[Render]

Well... I messed up. Ignore my post #12 and follow these steps:

Please follow these steps below. Save tools and logs on your USB memory stick and run them with Task Manager and New Task...

Step 1

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• Defogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running Defogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.


Step 2

• Please download aswMBR.exe to your desktop.
• Double click the aswMBR.exe to run it.
  
  
• When asked if you want to download Avast's virus definitions please select Yes.
• Click the Scan button to start scan.
  
  
• On completion of the scan click Save log, save it to your desktop and post in your next reply.

[Advertisements]

Worked well this time. Here is the log:

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-09-17 01:24:43
-----------------------------
01:24:43.390 OS Version: Windows 5.1.2600 Service Pack 3
01:24:43.390 Number of processors: 2 586 0x1C02
01:24:43.390 ComputerName: HPLAPTOP UserName: Irina
01:24:43.843 Initialize success
01:24:44.546 AVAST engine defs: 11060900
01:24:55.015 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
01:24:55.031 Disk 0 Vendor: SAMSUNG_HS082HB NL100-04 Size: 76319MB BusType: 3
01:24:57.062 Disk 0 MBR read successfully
01:24:57.062 Disk 0 MBR scan
01:24:57.359 Disk 0 unknown MBR code
01:24:57.375 Disk 0 scanning sectors +156280320
01:24:57.531 Disk 0 scanning C:\WINDOWS\system32\drivers
01:25:15.937 Service scanning
01:25:20.968 Modules scanning
01:27:46.703 Disk 0 trace - called modules:
01:27:46.734 ntkrnlpa.exe CLASSPNP.SYS disk.sys SahdIa32.sys ACPI.sys hal.dll atapi.sys pciide.sys
01:27:46.750 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86b38ab8]
01:27:46.750 3 CLASSPNP.SYS[f7628fd7] -> nt!IofCallDriver -> [0x86b08bb0]
01:27:46.750 5 SahdIa32.sys[f7649939] -> nt!IofCallDriver -> \Device\0000006b[0x86b099e8]
01:27:46.765 7 ACPI.sys[f749f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86b7b940]
01:27:48.734 AVAST engine scan C:\WINDOWS
01:28:06.546 AVAST engine scan C:\WINDOWS\system32
01:30:10.734 AVAST engine scan C:\WINDOWS\system32\drivers
01:30:24.453 AVAST engine scan C:\Documents and Settings\Irina
01:49:12.125 AVAST engine scan C:\Documents and Settings\All Users
01:50:50.453 Scan finished successfully
01:53:30.312 Disk 0 MBR has been saved successfully to "D:\MBR.dat"
01:53:30.343 The log file has been saved successfully to "D:\aswMBR.txt"

[Irishka]

Worked well this time. Here is the log:

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-09-17 01:24:43
-----------------------------
01:24:43.390 OS Version: Windows 5.1.2600 Service Pack 3
01:24:43.390 Number of processors: 2 586 0x1C02
01:24:43.390 ComputerName: HPLAPTOP UserName: Irina
01:24:43.843 Initialize success
01:24:44.546 AVAST engine defs: 11060900
01:24:55.015 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
01:24:55.031 Disk 0 Vendor: SAMSUNG_HS082HB NL100-04 Size: 76319MB BusType: 3
01:24:57.062 Disk 0 MBR read successfully
01:24:57.062 Disk 0 MBR scan
01:24:57.359 Disk 0 unknown MBR code
01:24:57.375 Disk 0 scanning sectors +156280320
01:24:57.531 Disk 0 scanning C:\WINDOWS\system32\drivers
01:25:15.937 Service scanning
01:25:20.968 Modules scanning
01:27:46.703 Disk 0 trace - called modules:
01:27:46.734 ntkrnlpa.exe CLASSPNP.SYS disk.sys SahdIa32.sys ACPI.sys hal.dll atapi.sys pciide.sys
01:27:46.750 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86b38ab8]
01:27:46.750 3 CLASSPNP.SYS[f7628fd7] -> nt!IofCallDriver -> [0x86b08bb0]
01:27:46.750 5 SahdIa32.sys[f7649939] -> nt!IofCallDriver -> \Device\0000006b[0x86b099e8]
01:27:46.765 7 ACPI.sys[f749f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86b7b940]
01:27:48.734 AVAST engine scan C:\WINDOWS
01:28:06.546 AVAST engine scan C:\WINDOWS\system32
01:30:10.734 AVAST engine scan C:\WINDOWS\system32\drivers
01:30:24.453 AVAST engine scan C:\Documents and Settings\Irina
01:49:12.125 AVAST engine scan C:\Documents and Settings\All Users
01:50:50.453 Scan finished successfully
01:53:30.312 Disk 0 MBR has been saved successfully to "D:\MBR.dat"
01:53:30.343 The log file has been saved successfully to "D:\aswMBR.txt"

[Render]

MBR looks good. We will try with clean boot now:

To start Windows XP with a clean boot, follow these steps:

Step 1

• Open Task Manager, click on New Task..., type msconfig, and then click OK.
• The System Configuration Utility dialog box is displayed.

Step 2

• In the System Configuration Utility dialog box, click the General tab, and then click Selective Startup.
• Click to clear the Process SYSTEM.INI File check box.
• Click to clear the Process WIN.INI File check box.
• Click to clear the Load Startup Items check box. Verify that Load System Services and Use Original BOOT.INI are checked.
• Click the Services tab.
• Click to select the Hide All Microsoft Services check box.
• Click Disable All, and then click OK.
• When you are prompted, click Restart to restart the computer.

Tell me if explorer starts now or not.

[Irishka]

The same problem. However, after step 7 there was a notification about "blablabla must login as administrator". But there is only one user - with all the admin rights - on this computer.

[Render]

OK. Run msconfig once again and enable all previously disabled items. Restart.

Now... Did you already tried with SmitRem. If not please try to follow these steps:

Please download SmitRem

• Save the file to your desktop.
• Right click on the file and extract it to it's own folder on the desktop.

Please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

* if you have trouble getting into Safe mode go here for more info.

Once in Safe mode, follow these steps:

• Open the smitRem folder, then double click the RunThis.bat file to start the tool.
• Follow the prompts on screen.
• Wait for the tool to complete and disk cleanup to finish.
• The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

[Irishka]

Done, smitfiles.txt attached.

Attached Files

•  smitfiles.txt   6.56KB   79 downloads

[Render]

We will try with combofix now.

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Notes:

• Do not mouse-click Combofix's window while it is running. That may cause it to stall.
• ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
• Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
• CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
• If you are using personal certificates I recommend you to export them before running ComboFix and save them to external media.

Please carefully follow all steps below:

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
• Double click on Combofix.exe and follow the prompts.
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes. ComboFix will now start scanning your computer for known infections. This procedure can take some time, so please be patient.
• When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Give it at least 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofix. Use copy/paste.

Also please describe how your computer behaves at the moment.

[Render]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.