Usually when an infection hits my computer, I can easily fix it using Ad-Aware, Anti-Malwarebytes and Registry Mechanic to fix up the possible damage. But now, it's something totally different to where they've denied me access to Anti-Malwarebytes by making it inoperable. Whenever I try to run the program, an error always comes up. I've reinstalled it and the same thing and I've also tried renaming it. Apparently, they've gotten smarter. When I restarted the computer, the usual log in menu didn't appear, only error messages saying something like LogonUI error, "Click OK to terminate and cancel to debug." I was just searching guitar tabs and out of no where I got infected and here I am trying to fix up as much as I can. Ran registry mechanic and it fixed about 20 high priority registries. When trying to save a log file from Hijackthis, it always comes up with a notepad error. I can't run it. I can't do a system restore, can't open up Add/Remove programs or anything. This really stumped me and I know you guys can help fix this.
All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.
There's some nasty stuff going around, it sounds like you have a Rootkit infection that is preventing you from doing any cleaning of this system. We can try a few things to remove it .
Run this program first in Normal windows, if it gives you issues than try it in Safemode. If this infection prevents its download, you will have to go to a known clean computer to download it and then burn it to a CD, do not use a thumb or flashdrive because at this point I don't know what you have and some of these infections can be easily transferred from one pc to another.
To Enter Safemode
Go to Start> Shut off your Computer> Restart
As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
Use the Up and Down Arrow Keys to scroll up to Safemode
Well, tried to run xxxxxxxxxbut a lot of Send Error Report messages came up such as errors with "SteelWerx Command Line Registry Editor", "Find String (grep) Uitlity" and "hidec.exe". Another message came up saying that the Operating System is incompatible and Combofix will only work for Windows 2000 or XP. This is in Safe Mode too and I am 100% positive I am running Windows XP because I've used combofix in the past.
Notepad doesn't work, an error report comes up everytime I try to run it. I'm using another computer for internet access also, so I'm currently transferring items through a CD-RW.
You have some major issues on this system, don't know if malware or a virus caused this or if system files have been corrupted. Do you have your windows CD or the CD that came with this system like the Recovery CD or the ReInstallation CD?
Depending on how your manufacturer set up your system, you may or may not need the Windows XP CD. If you have a I386 folder on your C:\ drive you may not need the disk.
Click Start>Run
Type in sfc /scannow, hit Enter.
Note: there is a space between sfc and /scannow
This should replace any corrupted/missing system files and will hopefully fix things.
Can you do an online Virus scanner?
Please run this free online virus scanner from ESET
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic
This is another program that should work.
* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
If so, click it and then click the next icon right below and select Move incurable as you'll see in next image: [external image: Posted Image]
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
Gah, an Send Error message came up after I agreed to scan. In the processes a lot of cmd.exe and services.exe processes were visable. I can't connect to the internet even through a direct connection and I don't have the Recovery CD or the 1386 folder.
My thoughts are that this system is in bad shape both malware and windows wise. None of the tools we use can run, be it a virus stopping them or just a badly corrupted system. We can try this tool to check for Rootkit activity, if it won't run than I think the only recourse is to contact the manufacturer of your system and have them send you a recovery CD and do a system repair.
Download Blacklight Rootkit Detection and Elimination Tool to your desktop
Click on fsbl.exe to run it and follow the prompts, post the log please
Registry Mechanic <—This is a legit program but let me tell you about registry cleaners. Remove the wrong entries ( and even the legit programs sometimes do ) and you can damage your system, remove bad and not needed entries and you will see no difference in System Performance. You should stay away from reg cleaners, there not recommended. I am wondering if in the course of using this program if you have caused some damage to your system. The only option I see here is to contact the manufacturer of your system and have them send you the re installation cd so you can either re install windows or do a system repair.
You can transfer all your documents and pictures and such to a CD or External drive, you may need the disks or the downloaded setup files for your programs. Norton Ghost among some other programs gives you the option to back up your entire drive, but your drive sounds like its in bad shape so you would not benefit from that.
Here are some windows support forums that may be able to help you as we just do malware removal on this one.
