cant connect to the interent after XP Malware removal

[Yockie]

Oh, this is misundertsnding...the Combofix has done his job for 5 min, and I am not sure it was happy,that I cant go on the interent, its asked me to do so, but as I cant- I clicked OK and its just restarted the computer. Since than I am looking for the file log , and its almost 3 h the search is looking for the file log, not Combofix scaning.This is why I think this doesnt work.

 

May be I didnt explain properly, sorry.

[Starbuck]

Ok, if CF has finished, it should have put the report on your screen.

If it didn't, you should find a copy at:

C:\ComboFix.txt

[Yockie]

Ok, CF restarted the computer, didnt put report on my screen and I am searching for this report since around 3.10h. And am trying to explain that I think that it goes round and round the same files and doesnt really planing to find anything, besides I dont think that such report exists, because CF wanted me to connect to the internet, but I coudnt and it just restarted the computer, nothing more.

 

And Im thinking here- how long should I wat for the search on this faulty computer to find a report that is not there , because it doesnt exists? In the meantime, it keep searching and I made 2 pic for you to see.

[Starbuck]

What i meant was, that instead of doing a search for the file.....

just take a look at the 'C' drive contents and see if the file is there.

if not.... 'Plan 'C' :p

[Yockie]

Aaaah, but you are fond of the idea of plan "C, be honest...its just that you are looking for a nice way to tell me, eh?

 

There is no such file in drive C, the last one by date is 26.04.2010.

Can I stop the search now? Its just wasting electrisity really, and hurting the enviroment...or may be just my nerves...

 

So, whats next?

[Starbuck]

but you are fond of the idea of plan "C, be honest...its just that you are looking for a nice way to tell me, eh?

Nooo, i just like the idea of a challenge ;)

 

Can I stop the search now?

Yep, no need looking for an invisible file. :D

 

Step 1

Plan 'c':

 

Download this program and then transfer it to the bad system:

 

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

 

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

 

Reboot your computer into SAFE MODE using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". Use the ENTER key to make your selection.

Then choose your normal account.

 

Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
  
• Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the "Scan tab" and UNcheck "Heuristic analysis"
  
• Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
  
• Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
  
• When done, a message will be displayed at the bottom advising if any viruses were found.
  
• Click "Yes to all" if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
  (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  
• Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  
• Save the DrWeb.csv report to your desktop.
  
• Exit Dr.Web Cureit when done.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

 

Note:

Some sites don't allow .csv files to be posted.

If this is the case here, the report may need to be renamed to Dr.Web.txt in order to post it on the forum.

 

During the scan, a pop-up window may open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.

 

Step 2

Let me have a fresh OTL report so that i can see if the files where removed or not.

start OTL ..... just click the scan button.

It'll probably only produce the main.txt .... that's all i need.

 

In your next reply, please submit:

Dr Web scan report

New OTL main.txt

 

 

Thanks.

[Yockie]

Now , here is a problem,when I restart the computer its always gives me few screens, which say different things, but I have to click few times enter in order to go to start Windows. I never can open Safe mode on this computer. I will try to make few pictures to show you. Is it posible to run this iprogram in normal, not safe mode?

 

variation 1:

I have to click enter few times, and when the times come to choose Windows- too, although there is not Windows 2000, only XP,and when I click enter it starts:

[Yockie]

However, if I choose safe mode, clicking as crasy F8, thats what happenes

variation 2: first 5 pic

[Yockie]

and the next 3, as the first 2 of them I just made in order to be clearer, but they are the same as the last one from the previous post, and after staying with these 2-3 min, the screen becomes black and thats that. No safe mode.

 

Is my hard work pays off at least a bit and does my pictures make all clearer for you?

[Starbuck]

those look like typical safe mode screens.

It does load like that.

Are you in safe mode now?

[Yockie]

No, Im not in safe mode, as it goes black, like shown on the pictures.I can be either or normal mode or black screen.Not from the virus, its always been like that, I never been in a safe mode with this computer, like I told you a century ago- apperantly Im the administrator, but I dont know what does it mean anyway for my powers over that computer, ...sorry that Im not more educated about these things... Edited May 3, 2010 by Yockie

[Starbuck]

Ok, i see what you mean now about the black screen.

 

Btw: Dr Web won't run properly in normal mode.

[Starbuck]

Ok, go back in to normal mode and let me have the fresh OTL report.

 

Thanks.

[Yockie]

Ok, Im use to this now, :)

Finaly I can say- ok, here it is!

[Starbuck]

Hi Yockie,

 

we'll have to stop meeting like this.... people will talk. http://fc06.deviantart.com/fs4/i/2004/250/7/1/ROFL_by_b4sti.gif

 

Ok, good news and bad news.

The good news.... the scan report is a lot smaller now and the date is correct.

The bad news...... the fix didn't run successfully before.

 

Let's go for this again:

 

Double click on OTL.exe to run it.

Copy the lines in the codebox below. (make sure that :Otl is on the first line )

:Otl
PRC - C:\Program Files\securus\SecurusClient\securusn.exe ()
MOD - C:\Program Files\securus\SecurusClient\support.dll ()
SRV - (AntiVirService) --  File not found
SRV - (AntiVirSchedulerService) --  File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
O4 - HKLM..\Run: [avgnt] H:\Personal Data\Avira\AntiVir Desktop\avgnt.exe File not found
O4 - HKLM..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe File not found
O4 - HKLM..\Run: [securus Network Client] C:\Program Files\securus\SecurusClient\securusn.exe ()
O4 - HKLM..\Run: [uSBScan.exe] H:\Personal Data\USBScan\USBScan.exe File not found
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38173.1592361111 (Reg Error: Key error.)
O33 - MountPoints2\{d1473aa9-1fd4-11dc-9ead-4d6564696130}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found
[2010/04/03 13:43:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.GMS-3IBDCJ3IZYP\Application Data\Avira
[2009/12/17 20:43:34 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2009/12/17 20:43:33 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2009/12/17 20:43:33 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2009/12/17 20:43:33 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2009/12/17 20:43:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2009/12/17 20:42:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
[2009/12/03 13:56:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\McAfee
[2008/04/16 17:08:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared

:Files
C:\Program Files\securus

:commands
[emptytemp]
[purity]
[EMPTYFLASH]

• Return to OTL,
  
• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
   
  
• Click the red Run Fix button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runfixbutton.png
   
  
• OTL will reboot your system once the fix has completed.
  
• After the reboot, you may need to double click OTL to launch the program and retrieve the log.

 

Copy and paste the contents of the OTL log that comes up after the fix in your next reply.

 

if you lose the report, there will be a copy here:

C:\Program Files\_OTL\MovedFiles (based on your header)

[Yockie]

May day, May day!

All turns blue, just blank screen, after I click run fix !

Should I at least restart?

[Yockie]

Ok, I did restart after 25 min waiting with blue screen, all seems good, but the fix obviously didnt work.

[Yockie]

May be its time to call it a day today. Thank you for the patience and the advices, I highly appreciate the time you spent on my problem and thank you very much for not becoming frustrated with my modest knowledge of computers. This is rare.

You are definitely a Star for a Million Buck-s.

{I dont care what people talk, let them :) We cant stop them if they want, we cant make them if they dont, so why pay attention to that then....}

[Starbuck]

There is definitely some underlying issues on the system.

Without getting the fix to run or any of the other scans, we're going to be struggling.

It's a pity you don't have the Operating disc ... this would have made life a lot easier.

A repair install may have sorted out the problems without losing any of the data stored on the system.

I'd suggest starting to backup any data you require from the system and then possibly acquiring an operating disc and reformatting the whole disc.

At least this way you will have a nice clean start.

Sorry i couldn't have been of more help.

[Yockie]

With you I have done more for 3 days than I would've do without you for 3 months. I know people with less of a problems who paid for a help and the result was zero. Coming here and meeting you saved me so much time, I cant even measure it. At least now I know for sure that the only way to repair it is to reinstall Windows. I dont have disk,so have to sort something out.

 

You have been of great help and I own you big time.

 

If there is something I can help with - just ask ( not about computers, though, I doubt I can help you there...)

[RandyL]

Yockie regardless of what happens we thank you for your kind words about us.

 

You said you have no disks to reinstall Windows but if you can tell us your make, model and number there may be options. Just a thought.

 

As far as helping us you might be surprised. Come back and look around. You never know when you might be able to help someone else.

 

I'll let you continue now while I do other things.

[Starbuck]

Hi Yockie,

 

Like RandyL says, thank you for those kind words.

Helping you wasn't a problem at all, sometimes comments like yours makes this job worthwhile.

Thank you again.

 

You said you have no disks to reinstall Windows but if you can tell us your make, model and number there may be options.

What RandyL is getting at ( i think) is that some manufacturers don't actually supply installation discs .... they put a copy of the OS on to a hidden partition on the computer.

You then reinstall from this OS image.

So giving the information as asked for, may be beneficial to you.

[Yockie]

RandyL, thank you for the invitation and the trust that I can help someone on here...sure, if all of you go on a vacation together at the same time- I will step up! Imagine the result …On the more serious side – it’s the effort and the time that Starbuck invested in my rubbish old machine, that counts for me. And about the result- I count it as a success, because I do know now what I have to do. Either plan C ( Starbuck ;) ) , either reinstall Windows. The result is very positive, saved me a lot of time and nerves and introduced me to a Star(buck). Good job to keep up this site,well done. Im more of a suggestion-in-a-newspaper-colum-about-everything-kind of person, but sure, I will stay, if you have hysterical and crying from computer problems people, who just need to cry on someone's shoulder. There, there...

 

Starbuck, to be completely honest – I was offered in Sunday additional disk with Windows XP home edition, copy from my new computer for the price of 30 additional pounds, but I didn’t take this opportunity:nono:. Because Im a good honest person,always doing the right things, aint I and I didnt want to use the same Windows 2-s, ah...c'est la vie. I dont understand what RandyL is asking as model and number, but I dont think there is hidden OS on my computer. But you know me - you never know what I have and what I dont, eh...my son is better in this, if you have any suggestions- he will read and follow. If you come up with something new, that is.

 

Much easier, can you just send me your magic hat ( I would've say stick, but you will start worring again that people will start talking), to do the trick, quickly repair the old boy on the desk here and ... I promise I will send it back.:D