AVG is gone, but can't run Combofix

Do you have your Windows CD? We may need it to replace those infected system files.

In the meantime, please follow these instructions and attach the requested logs>

READ & RUN ME FIRST. Malware Removal Guide

 

Let's do this:

Please use add/remove programs to uninstall:
Java(TM) 6 Update 18
Java(TM) 6 Update 4
Java(TM) 6 Update 7

Now let's try to use Combo.
* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\Documents and Settings\Sam\Application Data\F7D48A
C:\WINDOWS\usapusr.dll
C:\WINDOWS\awizuyosegefim.dll
C:\Documents and Settings\Sam\Local Settings\temp\7zS9.tmp
C:\Documents and Settings\Sam\Local Settings\temp\7zSAA.tmp

Folder::
C:\Documents and Settings\Sam\Templates\7vj5

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Vbeyuxawoda"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"Pwihonugi"=-

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now download and install:
Java Runtime 6

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop
Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

OK, let's try this again.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now see if Combo will run.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

 

Go ahead and run it anyway.

 

Did you ever answer me about having the Windows CD? If you have it, you need to boot to the bios and change the boot order to cd-rom as first boot device. Then boot to the CD and get into the Recovery console. Once there, do this:

Once you are back to the C:\Windows> prompt of the Recovery Console, input the below bold font commands one at a time each followed by the enter key.
copy D:\i386\explorer.ex_ explorer.exe
cd system32
copy D:\i386\winlogon.ex_ winlogon.exe
exit

Reboot to normal mode and tell me what issues you have.

 

Boot back into the recovery console. And at the C:\Windows> prompt enter the below commands.

cd system32
dir winlogon.*


What does the second command show? ( there is a space after the dir, also yes it says winlogon followed by a period and an asterisk )

 

The correct filesize for Win XP SP 3 is 507,904, What serice pack level was the CD you copied from? Seems likely to be very old based on the date.

In normal boot mode, copy the below file into the C:\Windows\system32 folder:

C:\MGtools\temp\winlogon.exemg

Then boot to the Recovery Console and run the below commands

cd system32
copy winlogon.exemg winlogon.exe
dir winlogon.*

Now what does the output from the last one show? Is it 507904 for size?

Try rebooting normally now.

 

You need to copy it while in normal Windows. You cannot access that folder from the Recovery Console. Sorry about that. Let me think

 

Let's see if the below copy will get your system bootable. Boot to the Recovery Console and enter the below commands.

cd system32
copy C:\WINDOWS\ServicePackFiles\i386\winlogon.exe winlogon.exe
dir winlogon.*

Now what does the output from the last one show? Is it 507904 for size?

Try rebooting normally now.

 

But you did not get the STOP error. Right? That is what we were fixing.

Now from the Recovery Console do the below to try and fix explorer. Note you do not want to use cd system32 this time. You need to be at the C:\windows> prompt.

copy C:\WINDOWS\ServicePackFiles\i386\explorer.exe explorer.exe
dir explorer.exe

Make sure the size of explorer.exe is 1033728

Then reboot.

 

Does it allow you to bypass the warning and run it anyway? Try safe boot mode if necessary.

 

Okay reinstall AVG if you still wish to use it, and see if it detects any problems.