[pbel]

Please help!

Windows XP Home, 2002, SP2, Mozilla Firefox, Avast

3 days ago I turned on the computer to be alerted to a virus. I was not smart enough to find the virus name but here is what happened.

1. Ie was taken over and quickly filled the screen with over 50 open browser windows.
2. My desktop was taken over with a black screen and a WARNING NOTICE screaming that I have a virus.
3. I had minimal control over Mozilla

ATTEMPTED FIXES:
1. Smitfix and it took care of about 70% of the problems.
2. Downloaded and purchased RegCure. Ran it and started to get RUNDLL errors.
3. Downloaded and paid for STOPzilla which came with Shield Deluxe 2009V2. The Shield Deluxe said to remove all other anti-virus applications. I did as instructed..(I know..how stupid is this guy?)
4. Ran STOPzilla and Shield Deluxe. Now I have decent internet access but everything is very slow. Many of the screens in IE do not display the images (just the html box and title). Mozilla seems OK.
5. Now I can not update Windows. I went into services and tried to set the Automatic Update but get an error (ACCESS DENIED) and the BITS is set to manual, but when I try to start it I receive: "COULD NOT START THE BITS SERVICE ON LOCAL COMPUTER. ERROR2: THE SYSTEM COULD NOT FIND THE SPECIFIED FILE.

Please help this helpless man...lol
Thanks
Paul

[Advertisements]

Go back to services.msc and double click on the BITS service, when the properties Window comes up what does it say for the "Path to Executable"?

Edited by Gnomad1600, 19 February 2009 - 08:11 PM.

[Gnomad1600]

Go back to services.msc and double click on the BITS service, when the properties Window comes up what does it say for the "Path to Executable"?

Edited by Gnomad1600, 19 February 2009 - 08:11 PM.

[pbel]

%fystemRoot%\system32\svchost.exe -k netsvcs

[123Runner]

I would suggest you take a trip over to our malware forum (link in my signature).
Start by doing what is suggested. This will clear a lot of stuff. If still not ok, then post a hijack log in that forum.

You need to be clean of virus's and malware. After the malware staff have cleared you, and if you still have issues, then return here.

[Gnomad1600]

Therin lies the problem, first step is to back up the Registry. For what we are going to do creasting a system restore point will work. Next you will need to open the Registry Editor. Hold the Windows key and press R, when the Run box opens type in regedit and hit Enter. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS , in the right Window pane look for Imagepath. In the data column it should have the %fystemRoot%\system32\svchost.exe -k netsvcs , doubleclick on Imagepath and change it to %SystemRoot%\system32\svchost.exe -k netsvcs. It is exactly the same except change the f to an S Hit Okay, while you are in regedit, check HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001 and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002 for the same settings. Exit regedit and go back to services.msc and check for other "Path to Executable" errors that say the same thing. You will need to make changes to any others that have the %fystemRoot%\system32 error.

[pbel]

Thanks for your help and suggestions. The system will not allow me to the registry for editing. pop up says: "Administrator has not allowed"

I am taking 123runners advice and heading over to the Malware Forum and starting the clean up from there. I will post the results once completed.
Thanks again!
Paul

[Gnomad1600]

You can download this tool to regain the ability to edit the registry.

[pbel]

Thanks Gnomad. I was finally able to get into the regedit and repair all the %fystem errors to %System and now the Auto Update is working but that is only half of the problems. I am not sure what to do from this point. I am not even sure how to list my problems on the MALEWARE FORUM

I have gone through as many of the steps as I can there but keep running into issues part way through the Malwarebytes QUICK SCAN. I get into the program and it winds up crashing and then the BSOD. I am runningit oncemore after uninstalling and re-installing and will let you know how it goes.

Again, thanks for the help.

[Gnomad1600]

Do you have a Windows CD? If so boot from the CD and when you are prompted select R to repair Windows. follow the prompts for selecting the installation to log into. Enter the administrator password at the prompt, if none just press enter. When you get to the command prompt type in chkdsk /r

[pbel]

I have had the PC for a while now (2 0r 3 years and I can not find the Windows CD
Sucks to be me...huh!

[Gnomad1600]

Do you know any one that has one you can borrow? It needs to be a Genuine CD, not one from Dell or HP.

[pbel]

can it be any Windows XP CD? I have one that came with a UMPC I bought about a year ago?

[Gnomad1600]

Is it the same Version Pro, or Home? Same service pack level?

[pbel]

yes it is

[Gnomad1600]

Then that one should work. Boot to it , follow the directions above and hopefully that will fix the blue screen error. It will likely take a while, so i will check back tomorrow. Good Luck!!