[DaveFoxall]

Hi guys, really hoping someone can help me out here...

Last night AVG kept telling me I had a trojan, so I tried to fix it myself and have completely nuked my computer. I found how to do it online, followed the instructions exactly, and after 3-4 hours of searches, fixes and general stress it rebooted.

And refused to work correctly.

The computer wouldn't connect to the internet, everything went very slowly, and I've spent the last 8 hours trying to fix it.

I tried restoring what I'd moved to quarantines, ran it in safe mode, ran it normally, no joy anywhere.

So I've backed everything up and I now just want to restore it to Factory Settings. Problem is the F11 pressing/holiding F11 isn't bringing anything up, and the Restore System option won't work either. I get the feeling there isn't a system restore installed, and as the computer came preinstalled I have no recovery CD.

Really need some guidance here, hope someone can help?




Computer is an "HP Compaq dc5750 MICROTOWER BU ALL"
I have the 'hp s/n' and the 'p/n' written on the case (Although I don't know what these are?).
I also have the "Microsoft XP Home Edition" product key, or at least I have all but half of three of the numbers. Pretty sure I can guess them as the label has worn off slightly, but assume I have it.
Currently I'm on my laptop, which accesses the internet fine and has no problems.
The PC seems to load up fine but some programs don't function and the network connection doesn't register at all, the error message from 'Network Diagnostics for Windows XP' read...
"Windows has detected a problem with the Winsock provider catalog on this computer. This catalog allows programs to communicate with the computer across a network. Would you like Windows to reset the catalog to the default configuration?"
...which I've tried several times without success.


Any further information required, please shout! Thanks in advance to anyone who could help...

[Advertisements]

If it makes any difference, these are the instructions I found online that messed it up in the first place, copied and pasted word for word....

"In safe mode F8 run malwarebytes anti-malware and SUPERAntispyware,and what they find you
delete it manually.
then run ccleaner to cleand your pc, and mvregclean, to clean registry.
what mvregclean find you remove because the key is there but not the file ,folder or program.
even you reformat and it finds anything remove dont be afraid."

[DaveFoxall]

If it makes any difference, these are the instructions I found online that messed it up in the first place, copied and pasted word for word....

"In safe mode F8 run malwarebytes anti-malware and SUPERAntispyware,and what they find you
delete it manually.
then run ccleaner to cleand your pc, and mvregclean, to clean registry.
what mvregclean find you remove because the key is there but not the file ,folder or program.
even you reformat and it finds anything remove dont be afraid."

[rshaffer61]

Before I post the instructions for a factory restore I would just like to say that depending on the infection a restore may not take care of the issue. The choice is yours but I'm going to post two different suggestions and you can let me know which you would like to follow.

HP:

Press the power button to start the HP. Press and hold the F11 key to launch the HP Recovery Manager from the recovery partition.



I suspect that you have some malware on your computer causing issues that we are not able to solve through means we can use here in the Tech Forums. I suggest you read the 'Start Here' topic found HERE. With these self-help tools you have a high chance of fixing the problems on your own. If you are still having problems after following Step 3 of the guide, continue with Step 4 and 5 and post in the Malware Forum. If you are unable to run any programs, Please create a topic stating what you have tried so far and that you are unable to run any programs. Also, Please do NOT post the logs in this thread.

If you are still having issues after the malware expert gives you a clean bill of health, Please return to THIS thread and we will pursue other options to help you solve your current problem(s).
Add a link to this topic so that malware tech can see what steps have been taken here

[DaveFoxall]

The holding F11 trick doesn't work. There doesn't seem to be any recovery program on the computer either (Searched for recovery through the start bar search facility). Also System Restore won't load, comes back with the error "System restore is not able to protect your computer. Please restart your computer and then Run System Restore again." I've tried this at least a dozen times.

If I format the C: drive will that take it back to factory settings, or will it make it completely useless?

[DaveFoxall]

Running OTL, will report back with what it comes back with. Any ideas on the formatting the C: drive question?

[rshaffer61]

Lets see since you can get into windows please do the following. This will tell me if you have the recovery partition or not.



Go to Start then to Run
Type in compmgmt.msc and click Enter
On left side click on Disk Management
On right side you will see you hard drive.
Now I need you to take a screenshot and attach it to your next reply. Do the following to take a screenshot while the above is open and showing on your desktop.

To do a screenshot please have click on your Print Screen on your keyboard. It is normally the key above your number pad between the F12 key and the Scroll Lock key
Now go to Start and then to All Programs
Scroll to Accessories and then click on Paint
In the Empty White Area click and hold the CTRL key and then click the V
Go to the File option at the top and click on Save as
Save as file type JPEG and save it to your Desktop
Make sure the window is open all the way so I can see everything on the top right window.


Attach it to your next reply

[rshaffer61]

Since you are running the OTL are you going to start a malware topic now? If so then I need to stop what I am doing and let the malware techs work on your system.

[DaveFoxall]

OTL came back with two text files that I don't really understand. Extras.txt and OTL.txt. Is there some specific information within them I need to pass onto you?

This is the screen compmgmt came up with.
(The E: drive is a USB stick I'm using to move files between laptop and desktop. The other two are CD drives.)

[DaveFoxall]

I have started a new topic HERE although I'm not sure if it is something they can help with as I thought I'd previously removed the trojan that originally caused the problem? I think the issue is that I've removed something I shouldn't have?

Any news on reformatting my C: drive? Or a factory default reset without the recovery CD or access to the system restore?

[rshaffer61]

OTL came back with two text files that I don't really understand. Extras.txt and OTL.txt. Is there some specific information within them I need to pass onto you?

Both of these txt files should be posted in your first post in the malware forum. We dont use those in this forum.

Your screenshot shows no recovery partition so there is only one other option at this point. You will need the same version OS disk that is installed on your system and the serial number you mentioned on the system.
If you don't have a OS installation disk you can borrow one from a friend but it must be the same as what was originally installed. Home, Media or Pro.
You will have to get all the drivers for the system as I'm sure they won't be installed with the OS. If the system came with a drivers disk that should take care of that issue then. You will then have to update all the drivers and do all the Microsoft Windows updates to get the system back up to date.
FYI: Before visiting any site other then Microsoft's Windows Update make sure you have your AV installed or you risk another infection.

[DaveFoxall]

OK, just for clarification...

If I can get another Windows XP Home installation CD then I should be able to reset everything with my product key?
(That's assuming the other forum guys can't fix the existing problem?)

If I have got that right, then could you quickly explain what I'd do once I have the CD? Is it just a case of putting it in once the computer turns on, or is it a little more in depth?

Also, what steps could I take to stop this happening in the future?

Thanks so much for your help today, really appreciate it.

[rshaffer61]

If I have got that right, then could you quickly explain what I'd do once I have the CD? Is it just a case of putting it in once the computer turns on, or is it a little more in depth?

In a nutshell you will do the following in order.

• Insert the disk while in windows
• Then restart your system
• If the boot sequence is set correctly in your bios then the system should display a message that says Press Any Key To Boot To CD.
• You want to Delete the existing partition on your C drive
• Then recreate the partition and format it using the NTFS (Not the Quick Format)
• Install Windows now on that partition.

Note: Make sure you are working with the C drive and not any other drive.
I would first suggest you try the malware steps when the Tech responds to your topic. You may be able to save everything without doing the format.

[DaveFoxall]

You've been really helpful, thank you very much. I really appreciate your time, hopefully the guys in the other forum will be able to come up with something.

[rshaffer61]

Also, what steps could I take to stop this happening in the future?

Safe surfing on the internet is number one.
Number two make sure you have a good AV installed.
Further look below for more explanation.

In safe mode F8 run malwarebytes anti-malware and SUPERAntispyware,and what they find you
delete it manually.

First off the programs you mention are not a actual AV. You need something like Avast or MSE that is a realtime sxanner protection.

then run ccleaner to cleand your pc, and mvregclean, to clean registry.
what mvregclean find you remove because the key is there but not the file ,folder or program.
even you reformat and it finds anything remove dont be afraid."

Stupid suggestions as A registry cleaner will not increase your system's speed or performance, and has the potential to break your registry to the point that your PC is no longer bootable.
We strongly advise that people stay away from any of the registry cleaners out there.
Go HERE to get more information about why registry cleaners aren't needed.


Thanks to Sari for the explanation

What you found out in your case is it has doinked something in your registry I'm sure. Never use a registry cleaner on your system especially if you are not 110% sure what you are doing. Removing just one wrong entry can cause the exact issue you are having. There are several programs that will work that do not mess with the registry at all.
Malware removal should only be done by someone who has been specifically trained for that which all our malware techs go through a very long process being trained to do this. When ever you suspect a infection and if your Av doesn't get rid of it come back and redo the malware steps I posted before.
Lastly P2P and file sharing sites are notorious for hidden infections so I would suggest staying away from them. If this is not a option for you then at the very least make sure your AV is up to date.


I will post exact instructions on the steps for a full install once the malware folks are done and if the issue is not resolved.

[rshaffer61]

Are you still having problems with your issue?
It has been 15 days since your last response and I was wondering if the issue has been resolved with the malware forum or do you still need assistance in this topic?
If so can you explain how it was resolved so others may be able to fix it if they have the same issue.
If not please let us know and we can continue with helping you to resolve the issue.