Getting through Malware info

Discussion in 'Malware Help (A Specialist Will Reply)' started by cyberchick, Jan 23, 2011.

  1. cyberchick

    cyberchick Private First Class

    Hi,
    I am trying to help re-computer running Win 2000 professional sp4, after downloading free music this pc will not load, and we can only get into safe mode.
    Having read the info "Read me first" I need to find " How to check for a 32-bit or 64-bit version of Windows" but can't find out how to do this on win 2000 in safe mode.
    Also how to "view hidden files,system folders etc"

    Help appreciated have been on site recommended but cant find it.



    Thanks :confused
     
    cyberchick, Jan 23, 2011
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    ??????

    You can simply look to see if you have folders names like below. If you do not see them then you are not running a 64 bit version.

    C:\Program Files (x86)
    C:\Windows\SysWOW64 or C:\Winnt\SysWOW64

    The instructions are in the READ & RUN ME.
     
    chaslang, Jan 23, 2011
    #2
  3. cyberchick

    cyberchick Private First Class

    Many thanks, :) I will continue to work through the read me and hopefully we can get the pc up and running :wave
     
    cyberchick, Jan 24, 2011
    #3
  4. cyberchick

    cyberchick Private First Class

    Hi,
    Downloaded and read the read me carried out the removal, I will attach the logs and hopefully explain what I have done.

    The SuperAntiSpyware found no errors so no log
    When I tried to run the Combo fix I had this error
    "n.pif-entry point not found. The procedure entry point WTS GetActiveConsoleSession could not be located in the dynamic link library kernal 32.dll"
    I closed this message then got
    ""iexplore.exe-Entry Point not found."


    I continued to MGTools program and started to run program, screen came up asking for RoxioCD Creater 6 disk which I put in.
    MGTools then ran.

    I thought I would try the Combo fix again which then ran.
    I have added all the files (I hope).

    Program called imesh seems to have caused the problem.
    After going through the malware removal I can still only access pc through safe mode, when I try to log on normal mode a blue screen appears which says

    "STOP c000026c (unable to load device)\??\c:\program files\Avira\Antivirus Desktop avgio.sys.device driver could not be loaded
    error status was 0x0000034"



    PC will not connect to the internet, hope this makes sense:confused
     

    Attached Files:

    cyberchick, Jan 24, 2011
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You don't appear to be having malware problems, but let's get rid of the iMesh junk you installed and see if this helps at all. Look in Add/Remove Programs and uninstall each of the below if found:

    iMesh
    MediaBar

    Now just incase iMesh leaves and junk around, let's force a cleanup by doing the below.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jan 24, 2011
    #5
  6. cyberchick

    cyberchick Private First Class

    Firstly thanks for the help its appreciated.

    Files attached as requested, tried to start pc normally but the same blue screen as before.

    "STOP c000026c (unable to load device)\??\c:\program files\Avira\Antivirus Desktop avgio.sys.device driver could not be loaded
    error status was 0x0000034"


    PC will still only load in Safe Mode, will await your input
     

    Attached Files:

    Last edited: Jan 25, 2011
    cyberchick, Jan 25, 2011
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looks like you did not use Add/Remove Programs to uninstall iMesh and Mediabar first as I requested. I see them. Did you not see them installed?

    Uninstall Avira and then try to boot normally.
     
    chaslang, Jan 25, 2011
    #7
  8. cyberchick

    cyberchick Private First Class

    Hi.
    No only the media one was on the add remove programs, I took that off when doing the house cleaning section (think bro had messed with imesh before me)will try and uninstall the Avira
     
    cyberchick, Jan 25, 2011
    #8
  9. cyberchick

    cyberchick Private First Class

    Logged on in safe mode, went into control panel add/remove programs, clicked on Avira Antivirus got this message

    "AviraAntiVirus Personal requires at least Windows 2000 S P4 and update rollup 1"


    The system on pc is win2000 professional p4!

    Could not remove the antivirus software, any thoughts?
     
    cyberchick, Jan 25, 2011
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Jan 25, 2011
    #10
  11. cyberchick

    cyberchick Private First Class

    Downloaded update as suggested, we can now start in normal mode,but two error messages.

    "msiexe Ordinal not found" " the ordinal 240 could not be located in the dynamic link library msi dll"
    AND
    "Adobe ARM.exe could not be found" "the ordinal 228 could not be located in the link library"

    When trying to open Outlook Express "Could not be started because MSOE dll could not be loaded.
    Must say that the pc seems slow after initial start up

    When I first started up the pc connected to the internet and updated the antivirus software automatically and without problem, so it seems as if some programs are not loading I wondered if this has anything to do with the missing above files ??

    Hope you have further advice.
     
    cyberchick, Jan 26, 2011
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    None of these are issues for the malware forum and per my earlier comment, you are not having malware problems. Thus you would be best served by posting in the Software Forum.


    Since you are not having malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jan 27, 2011
    #12
  13. cyberchick

    cyberchick Private First Class

    Thank you Chaslang for your time and help, I will post in the software section and hope that this issue can be resolved.
     
    cyberchick, Jan 28, 2011
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Jan 28, 2011
    #14

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds