help, i messed up!! bad

[scottlauer]

I have xp pro, Avast 4 pro anti virus detected virus and suggested imediate boot scan . I chose delete option. After scan, few programs will open, not even avast to undo, nor recycle bin undo. In safe mode I tried xp pro sytem restore to an earlier date, no luck? Programs cannot find program to open, I can get on internet thats about it? Any suggestion please. Thanks
Scott

[whocares]

Hi Scott,

please try the CLEANER from www.avast.com
read the instructions carefully on how to run the Cleaner "SOMEHOW" (by renaming it)

also work through the "VirusRemoval"-link below ..

[scottlauer]

Thanks, I am wondering how I may recover the files that I deleted, also i think one of the viruses was named mo sucker? Will I have to reinstall the OS?

[whocares]

I am wondering how I may recover the files that I deleted,

it depends whether an important file was INFECTED by a true VIRUS, or whether you just deleted a trojan/worm, which can/should/need not be repaired or restored.
(If you/avast indeed DELETED the file, and not just MOVED it, then you can't restore it, except MAYBE with special file recovery tools)

we'd need the exact virusname and location of "infected" file to decide on this

But first get your system running again with the Cleaner, and work through "VirusRemoval" & USER's FAQ (in Off-Topic forum)

then supply the requested info..

 

[scottlauer]

I have downloaded cleaner, cannot open, windows dosent know what program to open with? Any suggestions?I have a registry backup in tweak xp pro. How may I insatll this backup, I can use explorer, thats about it? The avast log files should tell what was deleted..yae?

[scottlauer]

I found a registry backup in tweak xp pro, how can I restore, windows explorer still works? Is that a good idea? I downloaded avast cleaner, but windows doen't know what program to open with? Maybe safe mode for the cleaner?

[whocares]

I have downloaded cleaner, cannot open, windows dosent know what program to open with? Any suggestions?

Yes.. READ THE INSTRUCTIONS !!

A)

read the instructions carefully on how to run the Cleaner "SOMEHOW" (by renaming it)

B)
"Solving other problems
If you have deleted a virus or worm file associated to a vital file type - and now you cannot run your applications anymore, avast! Virus Cleaner may help you as well. All you have to do is run avast! Virus Cleaner "somehow". If, for example, only the association for .EXE files has been corrupted, you may run the avast! Virus Cleaner by renaming it to a .COM file. The other extensions you may try are .SCR, .BAT, .PIF (on Windows NT/2000/XP/2003, you may try .CMD as well). If none of these extensions works (Windows is still reporting "Cannot find 'xyz.exe'" when you try to start the tool), you can use avast! Virus Cleaner itself as a replacement for the missing file. However, you have to know the name of the missing file to do that; if you know it, just rename the avast! Virus Cleaner file to the missing name (and move it to the corresponding folder, if necessary). Now, starting any application should bring up avast! Virus Cleaner instead. As soon as it starts, it detects that some of the vital file associations are corrupted, reports the problem and allows you to fix it immediately."

[scottlauer]

I have tried everything to get cleaner to run!
Information\_restore{D6F7AF44-E5FE-45F3-9E39-B5A9E2DEF2E3}\RP62\A0032845.REG Error 42006
File C:\System Volume Information\_restore{D6F7AF44-E5FE-45F3-9E39-B5A9E2DEF2E3}\RP62\A0032846.REG Error 42006
File C:\System Volume Information\_restore{D6F7AF44-E5FE-45F3-9E39-B5A9E2DEF2E3}\RP67\A0041607.reg Error 42006
File C:\System Volume Information\_restore{D6F7AF44-E5FE-45F3-9E39-B5A9E2DEF2E3}\RP70\A0046012.exe is infected by Win32:Trojano-118 [Trj] - Deleted
File C:\unzipped\LOMALKA[1].RU-Kaspersky_Anti-Virus_Personal_Pro_v4.5.0.94\awi.exe is infected by Win32:Inservice [Trj] - Deleted
File C:\WINDOWS\system32\msbltn.exe is infected by Win32:MoSucker [Trj] -

These were some of the deleted files,
I renamed cleaner C:\WINDOWS\system32\msbltn.exe and put a ccopy in directory
Nothing. I cannot find xp prodisk, maybe reload xp pro sp2, online scan or install my reg backup?

[scottlauer]

I installed an app from norton called unhook.exe, now I am able to start programs and am running cleaner.exe

[scottlauer]

I am running again, found two viruses and moved to chest. What action should I take with win32: mosucker and win32:inservice?

[raman]

Do you know where you "get" infected with win32: mosucker? Thats a reason to do this : "Some people advise a complete redo of the system from scratch, as it's compromised=not secure anymore." taken from here(first reply, but the other tips aren´t bad either!;) )):
http://forum.avast.com/index.php?board=4;action=display;threadid=5373