System restore not working.

[srtony1946]

When I boot my computer I get this IN BIOS...Invalid boot-file boot.ini booting from C/windows. I have a windows CD. Did you mean msconfig in last post? I tried that but could not find boot. ini file.

[evilfantasy]

Get your Windows XP CD.

Look at this link to see how to repair your boot.ini file. http://tricks-collections.com/2008/12/how-to-repair-bootini-file-in-windows-xp/

[srtony1946]

ok I will try this Tomorrow, I have to go into work. I will keep you posted.

[evilfantasy]

No problem.

[srtony1946]

When I repair windows with xp cd, will It erase everything on my hardrive? should I back up files?

[evilfantasy]

No a repair is just that. Repairing damaged files.

[srtony1946]

I am having problems with windows xp cd , when I get to the step where you have to type bootcfg/list It does nothing and I have to type exit to get out of it.

[evilfantasy]

You need a space between bootcfg and /list

[srtony1946]

Ok the virus did not appear in bios, I think we got it YES!!!. But system restore still not working.

[evilfantasy]

OK let's see what might be hiding now.

Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start
• An information notice will appear, click OK.
• This starts a short scan that will scan the files currently running in memory.
• If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
• If or when something is found, click the Yes button when it asks you if you want to cure it.

• Once the short scan has finished, Click Settings > Change Settings
• Under the Scanning tab UNcheck Heuristic analysis and click OK
• Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
  • Click Yes to all if it asks if you want to cure/move any file(s).
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
• Save the DrWeb.csv report to your Desktop.
• Exit Dr.Web Cureit.

• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

[/COLOR]

• After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
• Copy and paste that log in the next reply

[/list]

[srtony1946]

Update..... I fixed system restore by doing this. rt clicked on my computer, properties, system restore tab, turn off system restore, ok, rebooted. Than turned system restore back on. Thanks for hanging in there for me and all your help evilfantasy,your awsome.

[evilfantasy]

Cool!!

You should probably run a virus check just to be safe. ComboFix found a few things so better safe than sorry.

[srtony1946]

sens.dll;c:\windows\system32;Trojan.Starter.881;Cured.;
ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Tony\desktop\ComboFix.exe/data002;Program.PsExec.171;;
data002;C:\Documents and Settings\Tony\desktop;Archive contains infected objects;;
ComboFix.exe;C:\Documents and Settings\Tony\desktop;Container contains infected objects;Moved.;
A0000013.dll;C:\System Volume Information\_restore{785D763D-1628-4541-9037-095F39857DB9}\RP2;Trojan.Starter.881;Cured.;
A0000014.exe/data002\32788R22FWJFW\psexec.cfexe;C:\System Volume Information\_restore{785D763D-1628-4541-9037-095F39857DB9}\RP2\A0000014.exe/data002;Program.PsExec.171;;
data002;C:\System Volume Information\_restore{785D763D-1628-4541-9037-095F39857DB9}\RP2;Archive contains infected objects;;
A0000014.exe;C:\System Volume Information\_restore{785D763D-1628-4541-9037-095F39857DB9}\RP2;Container contains infected objects;Moved.; DR WEB FOUND ANOTHER VIRUS!!.

[evilfantasy]

Looks like Dr Web cured your sens.dll file, which is a library that contains functions used for System Event Notification Service.

Download OTCleanIt.exe and save it to your Desktop.

• Double-click OTCleanIt.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it yourself.

.
----------

Disable/Enable the System Restore Utility to flush old infected restore points

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Put a check mark next to Turn off System Restore on All Drives
4) Click the OK button.
5) You will be prompted to restart the computer. Click the Yes button.

Now re-enable System Restore

To re-enable the System Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Remove the check mark next to Turn off System Restore on All Drives
4) Click the OK button.

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

----------

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.