Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Heur Exploit Script virus looping to blue screen on start up


  • This topic is locked This topic is locked

#31
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Sorry for the delay.

Run Msconfig. Don't do any changes yet. Is the Safe boot option checked?

Lets run a few programs in that computer.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If any of these applications will not uninstall, it is first recommended to uninstall it with AppRemover by Opswat. http://www.appremover.com/. Do not remove Norton / Symantec with AppRemover. If you need further help with AppRemover, let me know.

      -----------------------------------------------------------

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    -----------------------------------------------------------

  • Double click on combofix.exe & follow the prompts.
  • Install the Recovery Console if prompted.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" .
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.
  • 0

Advertisements


#32
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
I still cannot access the internet via the corrupt PC. On broadband I get the Error Message 3758096902 "Windows cannot start installing New Modem Wizard" and the is no list of available networks. On the network diagnostics I get the error messgae 12007 on HTTP, HTTPS and FTP stating that server name or address could not be resolved.

I have also tried using an ethernet cable but I get the message that the Phone and Modem control panel cannot be opened. On Networks diagnostics, I have the error code 0x80070422 service either disabled or no enabled devices.
  • 0

#33
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Lets take a look at your connectivity.

Download the enclosed file. Extract its contents to the USB drive. While running the sick computer in Normal Mode, browse to the USB drive and click on the Test.bat file. A report.txt will be produced. Post its contents in your next reply.
  • 1

#34
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
Problem - windows froze trying to disconnect from the internet (even though it wasn't connected) so I have rebooted. It appears to start up normally but the message "can't find boot.ini, loading with Windows" flashes up and I have no icons or task bar on my screen, just the wallpaper and the cursor. Right clicking the screen doesn't do anything either.
  • 0

#35
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Press Ctrl+ALT+Delete simultaneously. That should bring the Task Manager. Select the Applications tab. Click on New Task, type Explorer.exe and click OK.

Do you now have control over the computer?
  • 0

#36
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Explorer.exe Had a typo on my previous post.
  • 0

#37
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
It has opened another explorer.exe file in the task manager but the screen has changed apart from that
  • 0

#38
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Still no icons?
  • 0

#39
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
I guessed that. :-) still the same though I'm afraid. No change. No applications are running either.

Edited by Jan1959, 02 January 2011 - 09:50 AM.

  • 0

#40
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Lets go back to OTLPE. There must be a remnant of the virus doing all type of things.

Take a look at Post #2. Follow those instructions to run OTLPE (Save those instructions in the USB drive), and post the report.
  • 1

Advertisements


#41
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
I have just loaded the OTLPE and a different window has come up asking me which folder I want to browse - my computer, Ram disk, local disk, ReatogoPE or shared documents. I didn't have this come up before and when I closed it to try to start again I have a box come up called Runscanner stating that no windows installations can be found.
  • 0

#42
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
There is no c:\windows?
  • 0

#43
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,999 posts
Restart the computer to the OTLPE CD. Perhaps the disk driver was not recognized.
  • 0

#44
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
loading now
  • 0

#45
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 249 posts
Same response - Browse for folder. No c:\windows option. The Windows XP logo does come up before Reatogo loads.

The local disk has c behind it, could this be the windows?

Edited by Jan1959, 02 January 2011 - 10:57 AM.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP