Win32/Heur problem

[Ledah]

userinit.exe seems to be no longer infected

 

[mflynn]

Do the below as we need to replace them also.

Left Drag mouse and Copy for Pasting all text in the box below.
Make sure the slider bar goes to bottom from the @ to the end of the second exit.

Then paste to the black screen of an open command prompt.

@echo off
cd\
dir /s explorer.exe >"%USERPROFILE%"\Desktop\xplor.txt
dir /s spoolsv.exe >>"%USERPROFILE%"\Desktop\xplor.txt
exit
exit
exit

Now post the xplor.txt from the new icon on the desktop back to the thread.

Mike

 

[Ledah]

I attached the file

 

[mflynn]

Ledah run combofix again no script.

Post log.

mike

 

[Ledah]

It's attached

 

[mflynn]

Ledah

I need to call it a night. My mind is foggy don't want to make a mistake.

I will be on in morning!

Good night,
Mike

 

[Ledah]

Sure thing

 

[mflynn]

Good morning Ledah

OK I hope you have your windows XP CD needed for the below.

Put it in the drive.

Start-Run
type
sfc /purgecache
Then click OK

next

Same as above but type
sfc /scannow

This may take a few minutes as tries to find and replace bad Windows files from the CD!

Reboot when finished and post another ComboFix log so I can view the results.

Bear with me we are close as you had some real bad boys. We get past this we should be OK!

Mike

 

[Ledah]

When I type sfc /purgecache a window comes up saying that sfc cannot be found.

The computer is Media Centre Edition, I have no idea why the combofix log says its Professional

 

[mflynn]

OK Ledah to much has been damaged by the Malware so to fix it we will do a repair install of windows.

A repair install fixes Windows files like missing or corrupted like we have here but does not effect the other things on the HD like documents email etc. That will still be there and work as normal.

The steps to do this is.

1. Boot from the windows CD
2. chose to install windows
3. Setup will offer (R) to Repair using Recovery Console (we decline this) and continue.
4. Setup will find an existing Windows Installation and offer to (R) Repair it and we do chose this R.

Some links to illustrate.
http://www.tweakxp.com/article36955.aspx
http://www.simplyguides.net/guides/repair_installation_xp/repair_installation_xp.shtml

Mike

 

[Ledah]

The computer never came with any Windows XP CDs, the Window XP CDs I have I got from someone else. I tried them but they don't have the right OS.

The only CDs for the computer are the ones that were created by the recovery program when the computer was first used. They only have the recovery console option and format.

 

[mflynn]

OK do not restore but look at the System restore and see what dates you have to restore if any.

Mike

 

[Ledah]

There are none because it was turned off since the virus got there too.

 

[mflynn]

Ok browse the xp cd that you have and see if there is a i386 folder on it.

Mike

 

[Ledah]

Yes it has the i386 folder

 

[mflynn]

Had to go eat.

Ledah do you feel comfortable with regedit?

Do this: http://www.petri.co.il/change_default_location_of_the_i386_folder.htm

If you can do this do it and let me know.

Mike

 

[Ledah]

I'm very sorry, I feel really bad about it but I decided to format the computer.

It's not my computer it's my brothers and he's getting really fed up with me trying to fix it.

I will run the 8 steps again once it's done.

 

[mflynn]

If you format no need to do the 8 Steps it will be clean!

I understand wish we could have whipped it.

Good luck,
Mike

 

[Ledah]

Thank you for all your help. This is a great forum also I will be using Avira from now on.