Help required - explorer malfunctioning and all services stopped!!

Welcome to Major Geeks!

I recommend that you never let this friend near your PC again.

Most if not all of your required Windows system services have been broken. This may or may not be fixable. You can see what I mean by looking at the end of the HijackThis.log file inside of MGlogs.zip. I will give you something to try and we will go from there. You may want to think about backing up all personal data first.

First you need to get the current version of ComboFix saved to your Desktop since the one you have is out of date and we need the current version. Don't run it yet. We will run it in the below fix.

Why did you put the below files from MGtools in this location? You need to delete them now.

Code:

2009-11-23 06:17 . 2009-11-26 06:11 2385076 ----a-w- c:\documents and settings\Rupert Fletcher\MGtools.exe
2009-11-21 05:49 . 2009-11-26 06:11 6965 ----a-w- c:\documents and settings\Rupert Fletcher\GetLogs.Bat
2009-11-21 05:39 . 2009-11-26 06:11 92365 ----a-w- c:\documents and settings\Rupert Fletcher\SN64.bat
2009-11-21 05:25 . 2009-11-26 06:11 86888 ----a-w- c:\documents and settings\Rupert Fletcher\ShowNew.bat
2009-11-10 02:36 . 2009-11-26 06:11 3860 ----a-w- c:\documents and settings\Rupert Fletcher\MGclean.bat
2009-11-10 01:37 . 2009-11-26 06:11 6574 ----a-w- c:\documents and settings\Rupert Fletcher\FixPerm.bat
2009-10-27 07:50 . 2009-11-26 06:11 109070 ----a-w- c:\documents and settings\Rupert Fletcher\GetRunKey.bat
2009-10-27 07:50 . 2009-11-26 06:11 110282 ----a-w- c:\documents and settings\Rupert Fletcher\GRK64.bat
2009-09-11 05:37 . 2009-11-26 06:11 5841 ----a-w- c:\documents and settings\Rupert Fletcher\SysBU.bat

Now download and save this XPsp3bu.exe to your C:\ root folder. You must do this properly. Now run the XPsp2bu.exe program by double clicking on it. You may or may not notice a quick flash of a black window. This is normal. The program runs quickly and just extracts some files we need.


Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Possibly because however you ran it from a command prompt was incorrect. You need to use the full path to the CFScript.txt file. If you open a command prompt and then change directories so that you command prompt is showing your Desktop folder, you would need to enter the below with the quotes:


ComboFix "C:\Documents and Settings\Rupert Fletcher\Desktop\CFscript.txt"

 

Based on your logs, you are still in pretty bad shape. You could still be needing a reinstall as your system may not be stable. However let's finish with malware cleanup since you still have some.

You also still have a bunch of files for MGtools in your user acccount base folder which we will also remove since they don't belong there.


Please download and run Win32kDiag per the below instructions:

• Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
• Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log

C:\win32kdiag.exe -f -r


Now download Junction,zip to your Windows folder

• Please download Junction.zip and save it to your Windows folder (i.e, C:\Windows\Junction.zip This assumes C:\ is your Windows boot drive.)
• Now unzip it and put junction.exeinto the Windows folder (i.e., C:\Windows\junction.exe)
• Do not try to run it right now. We will run something that uses it later.

Now we need to reset the permissions altered by the malware on some files.

• Download and save inhertit.exe to your Desktop: Inherit.exe
• It must be in your Desktop or the below fix will not work!

Now run the C:\MGtools\FixPerm.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

• A command prompt window opens and also a license agreement from SysInternals will appear for Junction.
• Accept the license agreement and the scan will begin.
• Wait until it finishes we can take a while to run since it scans your whole harddisk. e patient and don't do anything else while it is scanning.
• The command prompt window should close when it finishes.
• While this is running, you will get several/many popups that have a title Finish and say OK. Just click the OK button each time. This is an indication that it has found a file and has attempted to fix permissions. Depending on how many files that need to be fixed, you could get only a few or many of these popups.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• the Win32kDiag log
• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay this looks much better. Now most of your service appear to be running again but you may still have some issues with Windows to work out in the Software Forum. Your HijackThis log shows your Windows Installer service is missing and that your network interface card service is missing. You will have to check these out in the Software Forum. You may need to reinstall them.

O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\WINDOWS\system32\msiexec.exe (file missing)
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

Fix it by doing the below.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

All issues you need to resolver in the Software Forum. When you broke all your system services, and were playing with Windows Installed, you may have messed some of these up. As stated above, your Installer service may be missing/broken.


Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!