[Brandon Maki]

Bits starts with the same output as before with the exception of PID 1332. Should I try the afd start again? The shortcut icon just says malware.exe, it was created the day I was infected. No other details are given in properties to determine what it is.

[Advertisements]

Hi,

yes, please try starting afd, but I don't think the fixit worked. Did you get the sfcdetails.txt populated by using an elevated command prompt?

regards myrti

[myrti]

Hi,

yes, please try starting afd, but I don't think the fixit worked. Did you get the sfcdetails.txt populated by using an elevated command prompt?

regards myrti

[Brandon Maki]

No afd will not start. I tried to get the sfcdetails with elevated command prompt, but it still cannot open the file.

[myrti]

Hi,

can you get the C:\windows\Logs\CBS\CBS.log from a live-cd and zip it and attach it so I can take a look at it?

regards myrti

[Brandon Maki]

How do I do that?

[myrti]

Hi,

use your xpud flash drive, to boot from it. Then navigate to /mnt/sda2/windows/system32/cbs/cbs.log and copy and paste that onto /mnt/sdb1. This should make the CBS log show in your flash drive.

Reboot into windows. zip the file and attach it here. (or upload it somewhere and give me the link, if it is too big).

regards myrti

[Brandon Maki]

Here is that log

Attached Files

•  CBS.zip   195.94KB   129 downloads

[myrti]

Hi,

ok, it seems the following three files could not be repaired: afd.sys, msvrct.dll, shell32.dll. We have already checked that those files are legit and so it seems what we have is not corrupted files but a version mismatch. Do you remember what the date was you reset the computer too?
It's possible that those files are now "too new".

regards myrti

[Brandon Maki]

It was reset to March 30, 2012

[myrti]

Hi,

hmm, that shouldn't be an issue then. I would like you to try this windows repair utility:

Download Windows Repair by Tweaking.com to your desktop.

• Double-click tweaking.com_windows_repair_aio.zip and extract the Tweaking.com - Windows Repair folder to your desktop.
• Now open this folder and double-click Repair_Windows.exe.
• Click the Start Repairs tab on the far right.
• Click Custom Mode so there is a bullet in it.
• Click the Start button (bottom right)
  
  Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
  
• Click Unselect All
• Put a checkmark in the following items:
  
  • Reset Registry Permissions
  • Reset File Permissions
  • Remove Policies Set By Infections
  • Repair WMI
  • Repair Windows Firewall
  • Repair Winsock & DNS Cache
  • Repair Windows Updates
  • Set Windows Services To Default Startup
  
  Note: Leave everything else unchecked
  
• Put a checkmark in Restart System When Finished
• Now click the Start button (bottom right)

This should help with your internet conection issues and the Windows Updates/File permissions should fix the issue with the not-running services.

regards myrti

[Brandon Maki]

That still did not fix it, is there a log from it that I can post for you?

[myrti]

Hi,

one other option would be to reinstall SP1. That should get you all "fixed" when it comes to driver signatures. However that is a rather drastic measure.


You can download Windows 7 SP1 here: http://www.microsoft...lang=en&id=5842 Select windows6.1-KB976932-x64.exe and wait for the download to finish (this is about 1Gb to download unfortunately).
Then double-click the file and follow the prompts. You may have to reboot multiple times (and wait some time in between).

Once it's finished, reboot once more and let me know if there is any improvement with the machine.

regards myrti

[Brandon Maki]

When I tried to install SP1, I got error: ERROR_NOT_FOUND(0x80070490)

[myrti]

Hi,

could you try running the system readiness tool and let me know what it says: http://support.microsoft.com/kb/947821

regards myrti

[Brandon Maki]

Windows Update Standalone Installer:
Installer encountered an error 0x80080005
Server Execution Failed