Virus gone so is Windows explorer...

[ranter]

Ok so i'm writing this on my laptop since my main PC had had the "Anti-malware Doctor" virus.
I rebooted, into safe mode, and i had a black screen then. so i opened task manager ran rkill, then malware bytes. first a quick scan and rebooted.
Then i plugged my internet back in updated malware bytes to it's latest version.
still all in safe mode i did a full scan. removed everything that it had found.

I thought i had it all covered but when i rebooted again and went into normal startup. i get the login screen and after logging on it takes very long till it's passed by the welcome screen then it's just pure black with only my cursor.and it sometime's says that windows explorer.exe can't be found/opened. and if i would like to send a message to microsoft, wich i do but prolly never does something.

Anyway's i can run task manager and i went into regedit and onto the HKEY-LOCAL-MACHINE thingy to change the SHELL string and rebooted but it didn't do much.

Now i know i can still put alot of stuff on my HD (dunno about a backup though) and then reinstall, but the thing is that i have alot of music i produced on it with certain configurations that i just can't afford to lose.

So that's the story if you guys need more indo then please ask away and i can see what i can do!
Thanks in advance!

 

[tom982]

Ok so i'm writing this on my laptop since my main PC had had the "Anti-malware Doctor" virus.
I rebooted, into safe mode, and i had a black screen then. so i opened task manager ran rkill, then malware bytes. first a quick scan and rebooted.
Then i plugged my internet back in updated malware bytes to it's latest version.
still all in safe mode i did a full scan. removed everything that it had found.

I thought i had it all covered but when i rebooted again and went into normal startup. i get the login screen and after logging on it takes very long till it's passed by the welcome screen then it's just pure black with only my cursor.and it sometime's says that windows explorer.exe can't be found/opened. and if i would like to send a message to microsoft, wich i do but prolly never does something.

Anyway's i can run task manager and i went into regedit and onto the HKEY-LOCAL-MACHINE thingy to change the SHELL string and rebooted but it didn't do much.

Now i know i can still put alot of stuff on my HD (dunno about a backup though) and then reinstall, but the thing is that i have alot of music i produced on it with certain configurations that i just can't afford to lose.

So that's the story if you guys need more indo then please ask away and i can see what i can do!
Thanks in advance!

Hello ranter and welcome to the forums

Do you have a vista installation disc, or do you know anyone who would be willing to lend you one for an hour or so?

Tom

 

[ranter]

Hello ranter and welcome to the forums

Do you have a vista installation disc, or do you know anyone who would be willing to lend you one for an hour or so?

Tom

I can try to look for one, can i just repair it with that ?

Thanks!

 

[tom982]

Hello ranter and welcome to the forums

Do you have a vista installation disc, or do you know anyone who would be willing to lend you one for an hour or so?

Tom

I can try to look for one, can i just repair it with that ?

Thanks!

Yes, you can do a repair installation from that disc. I will send you a link to the tutorial if you can get your hands on a disc.

Tom

 

[ranter]

Okay so i couldn't find a vista installation disc anywhere 'cause it seems that noone gets one these days with their computers.

So i finally looked for one online, i had it burned on cd with poweriso and the rebooted it with that.

All went great and i even got to the system restore but now it says that there aren't any startup problems while there definitley is something wrong with Windows Explorer.

So i still could use some help!

 

[Shadowjk]

Were did you get this ISO?

If you got it for free then you have broken the Law

 

[ranter]

Were did you get this ISO?

If you got it for free then you have broken the Law

How is it stealing ? i recently asked the shop where i bought it, and they told me that fujitsu siemens send the discs for free when under warranty.
Since i bought the PC in January, that means i'm pretty much fully legal to have downloaded the repair disc, it's not the installation disc itself ofcourse.

 

[Shadowjk]

Ok I am Just Clarifying that for you may have downloaded The Installation Disk from the Internet for Free which is an Crime

It is this forums Policy to not Help others in any Criminal act or scheme

Many Thanks,
Josh

 

[Lorien]

If it's just a repair disk and not an installation disk, it won't do what Shadow had in mind. That requires a genuine Vista Installation disk of the same bit-size as on your computer - nothing else will work for a system repair/upgrade.

What are the options available on this repair disk (and where did you get it - the full web address please)? Please list EVERY available option there - so we'll know the alternatives. We may ask you to make a different disk if it doesn't have everything we want to check (or it may do just fine).

If it is just a repair disk and not an installation disk, you are fine legally. Repair or Recovery disks are readily available for free and perfectly acceptable. From what you posted, it did sound like you downloaded a Vista Installation Disk and while I'm not 100% certain about the legalities (since the disks aren't copywrited and it would be perfectly acceptable for you to make a copy of one you borrowed to keep for yourself - but downloading one off the web is another thing entirely especially if it comes with a keygen or something similar - then it would be unquestionably illegal), many places that do this are dangerous and the chances of getting a bad copy or a copy that won't come up as genuine or authenticate even with your valid Product Key or of getting infected by malware either through the download or embedded in the download is much too risky. And as Shadow said, we will not assist people who we know to be breaking the law and most certainly won't help them in doing so - and I don't need Forum rules for that, I wouldn't do it even if it were private and offline.

So, let us know the options on the disk and we'll go from there. Also, you said you could boot to Safe Mode. Can you boot to Safe Mode with Networking and connect to the internet?

Once we have these answers, the next post (at least from me) might be quite long and perhaps a bit intimidating because of that. Don't be concerned. I'm just covering all the bases at once instead of giving them to you in a wave of separate posts. But you'll see when the time comes.

For now, we need to know about that disk (all the questions asked above including where it came from). I may want to make my own copy to see what it's all about or recommend an alternative we're more familiar with.

We await your reply.

Thanks and good luck!

P.S. I know I keep editing this post (as I often do), but I just upgraded to IE9 and if I use the Edit reason box to indicate the editing and the reason for it, IE immediately crashes and then restores the tab but I lose what I wrote and sometimes it doesn't restore the tab but closes - so until that's resolved I can't identify edits.

 

[Shadowjk]

For a Repair disk you usually have

1. System Restore
2. Test Memory
3. Open Command Prompt
4. Startup Repair

EDIT: You also have a Complete PC Restore option (Restore form a Backup)

Hope this Helps Lorien,
Josh

 

[ranter]

Windows Vista Recovery Disc Download — The NeoSmart Files

Is the site where i got it, it seemed pretty legit and again, it's not the installation disc.

The options i have on the disc when booted are:
Startup repair (wich i've tried already but he "couldn't find any problems"
System Restore - havn't tried it yet.
Windows complete restore - wich doesn't work since the backups where deleted by the virus.
Windows memory diagnostics tool - Not tried yet, but i'm guessing he can't find it either.
Command prompt.

Those are the options on it.

Also, you said you could boot to Safe Mode. Can you boot to Safe Mode with Networking and connect to the internet?

Well the strange thing i believe is that everything works perfectly but for the windows explorer wich might be gone or corrupted. but thats my guess.

So yeah i can even go into the normal mode, open up task manager and then go to the internet.


P.s. if the link is wrong then please tell me i don't want to do anything illegal but the place where i bought the computer said it was alright aslong as it wasn't the installation disc wich it ain't!

Thank you for your time in helping me! i really appreciate that!

 

[Shadowjk]

I think you need to do an SFC /scannow or Repair Install for Vista

This is a Repair which only repairs Certain Modules You need an Installation Disk Form Somebody You know or Buy one

see http://www.vistax64.com/tutorials/88236-repair-install-vista.html For more Information

Hope This Helps,
Josh

 

[Lorien]

I realize this seems like a lot, but most are relatively easy to do and many can be done in the background while you do other things. Yes, it will take a while, but it's the only way to identify the cause and potentially resolve the problem. It may be one of the earlier options or it may require going all the way to the end, but if it's a software problem with Vista (as seems to be the case), then something here is going to eventually work. While it may seem like a lot of effort, I'm trying to save you from needing to do a complete clean re-installation which is, at the moment, the only other alternative (and I'm not even sure how you would go about that without a Vista Installation disk - do you have disks from the manufacturer or a recovery partition to restore the computer to factory-original condition?).


Do you know when this problem began? Try a System Restore to a point in time BEFORE the problem began. Here's the procedure: http://www.vistax64.com/tutorials/76905-system-restore-how.html. Be sure to check the box to show more than 5 days of restore points. If the first attempt fails, then try an earlier point or two. NOTE: You will have to re-install any software and updates you installed between now and the restore point, but you can use Windows Update for the updates. Use the recovery disk if the system prompt doesn’t work. The recovery disk works a bit different from the above procedures but if you follow the prompts from the System Restore menu option with the above information you should be able to restore with no problems.


If the System Restore doesn't work, do a Startup Repair by booting to the genuine Windows Vista Installation Disk (or one you can borrow from ANYONE) or from a Recovery Disk with recovery options included on it. Here's the procedure: http://www.vistax64.com/tutorials/91467-startup-repair.html. To boot to the CD you may need to change the BIOS to make the CD-drive first in the boot sequence. To do that, wait for the screen that tells you the F key to push to access the boot menu or boot setup. Push it quickly. Make the changes, save your work, and exit. Put the CD in the drive and reboot. When prompted, push any key to boot from the CD.

If that doesn't work, try to boot into safe mode (repeatedly click the F8 key while booting and go to safe mode with networking – or do so from the command prompt on the disk). Then let's check some of your system files:

Go to Start / All Programs / Accessories / Command prompt and right click on command prompt and click run as Administrator (you can skip this step if using the disk).

If using the disk, cd to C:\Windows\System32. Type sfc /scannow and enter and let it run. It will scan and try to fix some of your system files. Hopefully it will complete with no corruption it could not repair (if there is such corruption post back here or try to analyze it to find the problem file(s) using http://support.microsoft.com/kb/928228. Try to attach the report (you may need to copy it to your desktop before it will permit you to attach it) here so we can see if they can be repaired with good copies from the installation disk (if we can find one and unless there are too many).


While in Command Prompt, type chkdsk /f /r and enter and let it run. It will want to schedule itself to run at the next restart. Answer yes and then reboot to run the program. It will scan and try to fix any corruption or bad sectors on your hard drive and mostly remove that as a potential cause.


If that doesn't work, then please post the details of any error messages from the Event Viewer concerning startup or explorer.exe (Start / Control Panel / Administrative Tools / Event Viewer). Here's how to use Event Viewer: http://www.petri.co.il/vista-event-viewer.htm. Look in the System section.


You may be infected with malware. Try to run anti-malware programs (in safe mode with networking if necessary). To fix this problem (if it is a problem) download, install, and run the following two programs: http://www.malwarebytes.org/mbam.php and http://www.safer-networking.org/en/index.html. You may also want to try a free trial of Pandasoft (http://www.pandasecurity.com/usa/homeusers/solutions/global-protection/). Before downloading pandasoft, uninstall whatever anti-virus program you are currently using (because installing and running two at the same time can cause conflicts, freezes, and all sorts of problems). Use removal tools when appropriate http://www.raymond.cc/blog/archives/2009/05/05/comprehensive-list-of-uninstallers-or-removal-tools-for-antivirus-software/. Once you've uninstalled your current AV program, download, install, update, and scan using Pandasoft. I think you might be amazed at how much it finds that the other software missed. Once complete, uninstall pandasoft and re-install your current AV program (unless you decide to switch which I did when I first tried it about 4 years ago). You may also want to try the new, free Microsoft Security Essentials http://www.softpedia.com/progDownload/Microsoft-Security-Essentials-Download-131683.html (with the same caveat that only ONE AV program can be installed and running on your system at any one time). You may also want to try the free Avira at: http://www.free-av.com/ and Avast at: http://www.avast.com/index. Reboot after completing all the scans. You may also want to try the free OneCare at http://onecare.live.com/site/en-us/center/whatsnew.htm and let it run all the options (except the registry cleaner) because that’s good maintenance (it will take some time to complete but can be done in the background).


If that doesn't work, try a clean boot http://support.microsoft.com/kb/929135. If the problem goes away then it's just a matter of tracking down the culprit causing the problem. Follow the procedures in the article. Once found, delete, remove, deactivate, or uninstall it. Once done be sure to reset Vista back to normal status as explained in the procedures. If the problem occurs in clean mode then just restore the system to normal status and reboot - this solution is not going to work.


If that doesn't work, login as another user (if you have one) and see if it has the same problem. If not or if so, create a new user (preferably an administrator) and see if that user has the problem. If they both have the problem, then go to the next step. If only your user account has the problem, then it may be corrupt. To fix this use http://windows.microsoft.com/en-AU/windows-vista/Fix-a-corrupted-user-profile.


If that doesn't work, we'll need to do a system repair/upgrade using the genuine Windows Vista Installation Disk (one you own or one you can borrow from ANYONE - this is pretty much the last hope before a clean install, so if there's any possible way to borrow a disk from a friend, neighbor, co-worker, someone at the office or the office of any of the above, an acquaintance, a computer kiosk where they may have disks and be willing to let you borrow one for a fee or for buying a cup of coffee, or maybe even a computer repair shop or private technician that might be willing to lend out a copy for a small fee - any legal way poasible). To do this you have to also be able to boot normally. Here's the procedure: http://www.vistax64.com/tutorials/88236-repair-install-vista.html. Although this will not affect your data, settings, or programs, you should still backup your data before starting just to be on the safe side. You may have a lot of updates to re-install (including any service packs you had to remove). If the version on the system came with SP1 or SP2 pre-installed and the disk is an earlier version, then you'll need to make a slipstream disk as follows: http://www.vistax64.com/tutorials/151606-vista-sp1-slipstream-installation-dvd.html. Please reply before doing the next step as it is a radical option and I’d like to make sure we’ve ruled out all other options before taking that step. Include the results of everything you tried and attach copies of any logs generated or post the results directly. In effect, tell us exactly and completely what happened so we can see if any hints at something less radical than what otherwise remains is possible.


If that doesn't work (or you don’t have the disk), then I'm afraid the only option is a clean install. You can use Knoppix http://www.knopper.net/knoppix/index-en.html with a good ISO copier like: http://isorecorder.alexfeinman.com/isorecorder.htm along with a blank CD. This should give you enough access to the system (if you can't get in any other way - but I don't think it will be necessary here as you should be able to backup normally) to backup your important data (so your data will be preserved but nothing else - no programs, settings or anything else). If that doesn’t work, try slaving the drive to another computer and recovering the data using that other computer to access the disk.

Once done, you can do a clean install either using the genuine Windows Vista Installation Disk or the Recovery Disk or the Recovery Partition (whatever process is dictated by your computer manufacturer – you may need to contact them for the procedure and perhaps to get recovery disks). To do a clean install proceed as follows: http://www.winsupersite.com/showcase/winvista_install_03.asp (adapted as necessary by the procedures of your computer manufacturer). Then you will need to re-install all your programs, reset all your preferences, reconfigure your network and email settings, restore your backed up data, run Windows Update with possibly nearly 150 updates pending,...

Hopefully one of these procedures will resolve or at least identify the cause of your problem.

Good luck!

 

[ranter]

I don't know if this could help but it says the problem has got to do something with this: "Files that help describing the problems:"
C:\Users\Timo\AppData\Local\Temp\WERE57F.tmp.hdmp

Timo - obviously my user name.
Could this help you guys some more ?

I am doing alot of the steps Lorien described in the last post thanks for that!
The scannow didn't work though, but i'll try it again since i might have misunderstood some of the steps!

 

[Lorien]

What was the problem with SFC? Here's a detailed tutorial on the process that will probably explain things better than I did: http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html.

See if you can attach that file to your next post. If necessary, change the name so it ends in .dmp or if that won't work either, then to .txt

I'm disappointed to hear you're that far and the problem isn't resolved - I was hoping some of the first steps might do the trick - but at least you're making good progress. Keep it up and keep us informed.

I hope this helps.

Good luck!

 

[ranter]

well i hadn't had the scan the first time right but i do now.
It does tell me it has found damaged files but he couldn't repair them all.

I added the log as an attachment and left it as a .txt since thats what it gave me.

 

[niemiro]

After having a look at your SFC log, I have noticed that (amoust others) wininit.exe and explorer.exe are both corrupted. There is currently a very virulent Google Redirect going around which infects both of these files. It is very common at the moment, and I think it very likely that it is still on your computer. Without specialist knowledge, it is very hard to remove, as it is a file infecter. With certain tools, it could be removed. I do not have the authorisation to use these tools at the moment. Would you like us to call in a person with both the knowledge and authorisation to use these tools?

EDIT: Can we also ask you to re-run SFC and repost another log, so we can absolutely confirm what has been fixed, and what hasn't? Thanks!

 

[ranter]

Well i did another log so i attached it with this message.

Also i did ran malware bytes and it didn't find any more viruses but are you sure it's still in here ?
'Cause after the sfc i opened my explorer.exe and it works but i'm not sure if its supposed to be in the folder: "C:\System\windows" ?

 

[niemiro]

Well i did another log so i attached it with this message.

Also i did ran malware bytes and it didn't find any more viruses but are you sure it's still in here ?
'Cause after the sfc i opened my explorer.exe and it works but i'm not sure if its supposed to be in the folder: "C:\System\windows" ?

Look, that SFC log is clean. Modern infections can hide from malware scanners including Malwarebytes. So, yes, I think it is still there. However, that SFC log is clean. It looks as though SFC and Malwarebytes have together got rid of the bulk of the virus but I think that there are still fragments and remnants left. They could be information stealing backdoor trojans. We have no idea what still resides on your system, concealed from MBAM. That folder looks very bad. I think that would should just run a few logs, just to see what is there, and remove these remnants. Would that be OK by you?

 

[ranter]

Well if your certain then i'm most willing to completely destroy anything that still resides here!
I'm already glad i have my desktop back!

But what exactly are you thinking of?