[Resolved]  I really need help

i installed avast! 4 home that was in an above post. i think it found a logon file that was infected. i saw it saying logon files are infected. so what i am thinking is one of them got deleted.. not sure though. thanks!!!! dan

Can you remember the name of the file? Is it any of these … * winlogon.exe * logonui.exe * netlogon.dll * seclogon.dll * usrlogon.cmd

no… i really wish i could. sorry. thanksss

Let's boot the machine again using the Windows XP CD. When you get to the command prompt, type each of these lines.

C:\Windows> CD C:\WINDOWS\SYSTEM32
C:\Windows\System32> DIR WINLOGON.EXE

If the file isn't present, it will say "No matching files were found". If's it's present, repeat the DIR command for the next file name

C:\Windows\System32> DIR logonui.exe

Go through the list till you find the missing file.

* winlogon.exe
* logonui.exe
* netlogon.dll
* seclogon.dll
* usrlogon.cmd

thanks! i am not at my house with that computer right now. i will do it as soon as i get home which will probably be 4:30 my time thanks!! i really appreciate your help… this forum rocks!!

i hope this is what you ment. i did this by booting with the windows cd and then going to the recovery console. i put dir in front of all the list i.e when i typed it in it would already say c:\windows\system32> then i would type in dir and the file name. * winlogon.exe * logonui.exe * netlogon.dll * seclogon.dll * usrlogon.cmd i tired all of those and it said no matching files for all of them. if thats not what you ment no problem i can do something else. thanks!! Dan

i tired all of those and it said no matching files for all of them.

All of them ?? This sounds very bad.
How many files did Avast said was infected? A few … or was it a truckload?
Did Avast name the infection as Virut or Virtob ?

If it's Virut/Virtob, this machine is no longer salvageable. This is a vile infection. This infection has different versions and most of them are buggy. This means… it infects a file - but not properly done, so this results in the fact that Antivirus scanners cannot properly disinfect the files either > result > files are corrupted/or getting deleted instead. The best solution is a format and a reinstall here.

Also, if you want to backup important files before a format and reinstall, please note that you should not backup any exe or scr files, because they are infected.

dang,,,, hopping it wouldn't come to this… o well…. i guess its a new chance for me to learn. i didn't really have much control over what it deleted because it did it before i logged on like it scanned it before the logon screen. how could i back things up if i cant log on? i do have the windows oem cd.. have an external hare drive… have other desktops and laptops.. have norton ghost… this computer doesn't have a floppy drive.. it is a laptop… just a few facts that you may or may not need. also mabey it was my fault.. mabey not.. but i think… some one should take a look at avast and see if that is still stable software to recommend… i am not mad at all you guys rock. just mabey a tip.. thanks!! this forum is the best ive been to =]

If it's Virut/Virtob, this machine is no longer salvageable. This is a vile infection. This infection has different versions and most of them are buggy. This means… it infects a file - but not properly done, so this results in the fact that Antivirus scanners cannot properly disinfect the files either > result > files are corrupted/or getting deleted instead. The best solution is a format and a reinstall here.

If it was a virut/virtob infection, it is something that you caught since your last cleanup because Kaspersky online Scanner which we ran the first time, at the end, to make sure your system was clean, usually will show the presence of the infection. Mind you, the outcome is often the same. Many malware fighters automatically call for a format and reinstall as soon as they have proof of the existence of this infection.

My question, is how could you get infected so severely, so rapidly. Hopefully you remember what type of sites you visited just before the symptoms appeared and not go there any more.

Do you require any assistance with the format procedure? It is pretty straight forward but if you are not sure, I'll find you some links to information that will guide you through the process.

Trevuren

yes i would like some assistance. thanks i don't know how i got so infected so fast. i think mabey that one file downloaded and then another and the files that already existed downloaded more.. i dont know. beacuse while we were workng on it i didnt use the laptop at all. i would do what you said then put it in stand by mode until the next post..so i dont know do you know how to get all the info back from the reformat? thanks! hope we can save alot of the stuff.

Also, if you want to backup important files before a format and reinstall, please note that you should not backup any exe or scr files, because they are infected.

With this in mind, I would permanently discard any "cracked" software and stay away from emails also, if possible. One of the biggest culprits are files obtained through P2P sharing. These are some of the biggest carriers. The data that you really have to keep can be copied to CD/DVD quite easily. Remember no programs, .exe files in general and no screensavers. If this computer is part of a network or/and if there is any file/printer sharing or any synchronization going on, immediately remove this computer from that environment and leave it out of the loop until all the other computers have been thoroughly cleaned. You want as little info backed up as possible. By proceeding this way, you minimize the chance of corrupting your new installation.


Before doing any of this, please read the following article about formatting and reinstalling and get back to me with anything of which you are not sure. If I do not have the answer, I'll find someone who does.


http://www.winsupersite.com/showcase/windowsxp_sg_clean.asp


Good Luck,

Trevuren

how am i going to back up things if i cant logon? also is there anyway i can get the logon files copied off that cd so i dont have to do the reformat/install.. that i am not looking forward too… but will do? also what about my license key.. since its and oem key it shouldn't be moveable? also what about my Microsoft word?

Will this work for you?

http://www.geekstogo.com/forum/Repair-Windows-XP-t138.html

If it does, then get in and then get out fast. Only copy the minimum.


Trevuren

ok.. this is loading as we speak.. but heres a question for you… if i can logon after its done and i can access system restore.. do you think that i could use windows system restore and not have to reinstall? thanks

I am not sure if it is possible to do and I am definitely not sure if you should. This virus/whatever may have been lurking for a long time with a timed trigger. I just don't know. Also, System Restore only captures part of your Registry. Your gamble but I would not recommend such action. Trevuren