System: XP Pro x64 Edition

[joselepiu]

here is the log of the step 1 of step 3...

i did restart the comp manually by closing the message window by clicking on the X...

the restart the comp by ===> start ===> turn off computer ===> restart ...

step 2 did not produce a log...


Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\DJ RAC\Desktop>CD /D C:\

C:\>chkdsk C:
The type of the file system is NTFS.
The volume is in use by another process. Chkdsk
might report errors when no corruption is present.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
9 percent complete. (87772 of 91968 file records processed)
109196891968
91968 file records processed.

File verification completed.
10 percent complete. (1 of 1363 large file records processed)
1013631363
1363 large file records processed.

1000
0 bad file records processed.

1000
0 EA records processed.

1022
2 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
55 percent complete. (304875 of 305163 index entries processed)
55305163305163
305163 index entries processed.

Index verification completed.
5555
5 unindexed files processed.

CHKDSK is verifying security descriptors (stage 3 of 3)...
59 percent complete. (89943 of 91968 descriptors processed)
599196891968
91968 security descriptors processed.

Security descriptor verification completed.
5965906590
6590 data files processed.

CHKDSK is verifying Usn Journal...
100 percent complete. (9166848 of 9170704 USN bytes processed)
10091707049170704
9170704 USN bytes processed.

Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

293048248 KB total disk space.
281098396 KB in 70829 files.
30072 KB in 6591 indexes.
4 KB in bad sectors.
179968 KB in use by the system.
65536 KB occupied by the log file.
11739808 KB available on disk.

4096 bytes in each allocation unit.
73262062 total allocation units on disk.
2934952 allocation units available on disk.

C:\>

[OCD]

Hi joselepiu,

Windows found problems with the file system.

You stated that when you previously tried this step you encountered the path below:
C:\WINDOWS\$NtServicePackUninstall$>

What you will need to do is change directories before you can enter the correct command to have check disk complete.

• Click the Start menu , in the search box type "cmd" (without the quotes)
• Next you will see a menu that has a small black DOS icon with the text cmd next to it.
• Double click on the DOS icon to run, OR
• Right click on the DOS icon and select "Run as Administrator".
• Select Yes if presented with the UAC prompt.
• Next the larger DOS window will open with C:\WINDOWS\$NtServicePackUninstall$>

• Here is where you will have to change directories:
• Next to the above entry type: cd.. >> Enter
• You should see in the DOS windows that the line now reads C:\WINDOWS\
• Next type: cd system32 >> Enter
• You should now see C:\WINDOWS\system32>
• Next we will type our check disk command (shown below)

• Type or copy and paste (if it will allow) chkdsk /f, then hit Enter (make sure there is space between chkdsk and the /r)
• You will see a warning:
• Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)
• Press the Y key, then hit Enter
• You will see the following:
• This volume will be checked the next time the system restarts.
  
  
  
  
  
• Close the window, or type Exit, then press Enter.
• Now restart your computer to allow the chkdsk scan to be performed.

Post the results when completed.

[joselepiu]

i ran the check scan but did bo produce any logs...

you asked me to do this:

""To view results log:

Go to Start - Run and type in eventvwr.msc, and hit enter.
When Event Viewer opens, click on "Application", then scroll down to "Winlogon" and double-click on it to open it up.
This is the log created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.""

i did not find the ""Winlogon"" there...

i posted some pics of what i found there on my post ""??? 14-08-21, 16:02...

bit ill run the ""chkdsk /f"" comand again...

[joselepiu]

i just noticed that in your institutions there is a confusing typo...

Type or copy and paste (if it will allow) ===chkdsk /f=== , then hit Enter (make sure there is space between === chkdsk and the /r===)

which one is the correct one?...

[OCD]

i just noticed that in your institutions there is a confusing typo...

Type or copy and paste (if it will allow) ===chkdsk /f=== , then hit Enter (make sure there is space between === chkdsk and the /r===)

which one is the correct one?...

My oversite, chkdsk /r is the correct entry.

Go to Start - Run and type in eventvwr.msc, and hit enter.
When Event Viewer opens, click on "Application", then scroll down to "Winlogon" and double-click on it to open it up.
This is the log created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.""

Double click "Application" to expand the menu.

[joselepiu]

i get this again...

start ===> run ===> type: "eventvwr.msc" ===> click "OK" ===>

pic 9.JPG

and after clicking on "Application" i get this:...

pic 10.jpg

when i try to scroll down all disappears...

pic 11.JPG

but at the top of the window it still shows 24,385 events...

???...

[joselepiu]

in another note...

by error i clicked on security instead of application...

and i saw this...

pic 12.jpg

are those anonymous logons normal?...

[joselepiu]

here is another pic of those ""anonymous logons"" with todays date...

pic 13.jpg ...

[OCD]

Hi joselepiu,

Please do not attach the images, it makes it time consuming to review your answers.

We have removed all the malware that was found on your computer.

As far as the errors messages and the anonymous logons contained within the event viewer are concerned, unfortunately, this is not my area of expertise. My primary focus is on malware removal, and as stated in my opening introduction " I will be working on your Malware issues, this may or may not, solve other issues you have with your machine."

We may have come to the point where you best course of action would be to either reformat and reinstall the current version of your OS. Or option two, which would be to upgrade to a newer version. I would strongly recommend the second option since Microsoft no longer offers support for Windows XP.

Either option would resolve the current missing or corrupt files that are present on your computer and may be contributing to the problems we are encountering.

Please let me know how you would like to proceed.

[joselepiu]

sorry about the pics...

just try to do what you did...

tried to include the pics with the text but it did not work out...

could not edit it after posted (do not think is even possible in this site)...

thought it would be easier for you to understand what i meant...

a pic is worth more than 1,000 words... and all that...

in regards to the anonymous logons...

i think that that says that my computer is indeed infected with something unless that is normal...