc, the program doesn't load automatically and I guess it didn't do anything to the PC so... I don't know if it is an error or something.

 

Also!, when I try to do the system file check a window pops up saying:

 

''The neccesary files for Windows to execute correctly have been replaced by unknown versions. Windows must restore the original versions of these files so the system can maintain it stability.

 

Insert your CD-ROM of Windows XP Professional now.''

 

 

I attached a screenshot

Attached Files

•  proteecion mnsj.bmp   255.43KB   262 downloads

[Tomk]

I'm guessing that you don't have your XP disk in order to comply with the instructions?

 

May not be a big deal.  Even though you have now updated your system to Service Pack 3, it is still years behind in updates.  I believe you can still get them... so let's try.  Please try to download and install all updates.  What should happen is that a few will be available to download and install, then a few more, and so on and so forth.  There may be literally hundreds so this will take awhile.  Let me know how it goes.

 

To do this, go to You will need to use Internet Explorer to do this.  Then get all the Priority updates (you don't need to worry about the optional updates).  Once you can go there and it tells you everything is up to date,  you're done.

[Tomk]

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatth...ed_t106388.html and start a new topic