[dpends]

Windows loads. After that "Start" will not start. The hour glass will not turn off. I have tried smitRem (it did get me back to a blue screen). Now the whole truth is that the computer is infected with malware (SpySheriff) to be specific. True the post should be under Malware. All of the advice there is to run various programs to rid the computer of spyware etc. etc.. NO argument BUT I cannot get windowsxp to operate in order to do any of the things recommended, thus the reason for posting here.
I have tried running from taskmanager with all of the programs on cd but they get started on the setup process and then stop mid way through. The only one that ran was smitrem and then ccleaner to a point and then it stopped (about 2 dashes from the end).
Can anyone help
Thanks

[Advertisements]

did you try booting into safe mode by tapping the f8 key during boot up (once a second until you get a menu)

[gerryf]

did you try booting into safe mode by tapping the f8 key during boot up (once a second until you get a menu)

[dpends]

Yes. I have tried safe mode a number of different times. Exactly the same problem.

[dpends]

gerryf,
I should have added that this problem is on my desk computer thus i am writing to "geekstogo" on another computer hoping for some assistance before resorting to a reformat.

[gerryf]

you have multiple topics running here and seem to be partially following some directions but not others.

The most important quality in troubleshooting/fixing PCs is patience....throwing everything at a problem and hoping it sticks will cause issuses like this....I need more information now.

Let's start with how you know it is spysherrif

[Retired Tech]

If you can tie this down to recently

How to Start the System Restore tool at a command prompt

1. Restart your computer, and then press F8 during the initial startup to start your computer in Safe Mode with a command prompt.

2. Log on to your computer with an administrator account or with an account that has administrator credentials.

3. Type the following command at a command prompt, and then press ENTER:

%systemroot%\system32\restore\rstrui.exe

4. Follow the instructions that appear on the screen to restore your computer to an earlier state.

For additional information about the Safe mode with a command prompt, click the following article number to view the article in the Microsoft Knowledge Base:

A description of the Safe mode boot options in Windows XP

http://support.micro....com/kb/315222/




If you cannot tie this down to recently

Please go here to repair your operating system

Repair XP

If you are unable to run Repair XP

Alternate XP Repair Guide

Use the last one - Windows Installation CD to repair the current installation, which uses a slightly different method

Windows XP repair feature won't delete your data, installed programs, personal information, or settings. It just repairs the operating system

After running the repair it will be necessary to install all Windows Updates


When it is repaired and and before you update, you can run these to check everything is as it should be

Click start, all programmes, accessories, system tools to run disc clean up, then from system tools, run disc defragmenter.

Click start then run, type prefetch then press enter, click edit then select all, right click any file, click delete, confirm delete then reboot

Click start then run, type sfc /scannow then press enter, you need the XP CD and get a blue progress bar, after the bar goes, reboot.

Click start then run, type chkdsk /f /r then press enter, type Y to confirm for next boot, press enter then reboot.

This will take an hour, it will appear to load normally then either the monitor will show progress or the screen will go blank, do not disturb this.

When it gets to the desktop, the system files and the hard drive will be as they should

Run the updates then

Please go here: Malware Removal Guide

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

If you are unable to run any of the programmes, ask for advice in the Malware Forum

[dpends]

It has "announced itself on screen". It has put an icon on the desktop as well as the taskbar and it has "run a spyware cleaning" of its own. I tried both spybot (which was on the system) and ccleaner(again then on the system) then shut down (stupid) and restarted. At that point nothing would work. I then tried safemode. NO luck. I tried smitRem (which was advised on the Malware forum) It got back to the blue screen from the white. Sitll no programs will run from icons nor is it possible to get into the start menu ... itjust hangs with the hour glass running.
BTW thanks for taking the time

[gerryf]

I took a look at the program that ran...quite the script.

I need you to reboot, but this time choose safe mode command prompt.

This will bring you to a prompt that looks like this:

c:\documents and settings\{profile}>

type the following exactly

cd \ (note space)

cd windows <enter>

cd system32 <enter>

cd dllcache <enter>

dir wininit.dll <enter>

Is the file found? What is the size and date of the file?

[dpends]

I have started the processes in the above post and will come back on line here when it has finished. System Restore has started form command prompt and files are being loaded. From there I will let you know. For taking the time thus far guys, much thanks.
This has been an exasperating last 2.5 days working on this. I have learned to really hate "malware'

[dpends]

Gerry,
I just had system restore finish and windows opened and I can now get the start run area to open. Should I still go ahead with the above instructions ie cd cd \windows etc.
I will have to go away from the computer for about 2 hours and will look for your reply then
Thanks
and I will go to the Malware section in any case

[gerryf]

no, no need

I was going to have yo manually copy a copy of winnet.dll over the one that spysheriff likely messed up...the repair process repplaced it.

Please visit Windows Update now, but also you may need to check for other malware, so run a few detectors

[dpends]

Just got back Gerry,
Will do the Windows Updates and then go through the whole malware process ad-awarese, spybot cwshredder etc.
So far so good