Help!

Stuck At Desktop.

 
  

Goto page Previous  1, 2
Post new topic   General Reply to Topic (not reply to a specific post)    Forums Home -> HijackThis Logs RSS
Next:  If you thought your day was bad.............  
Author Message
ferasb



Joined: Feb 22, 2009
Posts: 20



PostPosted: Wed May 13, 2009 8:56 pm    Post subject:

Hi,

Notepad was one of the files that was affected by the virus and the exe file no longer loads because of an antivirus that I guess completely wiped the program off my PC. How do I replace it to run combofix?
Back to top
greyknight17



Joined: Feb 03, 2003
Posts: 5674

Location: Brooklyn, NY

PostPosted: Thu May 14, 2009 12:10 pm    Post subject:

How about if you rename Notepad.exe to Notepad.com? Notepad should be located in C:\Windows\.

If that still doesn't work, try the below:

Download the OTMoveIt3 by OldTimer.

  • Before you save it, rename it to OTMoveIt3.com instead. Then save it to your desktop.
  • Please double-click OTMoveIt3.com to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    Code:
    :Processes
    explorer
    :Services
    protect
    spider
    spidernt
    msncache
    :Reg
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "reader_s"=-
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "reader_s"=-
    :Files
    C:\38.tmp
    C:\39.tmp
    C:\3A.tmp
    C:\3B.tmp
    C:\3C.tmp
    C:\3D.tmp
    C:\3E.tmp
    C:\3F.tmp
    C:\40.tmp
    C:\41.tmp
    C:\42.tmp
    C:\43.tmp
    C:\44.tmp
    c:\documents and settings\Owner\reader_s.exe
    C:\ocqkmoc.exe
    c:\windows\system32\2B.tmp
    c:\windows\system32\2E.tmp
    c:\windows\system32\3.tmp
    c:\windows\system32\4.tmp
    c:\windows\system32\5.tmp
    c:\windows\system32\7.tmp
    c:\windows\system32\7.tmp
    c:\windows\system32\8.tmp
    c:\windows\system32\drivers\protect.sys
    c:\windows\system32\DRWEBSP.DLL
    c:\windows\System32\reader_s.exe
    c:\windows\system32\yezumoyu.exe
    c:\progra~1\DrWeb
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]
  • Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

  • Click the red MoveIt! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Back to top
AIM Address Yahoo Messenger
ferasb



Joined: Feb 22, 2009
Posts: 20



PostPosted: Thu May 14, 2009 1:29 pm    Post subject:

Unfortunately, that didn't help. Also, after running the program, I no longer have access to the internet. It says that I have "limited or no connectivity".
Back to top
greyknight17



Joined: Feb 03, 2003
Posts: 5674

Location: Brooklyn, NY

PostPosted: Fri May 15, 2009 11:40 am    Post subject:

I thought the internet was having problems earlier already when you posted it as being down?

The fix should not have touched the internet settings. Post the log file here from another computer if you can.

We are usually successful in most of the virus/malware removal. But in some cases, it may be too heavily infected and a format and reinstall of Windows is recommended. You may want to do this now...backup your data first before proceeding.
Back to top
AIM Address Yahoo Messenger
ferasb



Joined: Feb 22, 2009
Posts: 20



PostPosted: Fri May 15, 2009 1:59 pm    Post subject:

Hi. The internet did end up coming back before, but now it hasn't come back since I ran the last fix.

Now, as far as reformatting my computer, I have a Compaq presario and it didn't come with any backup CDs or anything so I have to press F10 when it is loading to do the process, but I am getting this message: STOP: c000021a {Fatal System Error} The Windows Logon Process system terminated unexpectedly with a status of 0xc0000034 (0x00000000 0x00000000). The system has shut down.

I appreciate everything you have done to help me and I am hoping you can help me reformat my computer as I have never done this. Thanks so much.
Back to top
greyknight17



Joined: Feb 03, 2003
Posts: 5674

Location: Brooklyn, NY

PostPosted: Sat May 16, 2009 11:11 am    Post subject:

That's not good. It looks like the recovery partition might be corrupted if you can't restore it using F10. This computer didn't come with any restore CDs? If not, see if you can obtain them at the HP website.
Back to top
AIM Address Yahoo Messenger
ferasb



Joined: Feb 22, 2009
Posts: 20



PostPosted: Sat May 16, 2009 12:12 pm    Post subject:

I did search this and they aren't offering the recovery disks anymore for it. Will it work with any old XP CD? I have a friend that has XP for a different brand of PC, will that work to set it up? I don't know how else to reformat it because no disks seem available. I might just end up taking it in for someone to do it for me.
Back to top
greyknight17



Joined: Feb 03, 2003
Posts: 5674

Location: Brooklyn, NY

PostPosted: Fri May 22, 2009 10:03 pm    Post subject:

If it's branded for another computer, it will most likely not work. Even if it will, the product key used may be a problem since some CDs will only work with their own PCs.

You might have to bite the bullet and take this one in then. If anything, try getting another XP CD for it also just in case this problem arises again.
Back to top
AIM Address Yahoo Messenger
Display posts from previous:   
Post new topic   General Reply to Topic (not reply to a specific post)    Forums Home -> HijackThis Logs All times are: Eastern Time (US & Canada) (change)
Goto page Previous  1, 2
Page 2 of 2

 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum