Solved Google redirect.

[Broni]

OK, this is not working....

We need to use the Recovery Console to fix your issue.

• You'll need to find your Windows XP installation disk.
• Insert the Windows XP CD into the CD-ROM drive, then restart your computer.
• If prompted, click any options that are required to start the computer from the CD-ROM drive.
• When the Welcome to Setup screen appears, press R to start the Recovery Console.
• The Recovery Console will start and ask you which Windows installation you would like to log on to.
  • If you have multiple Windows installations, it will list each one, and you would enter the number associated with the installation you would like to work on and press enter. If you have just one Windows installation, type 1 and press Enter.
• It will then prompt you for the Administrator's password. If there is no password, simply press enter.
• You will now be presented with a C:\Windows> prompt
• At the comand prompt window, type exactly the bolded text below (watch for "spaces"). (The d after the word expand is the drive letter to your CDROM. If it's different on your computer, please make the necessary adjustment).
  
  expand d:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe /y
  expand d:\i386\explorer.ex_ c:\windows\explorer.exe /y
  
  
• type exit to exit the command prompt and restart your computer.

Post fresh Combofix log.

 

[davidanthony]

after i entered the lines for winlogon and explorer the pc came back and said it couldn't expand the file
?

 

[Broni]

First of all, I need EXACT error message.
Then...
Is your CD drive listed as letter D?
Did you type the command correctly? There are two "spaces" in each command.
Are you pressing Enter after each command?

 

[davidanthony]

Unable to create file explorer.exe
0 file(s)

the same message wiith winlogon

this is what i typed at the prompt c:\windows>


expand e:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe /y
:

 

[Broni]

Try little bit different commands:
expand d:\i386\winlogon.ex_ c:
expand d:\i386\explorer.ex_ c:

 

[davidanthony]

that worked running combofix...

 

[Broni]

Nooooooooooooo.

 

[Broni]

Do NOT run Combofix!

 

[davidanthony]

sorry....my bad

 

[Broni]

Did you start it already?

 

[davidanthony]

* expand d:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe /y
expand d:\i386\explorer.ex_ c:\windows\explorer.exe /y

* type exit to exit the command prompt and restart your computer.


Post fresh Combofix log.


I thought we were still working on using this fix.....

 

[davidanthony]

do u want me to do the expand commands again?

 

[Broni]

Sorry for the confusion.
Combofix was fine to run, if the 1st expand command worked, but it didn't and we're forced to use 2 steps fix. We just completed 1st one.

I need to know, if you started/ran Combofix, or not.

 

[Broni]

We posted at the same time....
Please, answer my last question regarding Combofix.

 

[davidanthony]

yes i ran combofix

 

[Broni]

OK, you need to go back to my reply #30 and repeat same commands:
expand d:\i386\winlogon.ex_ c:
expand d:\i386\explorer.ex_ c:

IF successful, run these commands:
copy c:\winlogon.exe c:\windows\system32\winlogon.exe /y
copy c:\explorer.exe c:\windows\explorer.exe /y

Let me know, if you're able to perform both sets of commands

 

[davidanthony]

both files expanded ok

but when i tried to use copy command it said /y invalid parameter so deleted it from command

then entered new command but in both cases "winlogon" and "explorer" it said file not found

 

[Broni]

Open Windows Explorer and see, if both files explorer.exe and winlogon.exe are located in root C:\folder.

 

[davidanthony]

neither file found under c:\ using start:explorer

 

[Broni]

I'm not sure, what's going on here...

Have your Windows CD in.
Open Windows Explorer and navigate to i386 folder on Windows CD.
Can you see these two files:
explorer.ex_
winlogon.ex_
They'll look just like that, with "underscore" instead of the last letter.

 

[davidanthony]

explorer.ex_ on cd
winlogon.ex_ on cd

 

[Broni]

OK, copy both files to your desktop.
Using any unzipping program, unzip both files.
Then, copy both unzipped files to C:\ folder.
Make sure, they're both there.
Let me know, when you're done.

 

[davidanthony]

both files are now in a folder called c:\virus delete

 

[Broni]

No.
Copy them to root C:\ directory.
Don't create any new folder, just paste them to C:

 

[davidanthony]

C:\ folder.

sorry i took you literally...lol