[Tabbyman]

Widows Live Messenger wont let me sign in to Windows Live Mail on that page window comes up telling me "Windows Live Mail could not be started.The application was unable to open the Windows Live message store. Windows Live Mail was unable to locate its message data base. If you have moved the data base files to a new location click OK to reset". Other window opens telling me "Windows Live Mail could not be started. The application was unable to open Windows Live Mail message store. Your computer may be out of memory or your disk is full".

Since this started I can not run any Anti-malware or virus detecting programes, when I download any exe programe to clean up or find the problem I get error windows saying Files are corrupt download again and retry. but this never works

I have widows xp pro AVG ver8 Free, Malwarebytes Anti-Malware newest version which I can not run iether my AVG when I try to run I am told I have NO Active Components.

The only two logs I have managed to get are DDS txt and Attached txt.

I am now at a loss to where to go from here could I please have some Help Ty



DDS (Ver_09-07-30.01) - NTFSx86
Run by john at 15:57:29.56 on 24/08/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.447.120 [GMT 1:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
svchost.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BitComet\BitComet.exe
C:\Documents and Settings\john\Desktop\P.pif

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = about:blank
mStart Page = about:blank
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn2\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - c:\progra~1\arcsoft\videod~1\ARCURL~1.DLL
BHO: {3049c3e9-b461-4bc5-8870-4c09146192ca} - RealPlayer Download and Record Plugin for Internet Explorer
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
{3cf3bb6d-06f8-3b28-8a48-5bc00355d5bd}
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {78875F5C-A685-4405-8DC5-D48DC65452B0} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
{c2c4d36c-8318-48f8-9f76-94d4a28aa3b4}
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - SidebarAutoLaunch Class
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn2\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn2\yt.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} -
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {61D1C847-DF80-423A-8C6D-DC03B97E6EBE} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [BitComet] ; "c:\program files\bitcomet\BitComet.exe" /tray
uRun: [BitTorrent] ;
uRun: [EPSON Stylus DX4400 Series] ; c:\windows\system32\spool\drivers\w32x86\3\e_faticae.exe /fu "c:\docume~1\john\locals~1\temp\E_SE8.tmp" /EF "HKCU"
uRun: [ERROR FILM] ;
uRun: [eyeBeam SIP Client] ;
uRun: [IMC] ;
uRun: [Messenger (Yahoo!)] ; "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [MSMSGS] ; "c:\program files\messenger\msmsgs.exe" /background
uRun: [SpybotSD TeaTimer] ; c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Yahoo! Pager] ; "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [Zroj] ;
mRun: [Adobe Photo Downloader] ; "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe"
mRun: [Adobe Reader Speed Launcher] ; "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Alcmtr] ; ALCMTR.EXE
mRun: [ArcSoft Connection Service] ; c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [AVG7_CC] ;
mRun: [AVG8_TRAY] ; c:\progra~1\avg\avg8\avgtray.exe
mRun: [btbb_wcm_McciTrayApp] ; c:\program files\btbb_wcm\McciTrayApp.exe
mRun: [GrooveMonitor] ; "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [hpqSRMon] ; c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [iKeyWorks] ;
mRun: [iTunesHelper] ; "c:\program files\itunes\iTunesHelper.exe"
mRun: [JMB36X IDE Setup] ; c:\windows\jm\JMInsIDE.exe
mRun: [Motive SmartBridge] ;
mRun: [NeroFilterCheck] ; c:\windows\system32\NeroCheck.exe
mRun: [QuickTime Task] ; "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [RCAutoLiveUpdate] ; c:\program files\max registry cleaner\MaxLiveUpdateRC.exe -AUTO
mRun: [RCSystemTray] ; c:\program files\max registry cleaner\MaxRCSystemTray.exe
mRun: [RTHDCPL] ; RTHDCPL.EXE
mRun: [S3Trayp] ; S3trayp.exe
mRun: [SkyTel] ; SkyTel.EXE
mRun: [SunJavaUpdateSched] ; "c:\program files\java\jre6\bin\jusched.exe"
mRun: [TalkTalk] ; "c:\program files\talktalk\bin\sprtcmd.exe" /P TalkTalk
mRun: [TkBellExe] ; "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [VTTimer] ; VTTimer.exe
mRun: [WinampAgent] ; "c:\program files\winamp\winampa.exe"
mRun: [WindowsLite32] ;
mRun: [YBrowser] ;
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: Add to Windows &Live Favorites - http://favorites.liv...m/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java
DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} - hxxp://www.bebo.com/files/BeboUploader.5.1.4.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} - hxxp://help.broadbandassist.com/bbdesktop/PreQual/files/MotivePreQual.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553635000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\john\applic~1\mozilla\firefox\profiles\npl5vq4k.default\
FF - plugin: c:\program files\google\google earth plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [2008-4-30 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [2008-4-30 53248]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-7-9 11264]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-19 335752]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-19 27784]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-3-13 55152]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [2009-3-14 223232]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2007-7-9 634880]
R3 TNET1130;802.11 WLAN;c:\windows\system32\drivers\TNET1130.sys [2004-6-17 438912]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\amps2prt.sys --> c:\windows\system32\drivers\Amps2prt.sys [?]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-3-27 298776]
S4 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S4 gupdate1c9871078b94daa;Google Update Service (gupdate1c9871078b94daa);c:\program files\google\update\GoogleUpdate.exe [2009-2-4 133104]
S4 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
S4 sprtsvc_TalkTalk;SupportSoft Sprocket Service (TalkTalk);c:\program files\talktalk\bin\sprtsvc.exe [2007-10-12 202016]
S4 tgsrvc_TalkTalk;SupportSoft Repair Service (TalkTalk);c:\program files\common files\supportsoft\bin\tgsrvc.exe [2007-8-2 148768]
S4 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]

=============== Created Last 30 ================


==================== Find3M ====================

2009-08-05 10:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-18 22:32 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-07-18 22:32 335,752 a------- c:\windows\system32\drivers\avgldx86.sys
2009-07-17 20:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-03 18:09 915,456 a------- c:\windows\system32\wininet.dll
2009-06-16 15:36 119,808 ac------ c:\windows\system32\t2embed.dll
2009-06-16 15:36 81,920 ac------ c:\windows\system32\fontsub.dll
2009-06-12 13:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 13:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 15:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 07:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-03 20:09 1,291,264 a------- c:\windows\system32\quartz.dll
2008-06-25 09:32 1,687,040 ac------ c:\program files\MergeMP3.exe
2008-03-29 23:15 55,296 ac------ c:\program files\keygen.exe
2008-03-11 14:46 87,608 -c------ c:\docume~1\john\applic~1\inst.exe
2008-03-11 14:46 47,360 -c------ c:\docume~1\john\applic~1\pcouffin.sys
2008-02-17 09:31 456,272 -c------ c:\docume~1\alluse~1\applic~1\pswi_preloaded.exe
2007-09-26 16:36 1,308,672 ac------ c:\program files\Multimedia Mouse Driver.msi
2007-09-26 16:36 4,632 ac------ c:\program files\0x0409.ini
2007-03-15 10:38 8,823,064 ac------ c:\program files\Photoshop_albumSE_en_us_320.exe
2006-11-16 08:16 198 ac------ c:\program files\key.txt
2006-05-31 19:26 1,059,111 ac------ c:\program files\giganews.exe
2002-02-12 16:20 4,858,598 ac------ c:\program files\nimo433.exe
2002-02-08 20:10 693,055 ac------ c:\program files\codinstl.zip
2002-02-08 15:48 831,951 ac------ c:\program files\DivX412Bundle+Player.exe
2001-11-28 15:38 1,171,444 ac------ c:\program files\vivo-player.exe
2001-10-14 20:17 1,860,416 ac------ c:\program files\codinstl.exe
2001-10-14 20:09 2,068,266 ac------ c:\program files\iv5setup.exe
2001-10-14 19:36 138,208 ac------ c:\program files\mpeg4x.zip
2001-10-14 18:56 192,496 ac------ c:\program files\3ivx_delta35.zip
2008-03-26 11:55 88 ac-shr-- c:\windows\system32\333060F1AF.sys
2008-03-26 12:07 3,452 ac-sh--- c:\windows\system32\KGyGaAvL.sys
2008-11-19 10:56 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008111920081120\index.dat

============= FINISH: 15:58:24.98 ===============

Attached Files

•  Attach.txt   18.83KB   581 downloads
•  DDS.txt   16.56KB   200 downloads

[Advertisements]

Well at least that run

@ECHO OFF
DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\ntelogon.dll >Log.txt
START Log.txt
DEL %0

Next you will need to create the batch fix to do that copy and paste ALL of the above in the quote box to a notepad file.
Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type look.bat

This will create a batch file

Then run look.bat by double clicking you may see a black box appear this is normal

On completion there should be a text file on your desktop post that here please

[Essexboy]

Well at least that run

@ECHO OFF
DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\ntelogon.dll >Log.txt
START Log.txt
DEL %0

Next you will need to create the batch fix to do that copy and paste ALL of the above in the quote box to a notepad file.
Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type look.bat

This will create a batch file

Then run look.bat by double clicking you may see a black box appear this is normal

On completion there should be a text file on your desktop post that here please

[Tabbyman]

Ty essexboy hope this helps

Attached Files

•  Log.txt   797bytes   155 downloads

[Essexboy]

Ta, well that showed me what you do not have

Does your system restore work ?

We may well have to use the Dr Web live disc, but you will need to burn it from another computer. Do you have access to one ?

[Tabbyman]

Yes I think so but never had to use it so would need help and Yes my wife has a desk top running xp home and I think there is Nero installed on there but again your asking a noob to burn stuff

[Essexboy]

OK this is very simple - even I can do it

This is a full blown operating sytem and includes a browser for going on line. It runs from the CD and is not installed on your hard drive

OK then two programmes to download. Once ISOBurner is installed you can forget it Then when you download the Dr Web ISO it will have a burning disc icon, double click the Dr Web icon and it will open ISOBurner select burn to burn it to disc. Any questions just ask

FIRST

ISOBurner this will allow you to burn Dr Web ISO to a cd and make it bootable. Just install the programme, from there on in it is fairly automatic. Instructions

SECOND

Dr Web Live CD Download this and using ISOBurner burn to CD. Usage instructions are here

Having made the bootable CD set your system to boot from CD - Do you know how to do this ?
Or you could follow the steps on this page and continue through to step 7

Once Dr Web starts select Dr.Web LiveCD (Default)

When the system is loaded, check disks or folders you want to scan and press Start

If the operating system failed to configure access to your network, you can do it manually using Networks Configure Manager. Start->Settings->Networks Configure manager. This will enable you to get online if needed

Once Dr Web has completed then reboot to windows and let me know what the situation is

[Tabbyman]

Hi Essxboy Ty for getting back to me so quickly, unfotunately ISO Burner won't install Message window "Set up exe has encountered a problem and needs to close.We are sorry for the inconvenience" so that is a no go again

[Tabbyman]

Hi again Essexboy, thought I would try copying IOS Burner and Dr Web Live to my memory stick and installing them on my other halfs pc to burn to disc there However that also gave me a window up saying the same as on my own pc whether my wife's pc is infected as well I don't know so where do I go from here ???

[Essexboy]

Lets try Combofix again but this time I would like you to rename it to winlogon.com. Delete the copy you have now. Then set windows to show extensions. Destructions for that with pictures is here



Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2





--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt along with a OTL log so we can continue cleaning the system.

If that should fail we may have a look at a repair install - as until I can get some scans running we are getting nowhere. Do you have a windows CD ?

[Tabbyman]

NO Way Essexboy wont run that aswell running mode bar fixed to center of monitor and can nor remove it window telling me files are corrupt and re-install and try again I have windows disk that was after re-naming and not showing extensions.

[Essexboy]

OK two ways to go from here, we can parallel install or try a repair install. Repair install is the one that keeps everything in the right place
A parallel install is basically installing a new set of windows alongside your current copy

[Tabbyman]

OMG now thats really getting technical for my wee Scottish brain

[Essexboy]

Lets see -- A parallel install puts a fresh set of windows on your disc and it means you will have to reload your programmes to get them to work

A repair install just rewrites all the windows files back to disc as a fresh copy and everything remains where it was

Then there is a full reformat and install where we wipe your drive and start with a brand new copy. But you will need to back up your data and licences first

Each option will take from 30 minutes to an hour to run

[Tabbyman]

What am I better doing then? and how do I go about backing up my data and licences This is all new to me so sorry John

[Essexboy]

If this was my system with this many problems I would go for a full reformat

I have a tutorial here

If you have any questions at all just shout