Help

OK Mike we're going to try something we did another way.

With your XP CD in the CD drive, click Start> Run and copy / paste this line in the open window.


rundll32.exe advpack.dll,LaunchINFSection C:\Windows\Inf\sr.inf

Hoping this reinstalls system restore.

Check it and let me know.

Hi Bob, I tried it. At first I got nowhere. With the Windows XP disc in the drive, I copied the instructions into start> run. A small dialogue box opened up as before that stated: "The file 'sr.sys' on Windows XP Home Edition Service Pack 2CD is needed" "Type the path where the file is located, and then click OK." Benaeath that at the bottom of that dialogue box it states "Copy the files from:" and shows a place for an entry line. Even with my CD in the drive, the default (its already there) read C:\Windows\Inf\i386.I tried clicking on it, but it does nothing. SO I changed the default to read: D:\I386. (That's where the file sr.sy_ is). Now I clicked OK -and it seemed to download it. It seemed -pardon my layman's language- to accept the instruction and showed a progress bar downloading it. But then, immediatley afterward, nothing seems to have changed. and it does not appear to be downloade. It seems sr.inf is still not installed. I would like to suggest that something is 'blocking' or immediately erasing the reinstillation of that file. That's just my guess based on the fact that it seemed to be downloaded. The same thing occurred, it seems to me, when I tried to use the sfc /scannow command. It seemed to do something, showed a progress bar, but when it finished, nothing had changed. Mike

1. Click Start/run type in
services.msc
locate the System Restore service and doubleclick
it. Click the stop button, then set the startup type dropdown to disabled.
Click apply/ok, then reboot.

2. Navigate to c:/System Volume Information folder" on each drive and delete any contents.




Reverse the steps in 1. to restart system restore like this:


1. Click Start/run type in
services.msc
locate the System Restore service and doubleclick
it. Click the stop button, then set the startup type dropdown to Automatic.
Click apply/ok, then reboot.

Check system restore again to see if it's working.

Mike I just had a thought.
If by some slim chance
services.msc works I want you to check and see whether or not some of all this malware you had stopped or disabled other services.

To compare them look at this site.

Change any of them by double clicking on the service and change the start up type.

Hi Bob. I can't go do as you asked. When I went to start>run services.msc, I received the message I have mentioned before in other contexts: "MMC cannot open the file C:\WINDOWS\system32\services.msc" "This may be because the files does not exist, is not am MMC console, or was created by a lkater version of MMC. This may also be because you do not have sufficient access rights to the file " Sorry.

Hi Bob, I don't think there's any more that I can do for now. I think your other instructions were contingent on the first -which I can't get access to and perform. If I'm mistaken, please explain. Thanks, Mike

OK mike check one thing for me.

start> control Panel> Administrator Tools> Computer Management>users/OR local users and groups/users

Right click the name you sign on under in windows( your user name) /properties

Then click member of it should list you as an adminisrtator. If not :

Click add and add administrator if you can.

If not reboot into safe mode.
Log on as administrator..

Follow those same directions and get you listed as an administrator.

Let me know.

Hi Bob, After I open Administrative Tools, I clcik on Computer Management. Here I receive that same message: "MMC cannot open the file C:\WINDOWS\system32\compmgmt.svc" "This may be because the files does not exist, is not am MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file " So I will try to do so in safe mode. (I'll write back after I've tried that.) I should mention that both Superantispyware and Avast tell me there are new updates. Should I download them or wait until this is fixed? Mike

I tried to do as you suggested in Safe Mode. but here's the thing: I turn the computer on in safe mode, click on administrator and, after it loads the setting, there are only a few icons on the desktop -most of the desktop icons are gone. AND, more importantly, the bottom tool bar with the START function is gone. I tried to use the Windows key, which usually opens START in regular mode, but it doesn't work in safe mode. I tried fooling around in safe mode, but couldn't figure a way into start>control panel. Mike

Checking on something Mike. Be with you as soon as I can. May be time to try a repair of windows. I'll let you know.

OK Mike,
I have checked around with other people in the field. We are out of ideas. I gave it 110% and had hep along the way in the background.
At this point I am going to suggest a full repair of windows. This should repair most ( hopefully all) of what we see wrong.
The reason to do a repair is so that you won't lose all your programs and information. This is not a reformat.

PRINT THESE OUT FOR REFERENCE!




You will need to have you windows product ID handy. It should be on a sticker on the back or side of your computer.
It has 25 characters. Or on a windows booklet that came with the computer. If you can't find it you will have to contact the manufacturer of the computer to obtain this ID.

Ready?

____________________________


1. Place the windows CD in the drive and restart your computer.

2. First screen you see will say .. Press any key to boot from CD. Do so. Hit any key.

3. Windows XP will present you with three options:

To setup Windows XP now, press ENTER. << you want this option.
Press the Enter key and allow the CD to load the Setup program into memory.


4. After pressing the F8 key ( you will be asked to ) to accept the license agreement, the setup program searches for any previous installations of Windows. It should discover the existing corrupt installation and give you the option too perform either a 'New' installation or 'Repair' the existing one.

Highlight the Windows XP installation that you want to repair from the list, and press R to start the process.

The Setup program then continues as if it were doing a clean installation, but the previously installed applications and the customised settings should remain intact. As long as they weren't damaged by malware.

During this time it may restart a time or 2. DO NOT HIT ANY KEYS ON THE KEYBORAD WHEN YOU ARE ASKED AGAIN HIT ANY KEY TO BOOT FROM CD. This will only restart the process.
But keep the CD in place until windows is up and running.


If the option to Repair Install is NOT available and you continue with the install; you will delete your Windows folder and the Documents and Settings folders. All applications installed that place keys in the registry will need to be re-installed and will require the original install media. This would be a full format. Which is you next and last resort.

When this is done post back a new HJT log and let me know how things seem.


_____________________

Bob, :Looking for the Windows number. Have to go out for a while, will probably post later. Mike

Just curious as to how your getting by Mike?

Hi Bob, I realized that this would take a long time to do. I have been busy enough that I started once and stopped. I intend to perform the full repair. several questions, since I am writing: will I lose any data or programs/files that I will need or may want to download later? Is there anything else I should know about this procedure? Is it possible after a full repair that some bugs remain? Both Avant and Superantispyware have mentioned that there are updates. Should I wait until after the repair? Mike

Feel free to do the update s with both super anti spyware and Avast.

This procedure is designed to remove no programs you already have or produce no data loss.
Of course you have to remember that you were seriously infected.
What malware can do can always be a mystery.