Unable to install Superantivirus during "read this before..."

[evilfantasy]

I'm not sure whats going on to be honest. Do you have an XP CD?

Download DrWeb CureIt & save it to your desktop.

Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start.
  
• An Express Scan of your PC notice will appear.
  
• Under Start the Express Scan Now Click OK to start.
  • This is a short scan that will scan the files currently running in memory.
  • If or when something is found, click the Yes button when it asks you if you want to cure it.
• Once the short scan has finished, Click Options > Change settings
  
• Choose the Scan tab and UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button.
  
• Then click the Green Arrow Start Scanning button on the right and the scan will start.
  • Click Yes to all if it asks if you want to cure/move any file(s).
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.

• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

[/COLOR]

• After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
  
• Copy and paste that log in the next reply

[pineapplejeani]

I don't currently have the xp cd.  I'd have to ask my mom if she has one but it's 2am here so I can't ask her now .

Should I follow the latest directions even without the cd?

[evilfantasy]

Yes run Dr Web and see if it finds anything else. Once we stop finding malware we can try to figure out why the other functions aren't working. Until the malware is completely gone though there is no use in trying to fix everything else since it may be the malware causing it...

[pineapplejeani]

Thanks for helping me so late into last night (this morning)    Here is the log from Dr Web:


explorer.exe;c:\windows;Trojan.Starter.384;Cured.;
lsass.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
services.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
svchost.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
winlogon.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
ComboFix.exe\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Administrator\Desktop\ComboFix.exe;Program.PsExec.171;;
ComboFix.exe;C:\Documents and Settings\Administrator\Desktop;Archive contains infected objects;Moved.;
SDFix.exe\SDFix\apps\Process.exe;C:\Documents and Settings\Administrator\Desktop\SDFix.exe;Tool.Prockill;;
SDFix.exe;C:\Documents and Settings\Administrator\Desktop;Archive contains infected objects;Moved.;
slgclientservicesredists.exe\data002;C:\My Games\Cake Mania\slgclientservicesredists.exe;Adware.SpywareStorm;;
slgclientservicesredists.exe;C:\My Games\Cake Mania;Archive contains infected objects;Moved.;
F5D3D31D-6F72-4DF2-A411-8B4A24;C:\Program Files\Microsoft AntiSpyware\Quarantine\C05937E8-82D5-4157-A2AD-04A2C3;Adware.nCase;;
Process.exe;C:\SDFix\apps;Tool.Prockill;;
A0013247.dll;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013248.scr;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013249.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.MWS;;
A0013250.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.DownLoader.7028;Deleted.;
A0013258.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013260.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013261.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013262.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Isbar.438;Deleted.;
A0013263.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013264.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013265.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013266.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013267.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.DownLoader.7028;Deleted.;
A0013268.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013269.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013270.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013271.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.MWS;;
A0013272.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013273.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013274.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013275.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013276.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.MWS;;
A0013277.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013280.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013281.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013282.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013283.SCR;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0015336.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0018404.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Program.PsExec.170;;
A0019495.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Program.PsExec.170;;
A0019529.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019530.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019531.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019532.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019533.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019534.exe\32788R22FWJFW\psexec.cfexe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53\A0019534.exe;Program.PsExec.171;;
A0019534.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Archive contains infected objects;Moved.;
A0019535.exe\SDFix\apps\Process.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53\A0019535.exe;Tool.Prockill;;
A0019535.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Archive contains infected objects;Moved.;
A0019536.exe\data002;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53\A0019536.exe;Adware.SpywareStorm;;
A0019536.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Archive contains infected objects;Moved.;

[evilfantasy]

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

• Open the folder and run Dial-a-fix.exe
• 2 windows will open. Close the one in the background labeled Restrictive Policies
• Check the box in section 1, Empty temp folders.
• Check the box in section 2, Fix Windows Installer.
• Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked
• Check all boxes in Section 5, labeled Registration Center.
• Click Go
• OK any error messages if received, but write them down and post them here.
• Restart the computer when done.

.
----------

Download to your desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.

----------

Any luck with Normal mode now?

[pineapplejeani]

dial-a-fix website not working.  I tried from my laptop just to see if it was this machine or not.

[evilfantasy]

Try here http://www.majorgeeks.com/download4899.html

[pineapplejeani]

Should I continue with what I can?  See red below.

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

• Open the folder and run Dial-a-fix.exe
• 2 windows will open. Close the one in the background labeled Restrictive PoliciesDidn't see it
  
• Check the box in section 1, Empty temp folders.OK
  
• Check the box in section 2, Fix Windows Installer.Uncheckable
  
• Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checkedThey're not but I can check the Fix SSL/... box which checks the rest
  
• Check all boxes in Section 5, labeled Registration Center.
• Click Go
• OK any error messages if received, but write them down and post them here.
• Restart the computer when done.

.
----------

Download to your desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.

----------

Any luck with Normal mode now?

[evilfantasy]

Did you get Dial-a-fix from MajorGeeks?

[pineapplejeani]

yes

[evilfantasy]

How about FixPolicies and getting into Normal mode?

[pineapplejeani]

Wallpaper and cursor   

[evilfantasy]

Download to your desktop ISeeYouXP.exe by ShadowPuterDude
Next double-click on ISeeYouXP.exe on your Desktop.
 
ISeeYouXP.exe will self-extract ISeeYouXP to C:\ISeeYouXP and place a .bat file on your Desktop.

Double-click ISeeYouXP.bat to run the script.

Once complete a log will be saved to the Desktop named ISeeYouXP.txt.
           
Post the following logs in your next reply:
ISeeYouXP.txt

If the ISeeYouXP .bat file does not extract to the Desktop. Double-click My Computer on the Desktop and navigate to the ISeeYouXP folder located in the C: drive. Double-click the ISeeYouXP.bat file to run the program.

Upload the file to Savefile.com
There is no need to Register
Select Browse and locate the file.
Fill in the Title and Description and security code then click Upload
Copy the download link next to Your link to the file: and post the link back here.

[pineapplejeani]

Upload the file to Savefile.com  Which file?

Attached  is the ISeeYouXP log

[Saving space - attachment deleted by admin]

[evilfantasy]

Sometimes ISeeYouXP.txt is too large for the forums and needs to be uploaded at SaveFile..