Acidentally deleted files with avast, now got blue screen on startup!

[Skirrel]

I used avast on a computer yesterday to scan for viruses, and it found a virus on the physical drive or MBR or something, cant remember.  I deleted the file instead of repairing it (yeah dumb mistake I know).  Now i get a blue screen on startup and have even tried using the windows xp home edition cd to repair it, but it was unsucessful. 

Is there a way to fix this?

[essexboy]

Hi iot sounds like it was the MBR - although having said that Avast would not have deleted it... Can you get to safe mode with networking ?

What is the make of your computer i.e. Dell etc.

Please print these instruction out so that you know what you are doing

Latest version: v3.1.46.0

OTLPENet.exe
MD5=79209302A1AFB2490808DB890A815CED
Size: 127,222,215b / 121.3MB

• Download the attached scan.txt to a USB drive
• Download OTLPENet.exe to your desktop
  
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn  to burn the file to CD
  
  
• Reboot your system using the boot CD you just created.

Note : If you do not know how to set your computer to boot from CD follow the steps here

• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads  :) 
• Your system should now display a Reatogo desktop.

Note : as you are running from CD it is not exactly speedy

• Double-click on the OTLPE icon.
  
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
  
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  
• OTL should now start.
• Double click the Custom scans and fixes box
  
• In the dialogue locate the scan.txt you have on the USB
• Press Run Scan to start the scan.
  
• When finished, the file will be saved  in drive C:\OTL.txt
  
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive. 
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.
  

[Skirrel]

I could not get onto safe mode with networking.  Also, what attached scan.txt are you referring to?  Excuse me for being such a newbie ;/

edit:  ok i see it.  Also, the computer is not a dell, it was made by a relative from multiple hardware components.

edit2: yes it was an MBR file, that's all i remember

[essexboy]

At the bottom of the post is an attachment that is the scan.txt

[Skirrel]

Ok so I've just started the scan.  Will this process fix my computer, or will I have to wait until after someone reads my log?

[Skirrel]

attached is the OTL.txt file

[SafeSurf]

Essexboy will be the person giving your instructions on malware removal and reviewing your logs.

I have a question for you.  When you removed or uninstalled your previous antiviruses, like Kaskpersky (KAV), AVG, and ESET, did you use the vendor's uninstaller tools or do it some other way.  KAV is still showing up in your machine.

Also, with Spyboot, do you use Teatimer (TT)?

Is your SAS the Pro version?

I notice that you also use Adaware.  This has become obsolete and most people have replaced this with MBAM (Malwarebytes), which we will have you put on your machine for better security when we are done with your malware removal and better detection rates.

While you are waiting for Essexboy, please do not make any further changes to your machine or you will have to repeat making logs.  In addition, do not sync your machine with your phone or any other devices.  Try to not use the machine for email or surfing or anything else; use anther machine or your phone if possible.  Essexboy comes on the forum late UK time. 

Let us know if you have any questions.  Thank you.

[Skirrel]

Essexboy will be the person giving your instructions on malware removal and reviewing your logs.

I have a question for you.  When you removed or uninstalled your previous antiviruses, like Kaskpersky (KAV), AVG, and ESET, did you use the vendor's uninstaller tools or do it some other way.  KAV is still showing up in your machine.

Also, with Spyboot, do you use Teatimer (TT)?

Is your SAS the Pro version?

I notice that you also use Adaware.  This has become obsolete and most people have replaced this with MBAM (Malwarebytes), which we will have you put on your machine for better security when we are done with your malware removal and better detection rates.

While you are waiting for Essexboy, please do not make any further changes to your machine or you will have to repeat making logs.  In addition, do not sync your machine with your phone or any other devices.  Try to not use the machine for email or surfing or anything else; use anther machine or your phone if possible.  Essexboy comes on the forum late UK time. 

Let us know if you have any questions.  Thank you.

I use teatimer.  superantispyware is free version.  Thanks for the info.

[essexboy]

Lots of other programmes run prior to this - did they find anything ?

Lets fix the MBR first

Please start OTLPE
Double-click on the MBRFix icon, a command window will open


In the command window type in the following lines and press enter after each (please be sure you type it right) :

Code: [Select]

MbrFix  /drive  0  savembr  C:\Backup_MBR_0.bin
MbrFix  /drive  0  fixmbr  /yes
THEN

Copy the attached Fix.txt to a USB

• Insert your USB drive with fix.txt on it
• Start OTLPE
• Drag and drop fix.txt into the Custom scans and fixes box
  
• If you cannot drag and drop for some reason.  Then press the Run Fix button and a dialogue box will pop up asking for the location - select the file on your USB drive 
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot when it is done to normal mode if possible
• Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
  

[Skirrel]

ok i've run the fix and rebooted the computer, but still get blue screen.  Now im going back into otlpe to do a scan so i can post another log.

edit:  am i doing this right?  What scan log would I have to use this time?

[Skirrel]

attached is the fix log that came out after i ran the fix.

[essexboy]

When you get the blue screen what does it state ?

Can you get to safe mode ?

[Skirrel]

actually when i try to get on it shows a black screen that says "windows cannot start because the following file is missing or corrupt -\windows\system32\config\SYSTEM".  Earlier it showed blue screen because i didnt run the MBRfix correctly; I didnt type in the code correctly or something.

how would i restore the system file?  I tried repairing it but it wouldnt work.

[Dch48]

I found that file in my repair folder and I made a zip of it. I don't know if you'd be able to put it where it belongs but I can send it if you want. Essexboy would know better than me if it would work or not.

[essexboy]

Ah OK that is a corrupt hive in the registry

We will use an mobile operating system called xPUD, and a script called rst.sh to restore your computer.

On the clean computer.

Creating a bootable USB using xPUD

• Please download the following files and save it to the desktop
• Unetbootin.exe
  
• xPUD latest version is xpud-0.9.2.iso
• Insert the USB device to make bootable to the computer. (Make sure that no other USB's are inserted)
  
• Double-click on unetbootin.exe to run
• Select Disk Image, ISO and in the space provided, enter the path location of xpud-0.9.2.iso (ex. C:\Documents and Settings\yourusername\Desktop\xpud-0.9.2.iso)
  
• Select USB Drive type and the drive letter assigned to your USB stick.
  
• Click "OK" and wait until the program finishes. You now have a bootable xPUD.
  
• Download the following tool and save it inside the bootable USB
• rst.sh

Please note: if you prefer to create a bootable CD using xPUD, you may download the ISO image found here and burn it to a CD.



On the infected computer.

• Reboot your system using the xPUD bootable USB you just created.

Note : If you do not know how to set your computer to boot from USB follow the steps here

• Your system should now display a xPUD desktop.
• Select on the File icon; on the right pane click on the "mnt" folder and highlight "sdb1" - this is your USB device.
  [indent]sda1,2...usually corresponds to your HDD
  sdb1 is likely your USB[/indent]
  
• Click on the "Tool" menu and select Open Terminal
  
  
• In the open terminal window, type in the following:

bash rst.sh

• Press "Enter" and let it run uninterrupted.
  (The program lists available Restore Points and will save a report enum.log located in the USB drive.)
  
• The program is finished when it say's "Done".
  
• Type "Exit" to close the terminal window.
  
• Please attached the enum.log file in your reply. (You may remove your USB drive when transferring log to a clean computer).

Please note: If you have an ethernet connection you can access the internet by way of xPUD (Firefox). You can perform all these steps on your sick computer. When you download the download will reside in the Download folder. It can be found under the File tab also. You can similarly access our thread by way of this OS too so you can send the logs that way.