[CompCav]

I am going out to eat and will be back in about 2 hours or less.

Regards,

CompCav

[Advertisements]

I get the cannot create file c:\users\chris'laptop\desktop\cmd.bat. I've tried to run fix3 twice and this is what I get.

Please advise

[helpme1962]

I get the cannot create file c:\users\chris'laptop\desktop\cmd.bat. I've tried to run fix3 twice and this is what I get.

Please advise

[helpme1962]

I hit ok after that error message. Otl says its killing process, do not interrupt.

[helpme1962]

It still doing the same thing, killing process. Its been a while now. The cpu light is going crazy. Desktop background is completely black. No shortcuts or file on the desktop showing.

[helpme1962]

im stopping it now.

[helpme1962]

I manually shut it down, waiting for your response.

[CompCav]

Please use this modified fix file fix4.txt

 fix4.txt   346bytes   124 downloads

Follow the same steps with this file as in Post #60.

Regards,

CompCav

[helpme1962]

I get the same error message as in post 62 with fix4

[helpme1962]

I tried fix 4 again. I think it worked.

Here is a log.

========== OTL ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Chris' laptop\Desktop\cmd.bat deleted successfully.
C:\Users\Chris' laptop\Desktop\cmd.txt deleted successfully.
< COPY C:\_OTL\MovedFiles\04282012_161042\C_ProgramData\545mhm10i165fb14p5igv7o722375a57e2657 C:\ProgramData\ /C >
C:\_OTL\MovedFiles\04282012_161042\C_ProgramData\545mhm10i165fb14p5igv7o722375a57e2657
0 file(s) copied.
C:\Users\Chris' laptop\Desktop\cmd.bat deleted successfully.
C:\Users\Chris' laptop\Desktop\cmd.txt deleted successfully.
< COPY C:\_OTL\MovedFiles\04282012_161042\C_Users\Chris' laptop\AppData\Local\545mhm10i165fb14p5igv7o722375a57e2657 C:\Users\Chris' laptop\AppData\Local\ /C >
The system cannot find the file specified.
C:\Users\Chris' laptop\Desktop\cmd.bat deleted successfully.
C:\Users\Chris' laptop\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.42.1 log created on 04282012_213205

[CompCav]

Still missing the one with Chris' laptop as one of the sub directories.

[CompCav]

We have an issue with the way that the directory Chris' Laptop is written it uses the apostrophe and that is a no no when using DOS commands to move files around.

So we will need to move it manually with copy/paste.


Step 1.

First we need to make sure file extensions are showing and all system and hidden files are visible.

• Click Start >> Computer >>Organize
• A menu appears, select Folders and search options
• Click the View tab
• Under Hidden files and folders click the button for Show hidden files, folders, and drives
• Uncheck Hide extensions for known file types
• Click Apply
• Click OK

Step 2.

Now we wil retrieve the file.

• Click on the C: drive
• In the menu that comes up click on _OTL
• Click on MovedFiles
• Click on 04282012_161042
• Click on C_Users
• Click on Chris' laptop
• Click on AppData
• Click on Local
• Right click on 545mhm10i165fb14p5igv7o722375a57e2657
• Select copy

If the file is not there post back and we will copy it from one of the other locations.

You know have a copy of the file in memory.

• Click the back arrow in the upper left corner until you are back at Hard Disk drive labeled C:
• Click on C:
• Click on Users
• Click on Chris' laptop
• Click on AppData
• Click on Local
• You should see several directories (including Temp) and a few files
• In an open space beneath the last file, right click and select Paste
• The file 545mhm10i165fb14p5igv7o722375a57e2657 should now be showing here.
• Close the window and reboot the computer.

Please give me an update on the computer

[helpme1962]

did what you said. Still have the fake window things going on. Black desktop, security essentials is disabled but a pop up comes up from it in orange that says windoes did not pass the genuine validation etc. Was I supposed to run otl again. I didnt. Just checking.

One note that I think is important There is a padlock on Chris'laptop folder icon under the root of c\users that I think appeared when this whole thing started a few days ago.

[CompCav]

Please run RogueKiller again just like we did it in Post #2 Step 1.

The replacement of those two files was all we did so the issue with Windows genuine is a new issue.

I will wait to see the scans from RogueKiller before we check the Windows validation issue.

Regards,

CompCav

[helpme1962]

I did all 3 steps for Rouge Killer, the scan, the delete and the fix shortcuts. I hope thats what you wanted me to do. Here are all 3 logs.

RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Chris' laptop [Admin rights]
Mode: Scan -- Date: 04/28/2012 23:10:05

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD2500BEKT-75A25T0 +++++
--- User ---
[MBR] ccfd6f062029fa488456bf8ef07cf726
[BSP] 8ccd4d5a9ffdc8a21e5b737b68011ff8 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 12890 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 26480640 | Size: 225544 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[6].txt >>
RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ; RKreport[6].txt



RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Chris' laptop [Admin rights]
Mode: Remove -- Date: 04/28/2012 23:11:11

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD2500BEKT-75A25T0 +++++
--- User ---
[MBR] ccfd6f062029fa488456bf8ef07cf726
[BSP] 8ccd4d5a9ffdc8a21e5b737b68011ff8 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 12890 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 26480640 | Size: 225544 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[7].txt >>
RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ; RKreport[6].txt ;
RKreport[7].txt



RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Chris' laptop [Admin rights]
Mode: Shortcuts HJfix -- Date: 04/28/2012 23:11:45

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 35 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 5 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume3 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped

¤¤¤ Infection : ¤¤¤

Finished : << RKreport[8].txt >>
RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ; RKreport[6].txt ;
RKreport[7].txt ; RKreport[8].txt

[CompCav]

You did great, now please check my PM to you about Windows key.


And.....


Scan with WVCheck:

Please download WVCheck and save it to the desktop.

Right-click on WVCheck.exe and select Run as Administrator then follow the prompts.
The scan may take some time depending on the Hard-Drive size.
Please post the contents of the notepad file WVCheck_1009_dd-mm-yyyy that can be located on the desktop.