Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

SMART virus


  • This topic is locked This topic is locked

#61
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
Download the enclosed file. Attached File  SaveMBR.zip   207bytes   56 downloads

Save an extract its contents to the USB drive.

Insert the USB drive into the ailing computer and boot to Reatogo.

Browse to the USB drive throughout My Computer and locate the SaveMBR folder. Open the folder and doubleclick on the SaveMBR.bat file. If successful, it will create a file (MBRDUMP.txt). Please attach that file to a reply.
  • 0

Advertisements


#62
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
I guess that was not sucessful, because there is nothing on the sick computer called mbrdump
  • 0

#63
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
It should be created in the same folder the batch file, SaveMBR.bat, was saved in the USB drive.
  • 0

#64
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
found it-

Attached Files


  • 0

#65
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
Save these instructions in the USB drive, so you can have access to it while in Reatogo (you can use any name)

Insert the USB drive and Boot to Reatogo.

Change the C driver letter to H, and the D driver letter to C.

Run OTLPE as you did before. If asked for the Windows directory, select C:\Windows.

Leave the setting as they are, except that this time, copy and paste the following under custom scans:

:OTL
@Alternate Data Stream - 191 bytes -> C:\ProgramData\TEMP:238AA907
@Alternate Data Stream - 162 bytes -> C:\ProgramData\TEMP:D455373F
@Alternate Data Stream - 155 bytes -> C:\ProgramData\TEMP:C4532973

:files
Attrib -H C:\Users\Heidi\AppData\Roaming\*.* /S /D /c
Attrib -H C:\ProgramData\*.* /S /D /c
C:\ProgramData\8YiLcmFFsOhOQD
C:\ProgramData\8YiLcmFFsOhOQD.exe
C:\ProgramData\xBuRdeRWhJWa.exe.vir
C:\ProgramData\-8YiLcmFFsOhOQDr
C:\ProgramData\-8YiLcmFFsOhOQD

:Commands
[EMPTYTEMP]
[RESETHOSTS]


Click on the red Run Fix button. A report will be produced and saved in the C:\_OTL\MovedFiles folder in the form of Date_Time.log. Open that report in Notepad and post its contents in a reply.

Attempt to boot in Normal mode and let me know the outcome.
  • 0

#66
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Attached File  07302012_140819.log   3.04KB   70 downloads



I logged in from the hard drive running windows normally - it looped back to the windows error recovery screen - I didn't click on anything quick enough, so it ran the repair windows option, which broght me to the same windows username page where nothing works

Edited by hknh, 30 July 2012 - 07:14 AM.

  • 0

#67
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
You must change the drive letters prior to running OTLPE, or the fix will not work. Please try again.
  • 0

#68
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Files\Folders moved on Reboot...
C:\Users\\Public\Videos folder moved successfully.
C:\Users\\Public\Pictures folder moved successfully.
C:\Users\\Public\Music folder moved successfully.
C:\Users\\Public\Favorites folder moved successfully.
C:\Users\\Public\Downloads folder moved successfully.
C:\Users\\Public\Documents folder moved successfully.
C:\Users\\Public\Desktop folder moved successfully.
C:\Users\\Public folder moved successfully.
C:\Users\\Default\Videos folder moved successfully.
C:\Users\\Default\Saved Games folder moved successfully.
C:\Users\\Default\Pictures folder moved successfully.
C:\Users\\Default\Music folder moved successfully.
C:\Users\\Default\Links folder moved successfully.
C:\Users\\Default\Favorites folder moved successfully.
C:\Users\\Default\Downloads folder moved successfully.
C:\Users\\Default\Documents folder moved successfully.
C:\Users\\Default\Desktop folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\Templates folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\Start Menu folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\SendTo folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\Recent folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows\Cookies folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft\Windows folder moved successfully.
C:\Users\\Default\AppData\Roaming\Microsoft folder moved successfully.
C:\Users\\Default\AppData\Roaming folder moved successfully.
C:\Users\\Default\AppData\Local\Temp folder moved successfully.
C:\Users\\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files folder moved successfully.
C:\Users\\Default\AppData\Local\Microsoft\Windows\History folder moved successfully.
C:\Users\\Default\AppData\Local\Microsoft\Windows\GameExplorer folder moved successfully.
C:\Users\\Default\AppData\Local\Microsoft\Windows folder moved successfully.
C:\Users\\Default\AppData\Local\Microsoft folder moved successfully.
C:\Users\\Default\AppData\Local folder moved successfully.
C:\Users\\Default\AppData folder moved successfully.
C:\Users\\Default folder moved successfully.
Folder move failed. C:\Users\ scheduled to be moved on reboot.

Registry entries deleted on Reboot...



Attached File  07312012_180929.log   5KB   64 downloads

I attemptd to boot in normal - goes back to windows error recover screen
  • 0

#69
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
I am sorry, but that was not what the fix called for. You have removed every user from that computer. Can you post the entire log? This is only part of it, and your username is missing.

Don't do anything. I will need to consult this with OTLPE developer to see if there is a way out.
  • 0

#70
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
Did I do something wrong? I followed your directions exactly. How did I screw it up?
  • 0

Advertisements


#71
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
I don't know how that got into a fix window, but it is not what the above fix called for. Something is clear, however, it is not the first time as there were no files in those folders.

Take a look at post 58 above.

You must make sure the Recovery partition becomes H and the OS partition becomes C. Any other combination of drive letters will produce a false report. Please try to perform another scan once again, but this time around paste the following in the custom scans window:

:files
Dir /a C:\ /c
Dir /a H:\ /c
Dir /a C:\users\ /s /c
Dir /a H:\users\ /s /c


Doubleclick on the Run Scan button and post the report.
  • 0

#72
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
If you have not ran the scan above, I edited the options.
  • 0

#73
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
in post 65, you said to make c=h and d=c, but my c=os and my recovery=d, so that was incorrect - I always want os=c and rec=h,right? - the last report would have made the c drive recovery- I have written down now that OS will always become c and recov will always become h



the first time I ran this, it stalled and I had to use ctrl+alt+del to stop the unrespnsive otple

the same thing happened the second time
  • 0

#74
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
I am having problems with my ISP, please expect delays.

I will check the drive with an active flag (bootable) for these folders, but the developer of OTLPE replied back to me, and returning those folders back will not be enough, as some of these are junctions (links) to other folders, and I don't even know how to begin to re-create those junctions.

Give some time to resolve the issues with my ISP, and I will get back to you.
  • 0

#75
hknh

hknh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 54 posts
ok - thank you
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP