Followed 8-step Virus/Spyware/Malware Prel. Remov. Instr. to remove win32/PEPatch.ao

[Megaboetie]

Hi guys,
Followed the above instructions to get of an obnoxious Troyan Horse. Thank you very much for explaining how to proceed. Looks like it worked. I attach the logs for you to have a look and confirm my PC is healthy again !
Cheers,
Erwin (Belgium)

 

[Bobbye]

Welcome to TechSpot, Megaboetie. I'll try to help with your problems- actually I have made 3 replies and they seem to be off in cyberspace somewhere instead of here! Hopefully this will go through

Can you please give some some history on win32/PEPatch.ao. How did you know you had it? What did you do to get rid of it?

You can help prevent the Tracking Cookies seen in the SAS log:
Reset Cookies

For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> CHECK 'override automatic Cookie handling'> CHECK 'accept first party Cookies'> CHECK 'Block third party Cookies'> CHECK 'allow per session Cookies'> Apply> OK.

For Firefox: Tools> Options> Privacy> Cookies> CHECK ‘accept Cookies from Sites’> UNCHECK 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others.

I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
AdBlock Plus
Easy List

For Chrome: Tools> Options> Under The Hood> Privacy Section> CHECK 'Restrict how third party Cookies can be used'> Close.
(First-party and third-party cookies can be set by the website you're visiting and websites that have items embedded in the website you're visiting. But when you next visit the website, only first-party cookie information is sent to the website. Third-party cookie information isn't sent back to the websites that originally set the third-party cookies.)

When we have finished the cleaning, I'll give you the name of a program that will do a good job on that.

MBM shows a considerable amount of malware found. Let's follow up on that:
Please download ComboFix HERE:

• With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
  
• Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection.
  
• Run Combo-Fix.exe and follow the prompts.
  (Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.)
• Wait for the scan to be completed.
• If it requires a reboot, please do it.

• After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)

Notes:

• 
  1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
  3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
  4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please update and do a full system scan with AVG. Save the log and attach it in next reply.

Rescan with HJT, then PASTE the log (Ctrl V) into the next reply.

So it's attach Combofix report and Norton scan. Paste the HJT log.

 

[Megaboetie]

My PC not working anymore after installing and running ComboFix

Hi Bobbye,
Thanks for your help but I'm afraid I ran into serious trouble whilst doing the various things you suggested me to do. At this point, at reboot, my PC does not go beyond the Windows XP-logo and is obviously OUT OF ORDER. For a fraction of a second a blue screen appears (too short for me to read what it says) and then the PC reboots again and again and again... I cannot see what I've done wrong. I followed your instructions scrupulously...
PLEASE HELP !:dead:

P.S. It's only because I have a seperate PC that I am able to write this message

 

[Megaboetie]

My PC not working anymore after installing and running ComboFix

I now realise that I haven't renamed the ComboFix.exe into Combo-Fix.exe. Could this be the cause of the problem ???
Cheers
Erwin

 

[Tmagic650]

Yes Megaboetie,
rename combofix and retry... Good luck

 

[Megaboetie]

OK, Tmagic650, but my PC does not go beyond the Windows XP-logo, i.e. I cannot reach the PC's desktop nor its C or D-drive. I'm unable to rename the exe at this stage !!
Thanks for getting back to me if anyone can help out...
Erwin,
Belgium

 

[Tmagic650]

So the computer problems have gotten worse? You might be left with the only option to format and reinstall windows fresh

 

[Bobbye]

Here is my suggestion if you would like to continue with my help:

Have you tried booting into Safe Mode?
Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

If a symptom does not reappear when you start in safe mode, you can eliminate the default settings and minimum device drivers as possible causes. If a newly added device or a changed driver is causing problems, you can use safe mode to remove the device or reverse the change.

Using Safe Mode to determine a basic source of a problem:The choices:

• Safe Mode: Loads the minimum set of device drivers (serial or PS/2 mouse devices, standard keyboards, hard disks, CD-ROM drives, and standard VGA devices)and system services required to start Windows XP/2000/2003.(Event Log, Plug and Play, remote procedure calls (RPCs), and Logical Disk Manager.) User specific startup programs do not run. This is helpful in determining whether problems are due to specific programs.
  
• Safe Mode with Networking: Includes the services and drivers needed for network connectivity. Safe mode with networking enables logging on to the network, logon scripts, security, and Group Policy settings. Nonessential services and startup programs not related to networking do not run. Helpful if needed but should be used with caution as the security programs don't load in this mode.
  
• Safe Mode with Command Prompt: Starts the computer in safe mode, but displays the command prompt rather than the Windows GUI interface.
  
• Last Known Good Configuration, which starts your computer using the registry information that was saved at the last shutdown.

So by using the different options of Safe Mode, you can sometimes determine what the area of problem is- and isn't.

Let me know if you can do the above. Do NOT USE "Last Known Good Configuration" at this point. I need to know if you can even get into Safe Mode. If you can, I'll tell you where to look for the cause of the BSOD.

 

[Megaboetie]

Hello Bobbye,
Tried starting the PC in Safe Mode. Unfortunately, I don't even get to see a Windows XP logo before the PC hangs up.
Also please note that the Recovery Console gives me the following "A disk read error occurred - Press Ctrl+Alt+del to restart". Obviously installing that didn't work out either.
Finally, I should add that this PC is actually a miniPC (so no CD/DVD drive) with pre-installed XP. If I am to reinstall XP, how am I going to do that ? Also, I would like to avoid losing data which are on drive D.
Thanks for any help you can give me.

 

[Bobbye]

Here's how to do that: http://www.liliputing.com/2008/04/install-windows-xp-on-mini-note-usb.html

 

[Megaboetie]

Well, I have resigned myself to re-install XP onto my non-working miniPC. This link is of course helpful, looks like a straightforward way to go...except for one little thing. #5 of the "Installing XP on the Mini-Note"-section says you should delete all of the partitions on the hard drive. This is something I cannot do since there is essential data on the D-drive ! So I didn't erase the D-partition and, like the author foresaw, I ran into problems with a Hal.dll missing error. I understand this is because I didn't erase all partitions on my hard disk. My question is therefore: is there a way to install XP WITHOUT erasing the D-drive ? If not, how can I salvage the data from the D-drive prior to rebooting it ?
As always, I appreciate any help !
Erwin

 

[Bobbye]

Erwin, I can't answer this. It might be helpful for you to report it in the Hardware forum.