Windows Wont Start -Desperate

[eurojen]

Hi

I am trying to clean a friends pc that was infected with over 3000 virus/malware/spyware. Resolved most of the infections using several different AV scans, spybot etc. The systems is running Win XP Home SP2

I was left with infections relating to braviax.exe and cru629.dat. Avira AV was installed on the pc and it would block these infections but when the pc was restarted the infections would return. These infections would also disable HJT and spybot. I managed to get both working by renaming the executable files.

HJT was not able to fix the entries for the infections.

I tried using combofix, but is completed disabled and renaming did not allow it to run.

As a desperate measure I tried to run avenger.

I typed the following into the "Input Scripts Manually" box
Files to delete:
C:\WINDOWS\SYSTEM32\crypts.dll
c:\windows\system32\msvcrtd.exe
c:\windows\system32\cru629.dat
C:\WINDOWS\system32\braviax.exe

Drivers to unload:
msupdate

The PC shut down - and when restarted the black command box appears and nothing else appears on the desktop. The Pc will not event start in safe mode.

The following files are in the root directory:
quvuaxmo.bat
reboot.bat
reboot.exe
start_.cmd
zip.exe


Any help would be gratefully appreciated.



The following is the avenger.txt report file.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\yumxtbaw

*******************

Script file located at: \??\C:\WINDOWS\system32\txcyeelm.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\SYSTEM32\crypts.dll not found!
Deletion of file C:\WINDOWS\SYSTEM32\crypts.dll failed!

Could not process line:
C:\WINDOWS\SYSTEM32\crypts.dll
Status: 0xc0000034



File c:\windows\system32\msvcrtd.exe not found!
Deletion of file c:\windows\system32\msvcrtd.exe failed!

Could not process line:
c:\windows\system32\msvcrtd.exe
Status: 0xc0000034

File c:\windows\system32\cru629.dat deleted successfully.
File C:\WINDOWS\system32\braviax.exe deleted successfully.


Registry key \Registry\Machine\System\CurrentControlSet\Services\msupdate not found!
Unload of driver msupdate failed!

Could not process line:
msupdate
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

 

[kimsland]

## Desperate## - isn't everyone here?

3000 virus/malware/spyware

I have repaired these problems myself (large volume of errors/spyware/virus)
But in the end, 4 hours later. I've thought Hmm:
backup ~1Hour
Clean Install ~30 mins
Drivers ~30mins

I wonder if you have thought this too?

I'll tell you what the problem is:
After everything is perfectly clean by going Here or Here I've usually found that Windows itself, requires Repairing (due to missing files)
And some programs (ie AntiVirus; Nero; Office...) Don't work!
Or registry files are missing
And, some of these problems don't show up, for a week or so, until your friend users them.

I think to stop all this worry, bite the bullet, backup and re-install CLEAN
Everyone's happy!

You should be aware too, that most of the user online accounts have probably been compromized too. Another reason for clean install (otherwise it's your fault, months from now, when his bank account is attacked, or he gets stacks of spam)

I wonder who he will say is at fault! How do YOU feel about this ?

 

[DelJo63]

>>I think to stop all this worry, bite the bullet, backup and re-install CLEAN

too late for this. it only creates the possibility of reinfection.

the options are
a) fight your way thru each isssue one at a time or
b) wipe the disk and reinstall

 

[eurojen]

Thank you both for your replies. Sorry for the late reply - Have been hit with the Flu.

I think on reflection that safest bet is a re install. The problem is that I have "No CDs". This is an old Dell Desktop that was given to my friend but the XP CDs etc are nowhere to be found.

I have a windows XP home Cd for my own machine. The Dell machine does have a XP Product Key sticker. I assume I can use my Cd with the Product Key on the sticker?

Also - If I boot up from the CD Do I do a "Repair" Install ? Any advice on the re-install will be gratefully accepted.

I assume I can locate the relevant drivers from scanners, printers etc somewhere on the Dell website.


Thanks

Jen

 

[kimsland]

It might not work

Your Home disc needs to be the same version that is installed (not all Homes are the same)
You could do a search on that computer's model for a restore image, or buy one through Dell.

Also no not Repair, format and re-install clean