W7 error %hs is missing

Discussion in 'Malware Help (A Specialist Will Reply)' started by KrystiGyrl, Mar 10, 2013.

  1. KrystiGyrl

    KrystiGyrl Private E-2

    Please help me. My laptop will not boot and is stuck in a reboot cycle
    I've done all I can on my own...startup repair, sys restore, memory diagnostic, and factory restore. Nothing would work completely and all eventually failed. Safe ode also fails

    Please help :cry:cry
     
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Choose your language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    To enter System Recovery Options by using Windows installation disc:

    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Choose your language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.
    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    • Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)
     
  3. KrystiGyrl

    KrystiGyrl Private E-2

    Thank you for your help.

    This is what was saved...
     

    Attached Files:

    Last edited by a moderator: Mar 15, 2013
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Sorry for the late response, it's due to the fact you posted the log inline as well as attaching it, the inline all got caught up in the forum spam filter and delayed me getting to see your reply... checking the log right now. :)
     
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Attached is fixlist.txt
    • Save fixlist.txt to your flash drive.
    • You should now have both fixlist.txt and FRST64.exe on your flash drive.

    Now re-enter System Recovery Options.
    Run FRST64 and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (How to attach)

    Now attempt to boot normally.

    -------------------------------


    Re-run FRST - no fix, just a scan and attach the log.
    Are you now able to complete any of these procedures? READ & RUN ME FIRST. Malware Removal Guide
     

    Attached Files:

  6. KrystiGyrl

    KrystiGyrl Private E-2

    sorry about that :-D

    here is the fix log

    Looks like it's working so far.

    Thank you so much!
     

    Attached Files:

  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

  8. KrystiGyrl

    KrystiGyrl Private E-2

    I was able to start the computer and can find old picture files, etc. I tried to run through the internet explorer fixes and run windows defender, it won't let me run it and says it's not there. So, I went to the security center and tried to turn it on and it's telling me my "windows security service center can't be started".

    I have also downloaded Explorer 10 as well. Should I continue through the other steps? Is there a good free virus scan? My McAfee is long expired.
     
  9. KrystiGyrl

    KrystiGyrl Private E-2

    I've attached the log from RogueKiller
     

    Attached Files:

  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes! :)
     
  11. KrystiGyrl

    KrystiGyrl Private E-2

    I completed all of the steps and attached the log from rogue killer in a previous entry.

    What's the next step.

    And thank you again for all of your help.
     
  12. KrystiGyrl

    KrystiGyrl Private E-2

    I figured I should probably specify the actions I have competed.

    I had downloaded the Microsoft Security Essentials, but read that the Microsoft firewall isn’t up to par. I’m replacing that with Comodo since it appears to be highly rated and contains the firewall as well…completing that right now. I also uninstalled the McAfee and Norton copies from my computer, as they were long expired.

    I didn’t have any disk emulation software running that I knew of, but ran the disable tool as well just incase. I downloaded the CCleaner and ran it.
    I then completed the windows-7 64 bit instructions for removal/cleaning: I downloaded rogue killer. I disabled user account control and have not enabled it back until you advise me to do so. I ran the rogue killer and attached the log in a prior entry.

    That’s where I stopped. Please advise what the next step will be.
     
  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I want to see logs from:
    • Malware Bytes
    • Hitman Pro
    • MGTools --> MGlogs.zip
     
  14. KrystiGyrl

    KrystiGyrl Private E-2

    Sorry it took me a few days. Thank you again for your help.
    here are the logs for all of the programs:
     

    Attached Files:

  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Download Cleano 0.61

    Download it to your desktop, Right click the cleano.exe file and run as admin > and place check marks in the boxes as follows (click on link below to see image)

    View attachment 148092
    Click clean now and exit the program.


    Delete this file: C:\Users\Gertrude\AppData\Roaming\Microsoft\Windows\Templates\10xys50bcb7283tosmj28rmjvv6nq51dpu1j25k4v53nrl


    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.

    After reboot, check to see if your firewall is working.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
  16. KrystiGyrl

    KrystiGyrl Private E-2

    Ran Clean-O
    deleted that file.
    Ran windows repair
    firewall says it's on
    Attached are the new logs from MGtools

    (should I be running all of this stuff on my external hard drive that was connected to this computer when it failed...I hope it's not too late to ask that)
     

    Attached Files:

  17. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Have the external pluged in and scan it with Malware Bytes. That should suffice. :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Press and hold the Windows key http://forums.majorgeeks.com/chaslang/images/Windows_Logo_key.gif and then press the letter R on your keyboard. This opens the Run dialog box.
      • Copy and paste the below into the Run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.
    8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  18. KrystiGyrl

    KrystiGyrl Private E-2

    No malicious activity on the external drive. I attached the log incase you need it for some reason. (I ran the full scan)

    .......

    1. I will keep malwarebytes
    2. I don't believe combofix was one of the programs recommended to me, but I did go in and hide the hidden files again.
    3. I re-enabled the emulation files (do I need to delete/uninstall disk defogger?)?
    4. I couldn't find hijack this on my program list.
    5. Successfully added to registry.
    6. Completed.
    7. I don't believe I downloaded either of these
    8. I've left malware bytes, ccleaner, and comodo (is this ok/recommended)?
    9. Done.
    10. about to restart from #9 and will complete #10 when successfully restarted and restore point is successfully created...
     

    Attached Files:

  19. KrystiGyrl

    KrystiGyrl Private E-2

    i found Cleano and all of the logs still on my desktop. can I just delete them all?
     
  20. KrystiGyrl

    KrystiGyrl Private E-2

    From step #10 I did the following:
    1. All updates installed except "Bing"
    2. I kept Comodo antivirus and reactivated it.
    3. I downloaded the Comodo firewall, but it says the installation doesn't support the target platform.
    4. I have the Ccleaner
    5. See 3 above...I'd prefer to keep Comodo for AV & firewall, but let me know if that won't be possible due to the error.
    6. I couldn't find the following two options (and I looked a few times from beginning to end)...Set Installation of desktop items to Prompt and Set Allow paste operations via script to Disable
    7. I installed a backup browser
    8. I removed old versions and downloaded the most recent of Java.
    9. I didn't see Windows 7 on the list of versions, so I did not complete this step. Should I? or is this automatically disabled in Windows 7?
    10 - 15 - I read through the rest of the tips.

    Let me know if there is anything else I need to do (I guess I just need to know what to do about the Comodo firewall not installing...should I just choose another one instead?)

    Also, can you tell me what happened to the computer or where/how it got infected?

    And again, thank you so much for all of your help. I wasn't able to get to everything this week as it's a busy time of year at my job, but thank you for being patient with me.:)
     
  21. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Only if you do not use it.
    That's fine ;)

    Yes. Or ask about it in the software forum. :)

    No idea I'm sorry.
     
  22. KrystiGyrl

    KrystiGyrl Private E-2

    Ok. I got private firewall.

    Is that all?
     
  23. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Do you need any help with anything else at all?
     
  24. KrystiGyrl

    KrystiGyrl Private E-2

    That is all. Everything is working well.

    Thank you much!!!:)
     
  25. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You're most welcome. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds