Dodgy link clicked = XP wont fully boot

[nathan jay]

Hi

 

OS - XP (Sorry, I don't know version)

Acer Travelmate

 

My brother (seriously, it wasn't me) recieved a round robin email from a usually trusted source. He clicked on the link, which opened in Firefox, and immedieately began open many tiny grey pop-ups where the content was not visible.

 

He shut down his laptop, now when it's powered up there's the XP loading screen, then the standard blue background, and a mouse curser which reacts to the mousepad, but not the mouse buttons. Cntrl Alt Delete does not bring up Task Manager.

 

The laptop has to be reset by removing the battery.

 

Safe mode produces similar results, but with a black screen.

 

If someone has a system that can check malicious sites without actually opening them, the link is

 

DO NOT VISIT THIS LINK!

djtonyhouse.xpg.com.br/r8017BzgKI.html

DO NOT VISIT THIS LINK!

 

I have removed http:// from the begining of the URL.

 

 

 

Thank you for reading,

 

Nathan

[RandyL]

Mcafee flags this as JS/Redirector.k (Trojan)

[Starbuck]

Hi nathan

 

You don't actually say whether this is just a warning to others, or if you want this problem sorting out.

[nathan jay]

Sorry. A warning to others, but mainly I need help this sorting out please!

 

Thanks

[raju]

try this

 

start in safemode without networking (then restore to old date)

 

if it doesnt boot at all

try to boot from an old used norton antivirus cd

or

try to repair yor windows booting from cd with a windows cd .

or

you can start in dos mode (comand prompt and use a few commands to check the system .

or

the list is endless

the key is as soon as you can backup your data do it (and then reinstall the system from scratch)

raju

[raju]

i went there

 

i have been to the site and looked ok at first then a adobe document tried to open

the full report is below.

acers some times come withe system restore cd or in built

before the system loads press ctrl +shift+f10

see if you get the option for recovery usually symantic ghost

IF YOU DO IT WILL DELETE ALL YOUR EXISTING DATA AND REINSTALL SYSTEM AS NEW

 

 

raju

Edited March 13, 2010 by raju

[RandyL]

nathan are you able to get into Windows at all? Normally or via safemode?

[Starbuck]

Hi Nathan,

 

you able to get into Windows at all? Normally or via safemode?

Once we know this we'll know what course to take to help you.

Reinstalling the Operating System will be a last resort.

95% of these problems can be sorted using the tools at our disposal.

 

If you can get into the Windows OS, please try running this and post the reports.

 

• Download OTL to your desktop.
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/newOtl2.png

Now copy the lines in the codebox below.


netsvcs
msconfig
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

 

Thanks

[nathan jay]

Thanks for all your help(s). Nothing worked, so I managed to get hold of an XP disk, reinstalled it on a seperate partition, and now can access the files from the original c:/ My Docs etc.

 

Thanks again

[Starbuck]

Hi nathan

 

Thanks for letting us know. http://fc07.deviantart.com/images3/i/2004/146/9/1/Two_thumbs_up.gif