[Essexboy]

Rename the file extension to .com of the following programme

Download Dr Web from here Fill in the small form and download

It will download as an 8 digit file save it to your desktop

Restart in safe mode and run
Accept the enhanced version
Then run the quick scan
About halfway through you will be prompted to buy - just X the box closed
Once finished it will generate a log please attach that

[Advertisements]

ok it scanned and said "no viruses found" then when I tried to click ok it minimized and locked me out of the pc then rebooted with no warning. tried to scan again and now and the com file would not open. I ran exe fix then changed dr. web back to exe. any idea where dr.web hides it's log?

it's scanning now so we will see what happenes. this time my screen flickered for about a minute during the begining of the scan but seems stable now.

Edited by mohavepc, 11 July 2011 - 04:40 PM.

[mohavepc]

ok it scanned and said "no viruses found" then when I tried to click ok it minimized and locked me out of the pc then rebooted with no warning. tried to scan again and now and the com file would not open. I ran exe fix then changed dr. web back to exe. any idea where dr.web hides it's log?

it's scanning now so we will see what happenes. this time my screen flickered for about a minute during the begining of the scan but seems stable now.

Edited by mohavepc, 11 July 2011 - 04:40 PM.

[mohavepc]

Ok this time scan completed and found nothing. no report was generated. reboot and now com's work again but exe's are dead. I am about ready to throw linux on this danged pos and be rid of it. (sorry about the rant) Any new ideas? Combofix usually does a good job but this is stupid.

[Essexboy]

Hmm this is almost as if the registry is failing to save on exit

Do you have any system restore points available from around the time the problem first appeared ?

[mohavepc]

the restore points were lost when this happened, I have looked in sys vol info and cannot find any even with hidden files shown and hide op files unchecked. I tried to load linux from a flash to see if I could find them bot the mini won't load from usb even though it is turned on in bios.

Tell me if you think this might work. I might try anyhow. What if..... I repair the registry with the exe fix, then save a backup at that point. reboot then restore the registy from the backup. do you think it would save that way?

Edited by mohavepc, 12 July 2011 - 10:42 AM.

[Essexboy]

Could be a plan - failing that we may need to do a repair, I can see no apparent malware now. Do you have a windows CD ?

[mohavepc]

I do have an xp cd however this machine fails to boot from the usb. I'ts a mini so there is no cd rom. the factory restore partition wont boot so i am not sure what else to do. I can pull the drive and slave it to a linux box which I may do. If I create a restore point while the fix is in place do you think I could replace the reg files with the backed up versions? the sam, sys,default, and user files from the restore point? or do I just need the sys file?


I just noticed that combofix added the recovery selecion to the boot menu. could that be of use?

Edited by mohavepc, 12 July 2011 - 11:19 AM.

[Essexboy]

I would go the restore route first, Fix the exe problem, create a restore point. Reboot, if the problem is still present then roll back to the restore point just created

[mohavepc]

will try that now. the importing the reg didnt work. it said not all data was sucsessfully written to the registry. some keyes are open by the system. \

[Essexboy]

OK keep me updated please

[mohavepc]

ok heres what happened thus far with the restore. I fixed the exe files, then cleared the one sys checkpoint that was there, created a new restore point, rebooted. no exe , Applied fix, restoere to earlier time, 2 reboots not 1 during that restore, now I have an error as follows.
Windows cannot open this file:
File: rstrui.exe
To open this file windows needs to know what created it. blah blah blah

clicked cancel
desktop loads then tried to open notepad and got the error on that as well. this is the first time I have seen the rstrui so I am assuming that is the restore complete or failure window.

Edited by mohavepc, 12 July 2011 - 11:58 AM.

[mohavepc]

btw. the usb ports work fine exept for booting. I have no idea why.

[Essexboy]

Are they enabled within the BIOS ? What is the make and model of your computer

[mohavepc]

yes they are enabled and the boot from usb option is set to yes. this is an HP mini FZ978UA# ABA

Edited by mohavepc, 12 July 2011 - 12:32 PM.

[Essexboy]

If you reboot your computer and press the F11 key at the logo page what options do you get ?