[javacatz]

Help! Our pc got the redirect virus (and maybe something else). We followed all of the steps in the removal guide and it helped, but didn't completely fix the problem. the virus was blocking many of the help sites and also keeping us from downloading updates to programs, including MBAM. The last one we tried was MBAM, after loading a current version from the flash drive. It updated properly today (5/29) and found 5 problems. Complete fix required a reboot, which we attempted.

The pc kept locking up and restarting during the reboot, then wouldn't turn off. Eventually we got it to turn off, then tried to reboot again. It looked like it was going to open properly, but locked up on the win xp splash screen. We tried to open in safe mode, but it locks up during that process.

Now we're stuck. If we can fix it ourselves with help I'd prefer that to spending money at a repair shop. None of the ones locally are very reputable or reasonably priced. Not a good combination :-(

Thanks in advance for any help or suggestions, javacatz

[Advertisements]

IF you can get a friend to burn a bootable CD you can try Avira's rescue disk:

http://dlpro.antivir...m-common-en.iso

Instructions here:

http://www.techmixer...us-and-malware/

Another bootable CD that is useful is PC Regedit. See the instructions in the BOTTOM half of
http://www.raymond.c...ing-in-windows/

Normally we see problems with this key:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
(HKLM is HKey_Local_Machine)

userinit which should have: c:\windows\system32\userinit.exe,
shell which should have: explorer.exe

And with these:

HKLM\Software\CLASSES\batfile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\comfile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\exefile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\piffile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\regfile\shell\open\command => regedit.exe "%1"
HKLM\Software\CLASSES\scrfile\shell\open\command => "%1" %*
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools => 0x00000020,0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs: Normally no entry except when you have a third party firewall or with some anti-virus programs. Verify that any DLLs it lists are associated with programs you know.



Ron

Edited by RKinner, 29 May 2010 - 02:12 PM.

[RKinner]

IF you can get a friend to burn a bootable CD you can try Avira's rescue disk:

http://dlpro.antivir...m-common-en.iso

Instructions here:

http://www.techmixer...us-and-malware/

Another bootable CD that is useful is PC Regedit. See the instructions in the BOTTOM half of
http://www.raymond.c...ing-in-windows/

Normally we see problems with this key:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
(HKLM is HKey_Local_Machine)

userinit which should have: c:\windows\system32\userinit.exe,
shell which should have: explorer.exe

And with these:

HKLM\Software\CLASSES\batfile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\comfile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\exefile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\piffile\shell\open\command => "%1" %*
HKLM\Software\CLASSES\regfile\shell\open\command => regedit.exe "%1"
HKLM\Software\CLASSES\scrfile\shell\open\command => "%1" %*
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools => 0x00000020,0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs: Normally no entry except when you have a third party firewall or with some anti-virus programs. Verify that any DLLs it lists are associated with programs you know.



Ron

Edited by RKinner, 29 May 2010 - 02:12 PM.

[javacatz]

That may be a problem. We have a boot disk and the computer isn't recognizing the cd drive or the IDE drive. Hubby thinks the hard drive is dying, or the drive controller. Or when MBAM rebooted to fix the virus, it deleted all of the drivers.

He hit F12, option 6 and is now running a diagnostic of the system. We'll see how that goes. I burned a rescue disk, just waiting to see the diagnostic results.

[RKinner]

We're talking about the BIOS here and not the harddrive. Don't see how MBAM could have removed the drivers from the BIOS. Go into BIOS setup and you should be able to change the boot order so that it looks for the CD first then the c:\ drive. You may also need to set the BIOS to default. (On some Dells the default is IDE when the hard drive is SATA and then the default won't work. You have to go into the BIOS and tell it to use SATA.)

Ron

[javacatz]

Hubby finally got Windows to open using the last known good configuration. It took about 20 minutes to boot from the windows splash screen. He's running MBAM again. I'm not sure how far back the last good configuration was, but there are quite a few windows updates to reload.

Hopefully, the problem has been fixed. I'd rather get a new pc than pay for repairs to one that is 6 years old. Hopefully we can delay that scenario for a while longer.