I'm infected with Win32/Doklin!generic

Hi Thromble,

I don't know how that registry fix could have caused the problem you describe, but we will roll back the changes it made and see if that resolves it.
We will use Safe Mode to restore the registry backup using ERUNT:

Restart your computer and as soon as it starts booting up again continuously tap F8
A menu should appear, use the arrow keys to select Safe Mode and press enter

Use Windows Explorer to locate the backup folder, by default it will be in:
C:\WINDOWS\ERDNT\DD-MM-YYY\
where DD-MM-YYYY was the date of the backup

Open the backup folder and run ERDNT.exe, press OK to enter the program, leave the default settings and press OK to start the restore.

When it's complete, reboot into normal mode and see if the problem recurs.

If the issue is resolved, please check for and delete (if present)
C:\WINDOWS\service32.exe
then install and scan using AVG Antispyware following the instructions from the previous post.

If the problem recurs, let me know what's happened.

Hi Thromble,

I don't know how that registry fix could have caused the problem you describe, but we will roll back the changes it made and see if that resolves it.
We will use Safe Mode to restore the registry backup using ERUNT:

Restart your computer and as soon as it starts booting up again continuously tap F8
A menu should appear, use the arrow keys to select Safe Mode and press enter

Use Windows Explorer to locate the backup folder, by default it will be in:
C:\WINDOWS\ERDNT\DD-MM-YYY\
where DD-MM-YYYY was the date of the backup

Open the backup folder and run ERDNT.exe, press OK to enter the program, leave the default settings and press OK to start the restore.

When it's complete, reboot into normal mode and see if the problem recurs.

If the issue is resolved, please check for and delete (if present)
C:\WINDOWS\service32.exe
then install and scan using AVG Antispyware following the instructions from the previous post.

If the problem recurs, let me know what's happened.

Okay. Assuming that when I do the above, that the problem doesn't recur, and that I successfully install and scan using AVG Antispyware, do you want me to resume the previous instructions all the way to the end?

Yes that's it

Now, I can't even boot in safe mode. While windows is in the middle of starting up, before the logon screen appears, but after I select 'Safe Mode', it goes blank, and most of the internal CPU sounds die off. I've tried this 3 times, and everytime it won't boot, even in safe mode.

Hi Thromble, I'm sorry to hear about the problems, it sounds very frustrating. Given the symptoms you describe, and the fact that malware very rarely causes this type of problem, I think we have to consider whether there is a hardware element to this. What you describe could for example be caused by a dead or dying CPU fan - this causes the CPU to overheat and automatically shut down to prevent damage. There are numerous other hardware-related possibilities. One way to determine whether this is caused by hardware or software is to load a bootable CD - if a bootable CD loads up fine then we can probably put it down to either a hard drive fault or purely a software/OS problem. If the same issue occurs with the CD, then it's a hardware issue. Please let me know the following: - Do you have a Windows CD (any 2K/XP version), a recovery CD for the computer or any other bootable CD that you are aware of? - If you do not have a bootable CD, do you have a CD-writer and media so that you can create one? - Are you comfortable with opening the computer case to check whether the fans are clean and operating normally? - What do you think is the cause of the problem?

Yes, I have the e-machines Restore CD that came with the computer. (It's an e-machines computer.) Also, awhile back, I made bootable CD that boots to linux I think. I created it from a company called Weaknees. (It's a long story, but awhile back I upgraded the hard drive on my TiVo, and to do that, I had to temporarily transfer the TiVo hard drive to my PC, and use some linux utilities to modify the TiVo's hard drive, so that's why I created the bootable CD, but that CD does not boot to Windows.) Also, yes I'm comfortable opening the PC, as I have experence not only installing hard drives, but also RAM memory, and a power supply as well. But I've never replaced a motherboard, for example. Anyway, out of curiosity I opened the computer to see if I could see anything unusual happening on the inside while my problem exhibits itself. I booted to the linux CD, and while booting I did notice a lot of dust on the fan. (I'm assuming that's the fan I'm looking at. There's a big black box attached to the motherboard, several inches on each side. On the top of the box is a fan that blows downwards, towards the motherboard. That fan had a lot of dust. Anyway, while the computer was booting I tried to blow the dust off. It did boot, but after several seconds my involuntary shutdown problem happened, so yes, even using a bootable CD does not stop the involuntary shutdown. But since I had the case open, I was able to see in more detail what was happening. That fan I spoke of, that blows down onto the motherboard, stopped spinning at the same time as my screen went blank. But not all sounds were dead. It's hard to figure out where the remaining sounds were coming from, but my guess is that either the hard drive or CD drive was still spinning (probably the hard drive, as I usually don't have a CD in the CD drive.), and that spinning was the sound I could still hear. I didn't feel safe letting the hard drive spin like that when the other fan wasn't working, so I unplugged the computer.

Hi Thromble,

Well I think it's clear you know plenty about the insides of your PC, and you've certainly isolated the problem.

The big black box you refer to sounds like the power supply, you can check this by confirming that it's where the mains power cable plugs into, and on the inside you'll see connectors running from it to the motherboard, hard disk and CD drive.

If the power supply fan or the power supply itself is dead or dying, then that would be a very reasonable explanation for what's happening - it's not an unusual occurrence and in most cases not expensive to replace.

I think the next step for you is to confirm whether it is the power supply you are looking at, and then take steps to have it replaced. In the meantime I'd recommend leaving it unplugged for safety.

There is some good news, which is your data is still likely to be safe, however there's still a couple of things we should do to finish cleaning your machine when you have the power problem resolved.

Best of luck and if you need any further assistance let me know.

Hi Thromble,

Well I think it's clear you know plenty about the insides of your PC, and you've certainly isolated the problem.

The big black box you refer to sounds like the power supply, you can check this by confirming that it's where the mains power cable plugs into, and on the inside you'll see connectors running from it to the motherboard, hard disk and CD drive.

If the power supply fan or the power supply itself is dead or dying, then that would be a very reasonable explanation for what's happening - it's not an unusual occurrence and in most cases not expensive to replace.

I think the next step for you is to confirm whether it is the power supply you are looking at, and then take steps to have it replaced. In the meantime I'd recommend leaving it unplugged for safety.

There is some good news, which is your data is still likely to be safe, however there's still a couple of things we should do to finish cleaning your machine when you have the power problem resolved.

Best of luck and if you need any further assistance let me know.

Hmmm for some reason I didn't think the black box was the power supply, but this evening I'll look again to verify. The last computer whose power supply I replaced had a bigger one than this box, and it was silver, but admittedly that's the only power supply I've ever worked with, so I suppose this part might not be a standardized type of part. Also, in my other computer, the power supply was not directly attached to the mother board like this black box is. But maybe that's another feature that varies by computer.

It sounds like I had a hardware failure that coincidentally happened while I was applying your software fixes, so I'm thinking that once I fix the hardware, we'll need to resume with the software instructions you gave me. If I find these wires you speak of, suggesting it's the power supply or fan gone bad, I guess I could unhook it from the computer and take it to a computer store to buy a replacement power supply (which I guess will have the fan attached), and then install it, and then hopefully I can resume your software instructions.

Come to think of it, I may have an extra power supply left over from my last computer. (It eventually had to be replaced, and I kept the power supply.) But I don't know if power supplies are compatible from computer to computer. That power supply was mounted to the case, not the mother board, and the fan did not blow directly down onto the mother board, but across it's surface. So I'm not sure if it's wise to use it in this computer.

Hi Thromble,

If it's mounted on the motherboard, then the black box might not be the power supply, but of course it still could be a power supply fault causing the problem. I can't be sure from the information that's been provided - so please don't consider my guess a diagnosis.

It's likely to be straightforward to diagnose with right equipment so I'd recommend a computer shop as being the next step. Of course if you are able to conclusively diagnose and order/fit the part(s) yourself then that's great too.

Power supplies are not always compatible between computers, the total wattage and power output types can vary - you should get expert advice before fitting a replacement power supply.

I'd like to help with this part further, but my focus is malware and if you would like some support with the hardware repair then I'd recommend posting at PC Pitstop.

Ideally we should continue cleaning when the hardware fix is complete so by all means continue with the instructions when you're done, let me know and we'll pick up where we left off, we're almost done anyway.

Best of luck

Okay. I've verified it's the CPU fan that stops spinning. I talked with an emachines tech support guy (I have an emachines computer) and he recommends replacing the CPU fan. But thanks for the advice so far - to be sure I may get a second opinion before going out and buying another CPU fan. I just figured out how to remove it, so it will be simple if that's all I have to do. (It looks easier to replace that the power supply is.) Anway, after I fix it, I'll resume with the last set of instructions you gave me. By the way, thanks for that link to PCpitstop; it looks like a really nice site. I just posted my CPU fan issue to the people there.

You're very welcome, I hope it works out without too much difficulty, talk with you a bit later

Well I have an update on the situation. I used compressed air to clean it more thoroughly, like the people at PCpitstop suggested, and that didn't fix things. I'm also getting mixed advice from them, as some say it's worth trying to replace the CPU fan, and others think I have a motherboard problem. It does seem strange to me that the fan initially works fine and cuts off after less than a minute, as if the motherboard is shutting it off. Anyway, I tried three different places in town who sell my type CPU fan, as apparently my size of fan isn't common. The last place I called immediately asked me if I had an e-machines, and said 'yes, as a matter of fact'. They tell me emachines are known for my exact problem, and 90% of all the e-machine PCs brought in for repair with my symptoms (CPU fan works for about a minute, shuts off, screen goes black, hard drive still spins), are diagnosed as having a bad motherboard. With a bad motherboard, on a computer as cheap as the one I've got, and as old as the one I've got, it seems to make sense for me to buy a new computer. They have ones for less than $400 that are quite a bit more powerful than the one I've got, so I'm starting to shop for one. But I still might request some advice regarding malware though. Since I don't want to lose the data on my old hard drive, I'd like to install my old hard drive as a second drive in my new computer. But that drive has malware on it. So before installing it, I'm wondering if you could offer advice as to a safe procedure I might follow to avoid having the malware that exists on that drive from migrating onto the new computer. And of course, also, I'd like to know how to destroy the malware on that drive without destroying the data. Also, I'm assuming before I do any of that, the first thing I should do is install a firewall and antivirus / antispyware on the new computer. (Or is that a wrong assumption? Should the malware be cleaned off first before doing that?) People at Tom Coyote pointed me to some free websites containing exactly this type of software, which I've already installed on my other computer. (I own two computers.) That software is working very nicely, so it sounds like I should install that same software on the new computer.

Hi Thromble,

I'm sorry to hear things are a bit worse than we expected.

When you get your new computer, and before plugging your old drive into it, you should fully update the operating system and install security software.

If you are happy with the security software installed on your other machine then of course using the same software on the new machine makes sense. However, I strongly recommend that your setup contains the following components:
- 1 Antivirus program with active/real-time protection features
- 1 Antispyware program with active/real-time protection features
- 1 Personal firewall program

I recommend you install just one of each of the above programs on your machine, however if you wish to have more than one Antivirus or Antispyware program, then make sure their active/real-time protection features are disabled, otherwise there may be conflicts between them. Instead of using multiple programs to get a second opinion, I recommend using online scans such as Kaspersky's and Panda - they are free and very effective.

If you aren't sure about the software you have installed, post the details and I'll let you know what I think.

Some other security software to consider:

IESPYADS helps protect you from malicious websites by placing a list of known bad websites in Internet Explorer's Restricted Zone. This Zone limits the capabilities of these websites including preventing them from installing software. This will compliment your security software and I recommend you install it:
http://www.spywarewarrior.com/uiuc/resource.htm

A custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
If you install this, please be sure to follow the DNS Client service instructions.

Once you have your machine set up, then connect your old drive, immediately scan it with your antivirus program and your antispyware program, and clean/quarantine anything it finds.
Then, navigate to and delete the following file (if present):
X:\WINDOWS\service32.exe
Instead of X:\ please use the drive letter of your old hard drive.

After that is complete your old drive will probably be clean, however I'd recommend moving your old data off and reformatting it, as you will free up significant space taken up by your old OS.

If you need further assistance with this or you have questions then let me know.

Here's the protection software I have installed on my other computer that's not having problems:

• Spywareblaster ( http://www.javacoolsoftware.com:80/spywareblaster.html )
• Spywareguard ( http://www.javacoolsoftware.com:80/spywareguard.html )
• Zonealarm firewall ( http://www.zonealarm.com/store/content/cat…d=dbtopnav_zass )
• AVG antivirus ( http://free.grisoft.com:80/freeweb.php )

All the above is free, and I received the above links from a thread in TomCoyote from back when my good computer was less protected, and I was getting a virus off of it.

I'm assuming the above 4 programs are all compatible with each other.

Looks fine to me Let me know if you need any further help.