This laptop was booting to a black screen previously so i reinstalled windows xp home (instead of pro which is what it had originally) but then i found a XP pro upgrade disk so its all good now. have SP3

So i got all the drivers on and such eventually and it's been good.

But then i started noticing that when clicking on certain google search results i get redirected to other weird search engines, i just deleted something in malwarebytes and system restore and disk deframgmenter just started working, and when i go to my computer (i have a laptop and a partition) and double click either of the drives it says C:\resycled\boot.com is not a valid Win32 application. (that error started coming up just after i did my malwarebytes scan and rebooted)

i have no idea what's going on, please help!

Attached Files

	mbam-log-2009-01-02 (19-42-38).txt (3.5 KB, 5 views)
	hijackthis.log (7.2 KB, 4 views)
	SUPERAntiSpyware Scan Log - 01-02-2009 - 22-01-24.log (465 Bytes, 2 views)

Run the Norton Removal tool

Run Startup Control Panel and remove any not required startups: (should be most!)

Install Avira

Start up Malwarebytes again; Update it; then run a full scan (remove all found Malwares)
By the way, you forgot to remove found Malwares, on your old scan, make sure you check the log, and remove all found malwares
You need to run this multiple times, until all hidden Malwares are uncovered and removed

There you go
Oh I may not reply specifically here again; just do the above

Thanks for the post! I did exactly that, except now when I double-click either of my partitions it says "Windows cannot find 'resycled\boot.com'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search."
i ran malwarebytes a couple more times, restarting in between n it was clean after the first time. but the first time i ran it and deleted and rebooted, it told me there were files it could not delete... ill provide the log from the first malwarebytes scan, and a new hijackthis log.

Attached Files

	hijackthis2.log (5.0 KB, 0 views)
	mbam-log-2009-01-03 (13-35-24).txt (1.3 KB, 2 views)

No you didn't


-> No action taken on MBAM scan, for found issues
Please re-run Malwarebytes
Confirm updated (third tab)
Then do the above quoted message, but this time "Remove all found issues"

i ran mbam again and it came up with no results.... ill give you a new hijack this log, and i guess the empty mbam log.... still have the same hard drive access problem though...

Attached Files

	mbam-log-2009-01-03 (16-39-28).txt (844 Bytes, 2 views)
	hijackthis3.log (5.4 KB, 1 views)

Uninstall: SUPERAntiSpyware
Uninstall Viewpoint (Removal Tool: http://prm753.bchea.org/viewpointkiller.zip)

Clear & Reset System Restore's Cache

Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 and then press Enter
* Tick on the checkbox - Turn off System Restore on all drives
* Click Apply
Turn it back 'On' by unticking the same checkbox & click Apply, and then OK

Run another CCleaner

Restart

How does it now seem to be running?

Thanks again for posting

okay i did as you said, and im decently sure that the redirecting problem is gone, although i cant tell you for sure because it was random.

as for the problem with the "Windows cannot find 'resycled\boot.com'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search." notification coming up when i double click on either one of my hdd partitions.... its still there

ill provide another hijackthis log i guess.

Attached Files

hijackthis.log (4.9 KB, 2 views)

Oh sorry about that, I missed that important fault removal

Please right click on one of your Partitions (in My Computer) and select "Open"
Locate a small file such as "autorun.inf" (please note this file may also be normally hidden, meaning you may need to view "Hidden and System files" in Folder Options)

Anyway, delete that file; and then do the same for the other partition
Test it worked by re double clicking to open the partition

=\... it didnt work. When i clicked open, it said access denied, so i clicked explore and found autorun.inf and deleted it, and i did the same to the other partition but when i re-doubleclicked it still gave me the same error message

Just to confirm
You deleted the "Autorun.inf" from the root of the Partition? (ie assuming one of your partitions is F drive, the "Autorun.inf" would be located at F:\autorun.inf )

indeed, i did exactly that to both C:\ and D:\... but it still doesn't work and i get that notification.

okay nevermind, i messed around with it n got help elsewhere and now opening my hard drive is functional again! thanks so much for your help

all the best

You didn't want to say what they did?

So since being here, we helped you:
Remove the horrible Norton
Install Avira Antivirus
Removed miscellaneous startups
Removed Malwares through Malwarebytes
Removed Spywares running SuperAntiSpyware
Cleared out all temp files with CCleaner
Uninstall: SUPERAntiSpyware
Uninstall Viewpoint
Clear your System Restore entries
Removed "Autorun.inf"

And then you "got help elsewhere" And you didn't say what? (maybe restarting?)

Sorry we couldn't help you !

Oh, sorry

Well, I just ended up putting autorun.inf back into both root directories. Then i downloaded this program called tweak UI, and I turned off autoplay on both partitions.

Then i restarted and booted to safe mode with cmd and tried to delete autorun.inf from both drives but when i typed in the command it said "autorun.inf was not found" so restarted and booted normally again and the drives started opening upon double clicking, even after i enabled autoplay again.

That's about it!

Thanks for your help once again! i really appreciate it.