Author Topic: Install (Read 12760 times)

Ivy · « **on:** September 24, 2008, 06:29:51 AM »

Hi ,

I read that thread , before posting for help, It says we need to download AVG 8.0 but my download stop hlaf way, I don't have any antivirus right now and I wanna get my system checked.

thanks!

Ivy · « **Reply #1 on:** September 24, 2008, 10:56:53 AM »

Hey Evil,

Heres' what happened, I downloaded avast finally and it asks me to delete a few things and I did and my comp wasn't working anymore, I had to go back to a restore point to get this working, everything is infected!! What to do now!!

evilfantasy · « **Reply #2 on:** September 24, 2008, 12:00:35 PM »

Post a HijackThis log please.

I wish you would have posted the logs the first time, then things may not have gotten this bad....

Ivy · « **Reply #3 on:** September 24, 2008, 12:02:21 PM »

This is not the same system!

I ruined all the systems at my place!!

I tried downloading hjt, it doesn't work!!

evilfantasy · « **Reply #4 on:** September 24, 2008, 12:03:13 PM »

What error do you get (if any)

Ivy · « **Reply #5 on:** September 24, 2008, 12:06:32 PM »

It completes downloading and saves some kind of icons on my desktop and when I click on them they disappear.

evilfantasy · « **Reply #6 on:** September 24, 2008, 12:07:32 PM »

Try this.

Download random's system information tool (RSIT) by random/random from and save it to your Desktop.

Double click on RSIT.exe to run.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open.
log.txt <will be maximized and info.txt <will be minimized
Please post the contents of both logs in the next reply.

Ivy · « **Reply #7 on:** September 24, 2008, 12:09:29 PM »

Okay just now it did save a icon on my desktop but it won't open it is ''HJTInstall.exe.part''

Btw you might know that my windows is not orignal.

Ivy · « **Reply #8 on:** September 24, 2008, 12:14:43 PM »

I tried downloading that, download completed but then this came

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #9 on:** September 24, 2008, 12:17:29 PM »

Quote

Btw you might know that my windows is not orignal.

I had figured that out long ago....

I won't help with making it work illegally, but if there is malware issues I will help clean it up and then advise you do make it legal so these problems won't happen any longer. An improperly patched (updated) computer is very unreliable as you can see and putting a legal copy of Windows on an infected computer is very bad.

Try running this. Be sure to rename it.

Download Deckard's Association File Tool (DAFT) and save it to your desktop.

Rename daft.exe to daft.com and double click on it to run.
Read the disclaimer and click OK.
Click on the Scan button.
If it finds faulty file associations, they will appear in red beside a checkbox. If this occurs, just place a checkmark (tick) in the boxes in question.
Click the Fix button.

Ivy · « **Reply #10 on:** September 24, 2008, 12:20:33 PM »

Quote from: evilfantasy on September 24, 2008, 12:17:29 PM

Quote
Btw you might know that my windows is not orignal.

I had figured that out long ago....

I won't help with making it work illegally, but if there is malware issues I will help clean it up and then advise you do make it legal so these problems won't happen any longer. An improperly patched (updated) computer is very unreliable as you can see and putting a legal copy of Windows on an infected computer is very bad.

Try running this. Be sure to rename it.

It wasn't my fault you know!! I was young and dumber when that guy fooled me and I told my pa that I needed a comp of my own choice so he got this guy and he got me this pc and years later I realized how he had cheated !!

Ivy · « **Reply #11 on:** September 24, 2008, 12:23:02 PM »

Here, my God!!

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #12 on:** September 24, 2008, 12:27:23 PM »

I didn't ask why or accuse you of anything, just stated where I stand on the issue. But to be honest, you now know it's not legit so the naive excuse no longer applies.

Can you do a system restore and try to get some functions back?

evilfantasy · « **Reply #13 on:** September 24, 2008, 12:28:53 PM »

Also try restarting the computer then install HJT.

Ivy · « **Reply #14 on:** September 24, 2008, 12:32:27 PM »

This is a restore point I'm working in right now, Actually earlier I had downloaded Avast and HJT etc but then Avast scanned the comp and asked me to chose what to do to the infected files I choose delete but then my comp stopped working, so I took it back to this restore point I created today itself, earlier I had no restore points.

Shall I restart the comp and see if download works?

evilfantasy · « **Reply #15 on:** September 24, 2008, 12:35:26 PM »

You might try restoring the files that Avast removed and then restart.

There is a possibility, depending on how this copy of Windows was installed that Avast is removing files needed to run Windows properly. Many antivirus are starting to detect illegal code and remove it as if it were a virus.

Ivy · « **Reply #16 on:** September 24, 2008, 12:37:16 PM »

Oh !! How do I restore those files?

evilfantasy · « **Reply #17 on:** September 24, 2008, 12:41:08 PM »

Start Avast and go into the quarantine then choose the files and restore them. You will probably need to restart for it to take effect.

Ivy · « **Reply #18 on:** September 24, 2008, 12:42:31 PM »

But I don't have Avast in this restore point!!!!!

evilfantasy · « **Reply #19 on:** September 24, 2008, 12:48:25 PM »

Ohhh....

I need to do some looking around on this.

Ivy · « **Reply #20 on:** September 24, 2008, 12:50:59 PM »

I'm so sorry, hope its not too much trouble!!

I restarted and windows gives this message on every restart.

[Saving space - attachment deleted by admin]

evilfantasy · « **Reply #21 on:** September 24, 2008, 12:59:37 PM »

See if you can do this and then restart and try again.

Clearing Temp Folder

Click on Start and then Run.
In the text box in the Run window, type %Temp% and click OK. A folder full of files and other folders will appear.
Remove everything inside the Temp folder, choose Edit and then Select All from the menu.
- Note: If you're prompted that there are hidden files in this folder, just click on OK to bypass the message.
Now that all of the files and folders are selected, hit your Delete key or choose File and then Delete from the menu.
Confirm that you want to delete the files by clicking Yes on the Confirm Multiple File Delete window that opens.
After all of the files have been deleted close the window and empty your Recycle Bin.

evilfantasy · « **Reply #22 on:** September 24, 2008, 01:03:37 PM »

Also try going into the control panel and create a new account. See if the new account will work for downloading the tools we need.

Ivy · « **Reply #23 on:** September 24, 2008, 01:10:22 PM »

Ok, I deleted the temp files and Still that error came on restart.

I'm creating a new account now.

evilfantasy · « **Reply #24 on:** September 24, 2008, 01:14:48 PM »

If the new account will not work right do this. Actually it won't hurt to do it anyway to make sure these files are gone.

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Go to Start > Run and type notepad.exe then click OK

Copy the text in the Code box below and paste it into Notepad.

Code: [Select]

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\lsass.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\services.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\smss.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\winlogon.exe]

In Notepad go to File > Save as...

Next to File name: type fixme.reg Use the dropdown box next to Save as type: and select All files. Save it to the Desktop.

There should now be a file on the Desktop that looks like this

Double-click fixme.reg it and allow it to merge with the Registry.

You may not see anything happen but give it a few seconds or so to finish.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it did not work.

Now delete the fixme.reg file from the Desktop.

Ivy · « **Reply #25 on:** September 24, 2008, 01:21:18 PM »

It says it has successfully merged with the registry or somethin like that!!

Ivy · « **Reply #26 on:** September 24, 2008, 01:22:31 PM »

Do I delete it now?

evilfantasy · « **Reply #27 on:** September 24, 2008, 01:26:43 PM »

Yes delete it now and try to install something again.

Ivy · « **Reply #28 on:** September 24, 2008, 01:30:35 PM »

Its not working!!

What am I gonna do?!!

Ivy · « **Reply #29 on:** September 24, 2008, 01:40:16 PM »

Okay, I created a new account, and on this new account I have almost no icons on the desktop, its like a new computer, But even on this account the download did not work!!

evilfantasy · « **Reply #30 on:** September 24, 2008, 01:40:49 PM »

Go to C:\Program Files and look for the Avast folder. See if the quarantine folder is there and right click the files to see if there is a restore option.

Ivy · « **Reply #31 on:** September 24, 2008, 01:44:46 PM »

There's just a temp folder of avast which is empty.

Ivy · « **Reply #32 on:** September 24, 2008, 01:50:37 PM »

Its very very late at night now, I have to go to college tomorrow, actually practically its already tomorrow right now!!

Hey Evil, thankyou so much for helping!!!

I was wrong about you in many aspects, sorry!!

I'll come tomorrow now.

Hopefully we'll figure this out!!

Thanks again!

evilfantasy · « **Reply #33 on:** September 24, 2008, 02:17:08 PM »

See if you can borrow an XP CD that matches your system Xp Home or XP Pro to do a repair install.

Ivy · « **Reply #34 on:** September 24, 2008, 10:37:58 PM »

I dont know whom to take a cd from!!

is that the only way out?

evilfantasy · « **Reply #35 on:** September 24, 2008, 11:40:54 PM »

I'm running out of ideas.

Create A Bootable/Slipstreamed Windows XP Installation CD http://www.theeldergeek.com/slipstream_01.htm

Ivy · « **Reply #36 on:** September 27, 2008, 04:19:46 AM »

Okay, I got a windows xp 2 CD now

evilfantasy · « **Reply #37 on:** September 27, 2008, 12:30:02 PM »

Download this guide.

Repair Install XP.pdf

Ivy · « **Reply #38 on:** September 29, 2008, 06:20:29 AM »

Thanks Evil, I reformatted my computer yesterday!

Now I can download etc, I'll still download HJT etc and post a log here so you can take a look.

thanks

Ivy · « **Reply #39 on:** September 29, 2008, 07:55:01 AM »

New HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:32:19 AM, on 9/29/2008
Platform: Windows XP SP2, v.2096 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2096)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Program Files\Trend Micro\OfficeScan Client\PCCNTMON.EXE
C:\Program Files\Sify Broadband\BBClient.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B49B764-A2EE-4C58-ACFC-6B323C5575DA}: NameServer = 202.144.13.50,202.144.66.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{4B49B764-A2EE-4C58-ACFC-6B323C5575DA}: NameServer = 202.144.13.50,202.144.66.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{4B49B764-A2EE-4C58-ACFC-6B323C5575DA}: NameServer = 202.144.13.50,202.144.66.6
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe

--
End of file - 2864 bytes

evilfantasy · « **Reply #40 on:** September 29, 2008, 08:40:45 AM »

Everything looks fine now.

Ivy · « **Reply #41 on:** September 29, 2008, 09:13:42 AM »

Yes Currently it si, before that it was in west asia, in 48 days it will probably be in russia, I travel with my Group and stay in different places for 3 to 6 months, anyway I'd like you to edit your last post or just remove the place, that would be very nice you know!

evilfantasy · « **Reply #42 on:** September 29, 2008, 09:20:35 AM »

Don't be over paranoid. Lots of people know where you are and it is a large country. We wouldn't allow information that could be harmful in any way to anybody to remain in the forums

Ivy · « **Reply #43 on:** September 29, 2008, 09:22:46 AM »

Read my profile

thankyou for helping again

evilfantasy · « **Reply #44 on:** September 29, 2008, 09:23:36 AM »

Caught it and already was fixing. Sorry.

Ivy · « **Reply #45 on:** September 29, 2008, 09:24:56 AM »

Its alright!!

Thankyou

Computer Hope Forum

News:

Author Topic: Install (Read 12760 times)

Ivy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

Ivy

evilfantasy

Ivy

Ivy

evilfantasy

evilfantasy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

evilfantasy

evilfantasy

Ivy

evilfantasy

Ivy

Ivy

evilfantasy

Ivy

Ivy

evilfantasy

Ivy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy

evilfantasy

Ivy