Attack of windows xp restore- DDS.txt

not for windows xp pro

Hi Blade,
The tool provided did not restore sytem tools.
That link for manually restoring the system tools, entertainment, games, communication is not for my machine (as per Windows).
Any other way to do this manually or with a program?
Am I completed in the repair of this windows xp restore?
Thank you for all your help in this process.
Can I improve the security on my machine- any advise?
I will make a donation to Safer Networking.
I can't Thank you enough.
John
 
Hi,

The tool provided did not restore sytem tools.
That link for manually restoring the system tools, entertainment, games, communication is not for my machine (as per Windows).
Any other way to do this manually or with a program?
Unfortunately, there's no other way to do it manually. All those system tools etc should physically exist there. Just shortcut links in start menu have to be rebuilt. If you have another system with XP on it you could use it as an example and then add new menu items by following that instructions I linked in my previous post.



Some steps to secure your system to prevent against further intrusions.


THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis



Now lets uninstall ComboFix:
  • Click START then RUN
  • Now copy-paste Combofix /uninstall in the runbox and click OK


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


Download and run Secunia Personal Software Inspector (PSI) and fix its findings. Leave the program installed so you'll stay alarmed about vulnerable components in future too.


Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:
 
Very slow start up

HI Blade,
Thanks again for all your help. A donation is on the way.
So far I have been cleaning the machine from all you mention combo-fix and all the logs txt. and attach and scans that you used.
I used cc cleaner to get rid of a lot of junk that was installed- cookies that would not go away.
I have downloaded seconia and it seems my biggest problem is outdated MS office suite. I am going to change to MS 10.
My computer is very slow when starting and for my security to load takes forever.
I am going to reload spy bot as I had to remove when we were scanning.
All the best
John
 
Still infected?

Hi Blade,
I am sorry to be a PIA but I belive my machine is still infected. It is slowing down to a crawl and symantics is running in the background as an auto scan and it showed from a scan that bloodhound was in the machine and that it partially fixed it. Backdoor.tideserv.int and rootpatch kit show up in malwarebytes. It seems to show that area where you were working C:\systemvolume. and I missed the rest of the file
Thanks
John
 
Hi,

It seems to show that area where you were working C:\systemvolume. and I missed the rest of the file
Did you reset the system restore as instructed? If bad items are still found after that post fresh dds logs.
 
dds and attch compressed

Hi Blade ,
Please check I apologize to keep bothering you. I did turn off system restore and then turn on again as you told me to do.
Thank you
John
 
Hi,

That MBAM finding is a backup of the file I made you to do earlier. Please delete c:\WINDOWS\system32\drivers\volsnap_old.sys.

Are there any other issues remaining? I'd try some lighter antivirus solution than Symantec AntiVirus or alternatively add some more RAM.
 
Hi,

Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop.
@ECHO OFF
DEL /Q c:\WINDOWS\system32\drivers\volsnap_old.sys
DEL %0

Double-click on fixes.bat file to execute it. That should take care of the file :)
 
File deleted

Hi Blade ,
I deleted the file as per your instruction. Symatic will not run or update. Does the machine appear to be clean at this point ?
john
 
Logs look good. In case you may want to try other antivirus solution instead of Symantec Antivirus I included a few options below.

Good free antivirus programs are:
Antivir and
Avast!

Good commercial ones are from:
Kaspersky and
ESET
 
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.
 
Back
Top