Solved Groogle.tr35.com virus

[robgee]

Not Booting

I have just tried loading a previous restore point - also doesnt work. I keep getting set back to the two options:

1. Launch Startup Repait (Recommened)
2. Start Windows Normally.

Neither of these options work.

 

[Bobbye]

Have you made any change in the BIOS? It sounds like you're going to have to boot from a disc> that means you are going to have to go into the BIOS and set the first boot order to CD, hard drive 2nd. Then put the OS CD in and boot into the Recovery.

As it stands now, you can't even get into this.

 

[robgee]

Booting

Hi, no changes to the BIOS - it happens when ComboFIx is run - I tried tried the last good config and and it worked - havent rebooted again. Im leaving my laptop in sleep mode instead because Im am behind on my work - hopefully the next reboot will be ok...

 

[Bobbye]

After Combofix ran the reboot, I got a message asking if i wanted to boot normally or in recovery mode. I selected normal and the machine booted normally. I followed the instructions from a previous post where the system runs a checkdisk on the next boot.

When I did the next boot, the system offered me the same 2 options. Boot Normal or Boot with recovery.I chose Boot with recovery and then the system attempts to run a fix. If a fix cannot be applied, the system normally offers a restore point option. In my case , the fix could be applied and all I was offered was a option to mail the problem to MS or to attempt another reboot.

Something went wrong at this point and I thing you've confused 'chkdsk' with 'Combofix'.

Where to set Error Checking up
You can do the Error Check from Command Prompt:
Using the Command Prompt should have been this: Start> Run> type in cmd> type in Chkdsk /f/r followed by a reboot. Chkdsk will start in a few seconds

Or Windows Explorer:
Right click on Start> Explore> My Computer> Right click on Local Drive (usually C)> Properties> Tools> Error Check> check both boxes on the screen that comes up> Apply> Close the message and reboot for the Error Checking to start.

You have nothing else to do except wait for the system to reboot after the Error Checking has finished.

The choices in Error Checking:

1. CHKDSK or Error Check alone will only scan the current drive but will not fix errors on the disc or attempt to recover bad sectors. Using Start or Enter begins the process without a reboot.
2. VolumeSpecifies the drive letter other than the Local Drive (followed by a colon), mount point, or volume name.) To have the checking use a different drive, the Command Chkdsk is followed by the drive letter, then a colon such as chkdsk volume E:
3. File Errors can be found and fixed using the switch /F The nag message that comes up can be closed and the system rebooted to start the checking.
4. Recovery of readable information in bad sectors can be done by using the switch /R This implies that the /F switch has also been used. Locates bad sectors and recovers readable information (implies /F).The nag message that comes up can be closed and the system rebooted to start the checking.

(Please note: this is not meant to include all of the options available for Error Checking- just the appropriate options here)

I'd like you to try and run Chkdsk one of the ways I've described above, usinbg both the /f and /r switches. Note there is a space before each slash: chkdsk /f /r

 

[robgee]

Booting again

There is definately something strange that happens when Combofix reboots the system. Its happened twice now. Both reboot options do not work after Combofix is run.

What I am confused about is why sometimes the F8 option to boot "last good config" works and sometimes it doesnt. This is why I tried the chkdsk option because it looked like Combofix had modified the bootsector. However, it seems selecting the chkdsk option doesnt work because the system boot back up to run it.

Also, the windows firewall is switching off again.

 

[Bobbye]

As I said several times previously, I don't think this is a malware problem. I had you running without incident. Combofix didn't modify the boot sector- that is most likely due to your work in the system. You might want to temporarily disable the TortoiseOverlay and DesktopWindowManager, both of which are high resource users, both of which have a large number of entries loading and running

 

[robgee]

Desktop Manager

I had disabled Desktop Manager in line with your previous recomendation and that has had a positive effect on preformance - I havent modified Tortoise. Anyway, the machine is stable now and switching the firewall on when I boot is not a big deal.

In an earlier post you mentioned removing some of the tools and a cleanup?

 

[Bobbye]

Removing all of the tools we used and the files and folders they created

• Uninstall ComboFix and all Backups of the files it deleted
• Click START> then RUN
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

• Download OTCleanIt by OldTimer and save it to your Desktop.
• Double click OTCleanIt.exe.
• Click the CleanUp! button.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes.

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
Creating a Restore Point in Windows 7:

• Click on Start> right click on Computer> Properties
• Select System Protection
• Click on the Create button (near bottom)
• Type a name for the Restore Point
• Click on Create again to save the restore point.

Deleting all but the most recent System Protection point in Windows

• Click Start, type Cleanmgr.exe and press ENTER
• Select the drive-letter from the list and click OK
• Click Clean up system files
  This restarts Disk Cleanup to run in elevated mode.
• Select the drive-letter from the list and click OK
• Click the More Options tab
  
  
• Click the Clean up… button under System Restore and Shadow Copies.
• Click OK.

Empty the Recycle Bin

If any of the Tools remain, you can remove them in Add/Remove Programs in the Control Panel.

The firewall should not be resetting like that. But again, I think it is due to some conflict in the system settings rather than malware.

Please let me know if you have any more questions.