XP Internet Security 2012

Other than needing to clean out your temp folders, use windows explorer to find and delete:
C:\Documents and Settings\All Users\Application Data\528OK2x8V.dat

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Please also download MBRCheck to your desktop.

See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

 

Do you have your XP installation disc? If so, please boot into the bios and set your boot order to CD/DVD as first boot device. Put in the disc and reboot. Hit enter to boot to the disc, then go to the Recovery Console and type this:
fixmbr

Exit, and boot to normal mode, then re-run MBRCheck and attach the new log.

 

Please go into the control panel / admin tools / disc management and get me a screen shot of your partitions. I think you have a faked partition:

Code:

Partition    Disk #0, Partition #2    
Partition Size    8.72 MB (9,143,808 bytes)

 

Preferably from a clean computer, I need you to download: gparted-live-0.10.0-3.iso (115.1 MB)
Windows XP Recovery Console rc.iso

Create a bootable CD, 1 for Gparted and 1 for the Windows XP Recovery Console, from the ISO images. You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

http://img829.imageshack.us/img829/5772/gpartedsplash.th.png
You should be here...
Press ENTER

http://img5.imageshack.us/img5/7286/gpartedkeymaps.th.png
By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.

http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png
Choose your language and press ENTER. English is default [33]

http://img140.imageshack.us/img140/7958/gpartedgui.th.png
Once again, at this prompt, press ENTER

You will now be taken to the main GUI screen below
http://img32.imageshack.us/img32/1122/gpartedo.th.png
According to your logs, the partition that you want to delete is Partition Size 8.72 MB (9,143,808 bytes)
Click the trash can icon to delete and then click Apply.

You should now be here confirming your actions:
http://img233.imageshack.us/img233/1533/gpartedsteps.th.png

Now you should be here:
http://img696.imageshack.us/img696/8471/gpartedsuccessclose.th.png

http://img194.imageshack.us/img194/7753/gpartedboot.th.png
Is "boot" next to your OS drive?

If "boot" is not next to your OS drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:
http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png

Now double-click the http://img822.imageshack.us/img822/641/gpartedexit.png button.

You should receive a small pop up like this:
http://img88.imageshack.us/img88/8986/gpartedexitreboot.png
Choose reboot and then press OK.

Now reboot from the Windows XP Recovery Console CD and execute the following commands:

• fixmbr \Device\HardDisk0
• fixboot c:
• exit

Once back in Windows.

Download MBRCheck.exe to your desktop.

• Be sure to disable your security programs
• Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
• A window will open on your desktop
• if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
• If nothing unusual is found just press Enter
• A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
• Attach that file.

 

Please download and save the below tool from Grinler @ bleepingcomputer to your Desktop or anywhere else you can find it ( if the Desktop is not showing )

http://download.bleepingcomputer.com/grinler/unhide.exe

Now run it. Now see if you can find the items that seemed to be missing ( like shortcuts, Start Programs... etc )?



Now download The Avenger by Swandog46, and save it to your Desktop.
See the download links under this icon http://www.majorgeeks.com/images/dll.gif

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.
Run MGtools.exe ( Note: If using Vista or Win7 make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Did running unhide restore your shortcuts and programs list?

 

If I ask you to uninstall TrendMicro, do you have the software to reinstall it again later. It could be getting in our way and also it could have been corrupted by the malware.


Download HostsXpert and then follow the below steps.

• Unzip HostsXpert.zip
• It will create a folder named HostsXpert in whatever folder you extract it to.
• Run HostsXpert.exe by double clicking on it.
• Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
• Click Restore Microsoft's Hosts File and then click OK.
• Click the X to exit the program

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now. Some of these items we are fixing are just unnecessary startups which are slowing your PC down.

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mwavscan_autoscan] "C:\DOCUME~1\NSCAFF~1.TDT\LOCALS~1\Temp\mexetmp.ex~" /s /AUTORUNBOOT
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [GBWXufOsmTrrX.exe] C:\Documents and Settings\All Users\Application Data\GBWXufOsmTrrX.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.
After clicking Fix, exit HJT.


Now run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below old versions of software:
Java(TM) 6 Update 20

• Run avenger.exe again by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Happy New Year.

Download the below file to your Desktop. ( use another PC to put it on a flash drive if necessary and copy to this PC ). Once saved on your Desktop, Right click on it and select Install

EXEfix

Then see if you can run EXE files.

 

Apparently you are missing some Windows system files. The grpconv.exe file should be in your c:\windows\system32 folder but it is missing. Do you see a copy of grpconv.exe in C:\windows\system32\dllcache


Seems you have quite a few problems.

 

It's possible but I have never seen this file deleted by a virus.

Do you have an i386 folder on your PC? Either C:\i386 or possibly somewhere else like as a subfolder somewhere under the C:\Windows folder?

Do you have your Windows XP boot CD?

 

Okay so then copy this file to C:\Windows\system32

Once you have it copied, see it you can run the EXEfix

 

Try selecting the grpconv.exe program itself.

 

If you boot in Safe Mode or Safe Mode with Command Prompt, can you run anything. In command prompt mode there will just be a black command prompt Window. Just type in regedit and see it the Windows Registry Editor opens.

Also in the command prompt, type the below and tell me what happens for each

cd c:\mgtools

fixfa.bat

getlogs.bat

 

How are you trying to change it if you cannot boot up the PC?

Also which user account are you trying to log into? You logs had shown that someone enabled the Guest account with administrator priviledges. While this is a very bad idea, can you logon to the Guest account. It may not have a password.

Your logs showed the below accounts

Code:

Is Admin? | Username
------------------
   Yes    | Administrator
   Yes    | Guest

 

Okay so you can run programs now in safe mode.

Have you attempted to run them in normal boot mode?

 

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [dplaysvr] %APPDATA%\dplaysvr.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [dplaysvr] %APPDATA%\dplaysvr.exe (User 'SYSTEM')

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now try rebooting in normal boot mode. If that works, then get the new MGtools log below in normal mode. If you still cannot run in normal mode, get the new MGtools log in safe mode.


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

When you boot in safe mode, are you using Safe Mode with Networking or just Safe Mode? Looks like plain old Safe Mode to me. It would be better if you used Safe Mode with Networking.

While in Safe Mode, run MSconfig and choose Selective Startup. Then goto the Services tab and first check the Hide all Microsoft Service box at the bottom. Then disable all remaining services you see. Then click Apply and OK. Then reboot and see if you can run in Normal Boot Mode.

 

Please answer each of the below questions:

1. When you boot up in safe mode, are you using the Guest user account?
2. When you boot in normal boot mode, which account name are you logging in with?
3. When you boot in normal boot mode is anything functional at all?
4. In normal mode, can click the Start button and select Run and can you type regedit.exe and click OK to bring up the Registry Editor? Describe what happens when you try this.
5. Run MSconfig again and select Diagnostic Startup then click Apply, OK, then reboot in normal mode. Can you run anything this way??? You will not be able to do too much in this mode since many services and drivers will be disabled. We just want to test if anything can run at all.

 

In addition to answering the questions in my last message, work thru the below.



Now download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

• Now open Repair_Windows.exe
• Go to Start Repairs tab.
• Choose "Custom Mode" and press "Start".
• Create a System Restore point if prompted.
• In the Custom Mode window, select the following repair options:
  • Reset Registry Permissions
  • Register System Files
  • Repair WMI
  • Remove Policies Set By Infections
  • Repair Winsock & DNS Cache
  • Repair Proxy Settings
  • Repair Windows Updates
• Now click the Start button.
• Be patient while the tool repairs the selected items.
• If asked to reboot the computer for the changes to take affect, make sure other tasks in the program are not still running before accepting to restart.

Please download and save MiniRegTool.zip to your Desktop and unzip it. It will default to creating a MiniRegTool folder with the executable program in it.

• Run the MiniRegTool.exe program
• Copy and paste the following into the white box:

HKEY_CLASSES_ROOT\.exe

HKEY_CLASSES_ROOT\exefile
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft

• Click the Export Keys radio button.
• Press Go button and attach the Result.txt that pops up. A copy of Result.txt will be saved in the same directory the tool is run.

 

Seems there are still some issues in the registry.

Now copy the bold text below to notepad. Save it as fixEXE.reg to your desktop. Be sure the "Save as" type is set to "all files". Just save it. Don't do anything else with it until I ask later.

In safe boot mode, can click the Start button and select Run type regedit.exe and click OK to bring up the Registry Editor?

• The click File, Import
• Navigate to the fixEXE.reg file saved above to your desktop and either double click it or select it and click open.
• Allow it to be added to the registry.
• Then if the above works without any errors, reboot your PC in normal boot mode and see if you can run programs.

 

Okay please do the below again so I can make sure the registry changes actually took:

• Run the MiniRegTool.exe program
• Copy and paste the following into the white box:

HKEY_CLASSES_ROOT\.exe
HKEY_CLASSES_ROOT\exefile

• Click the Export Keys radio button.
• Press Go button and attach the Result.txt that pops up. A copy of Result.txt will be saved in the same directory the tool is run.

 

Well from the safe mode logs, we cannot find any more infetions. This is why we need to boot into normal mode to run scans. Since you still cannot do this, it seems likely there are problems within Windows itself. Let's see if an update to Windows XP SP3 will help. Hopefully it can install in safe mode.

Download this >> http://www.microsoft.com/download/en/details.aspx?id=24

See if you can install it. If i installs properly, then reboot afterwards and see if there is any improvement. If not then it is looking like you may need to reinstall..... although possibly an inplace repair install may work.