Repair Install does nothing??

[merkat106]

I have a 5 yr/old HP laptop (an upgraded zv6130us) with win 7 pro x86 and Microsoft Security Essentials. Somehow got a ie google redirect virus. Used malwarebytes to clean it and other trojan malware off. :shock: It no longer redirects, but it was buggy. It no longer recognized any usb devices & niether command prompt nor ctrl-alt-delete worked.

So I begin to try to repair it. I power it off, unplug the battery etc - nope. I reinstall the chipset drivers - nope. No restore points available. I pop in the win 7 disc and select repair your computer then use command prompt. Can't run sfc /scannow (recieved a message to reboot), chkdsk was normal, startup repair can't repair anything.

So I then try a repair install. It is successful, but upon first boot I recieve a message indicating NET framework version 4 was damaged, and setup was repairing it. Minutes and a reboot later, I launch the OS.

1. my desktop background is gone unlike the other repair installs I've ever done

2. usb devices are still not recognized: "unknown device"

3. command prompt still does not open

4. ctrl-alt-delete also still doesn't work

I wanted to keep my programs, data and settings. I will not trust MSE anymore for anyone.

What's next here???

 

[merkat106]

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4181

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6/8/2010 4:56:50 PM
mbam-log-2010-06-08 (16-56-50).txt

Scan type: Full scan (C:\|F:\|)
Objects scanned: 181685
Time elapsed: 1 hour(s), 17 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Windows\System32\ddhcpcsvc.dll (Trojan.BHO) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{6e1a356c-0f17-4008-44c2-0c0b2fc77e79} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6e1a356c-0f17-4008-44c2-0c0b2fc77e79} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6e1a356c-0f17-4008-44c2-0c0b2fc77e79} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\ddhcpcsvc.dll (Trojan.BHO) -> Delete on reboot.
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid (Trojan.Vundo) -> Delete on reboot.

 

[Night Hawk]

Want to see if there are any more infected files or hidden bugs on the system there?

Having seen one system lately hit with a bug that actually locked the owner out by creating a totally new admin account where even a boot in safe mode was ??? pointless except for creating a desktop someone suggested something quite a bit more thorough then most protections out there but runs as a stand alone tool to perform a complete system scan and removal of anything with a malicious code found.

The Vipre Rescue Program simply creates a new temp folder to unpack files into and run out of with a command prompt type dos gui where you can watch as it goes through an entire drive in a few minutes. You might want to give this one a try to see what else is tucked away on the system there. VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software

 

[merkat106]

I am completely confused...

Frustrated last night, I left the laptop on all night. At one point it went into stand by then hibernation. Resumed it this afternoon so I could reboot into safe mode.

I connected my ipod to it to charge it only to find out that it was recognized by the computer. Confused, I connected a flash drive to it. It was also recognized.

At a whim, I pressed ctrl-alt-delete and it worked. So I tried command prompt. Nope, it did not work.

So I booted it into safe mode and ran combofix out of curiosity. As combofix loaded, wierd things began happening. The screen turned blue but did not bsod, flashed on/off a few times, then I saw what looked like command prompt pop up as combofix loaded. Combofix itself could not run since the version I had was old.

So, out of curiosity, I tried opening command prompt. It did, but in full screen mode. Had to type exit to close it.

I am rather confused here.

I am still going to run VIPRE just in case anything is still left on the laptop, then I'll reboot and install Norton IS.

 

[Jonathan_King]

I suggest a clean install if the problems persist. It sounds like maybe the virus still has remnants.

 

[gregrocker]

I would zero the HD before clean reinstall. Any data pulled off should be scanned on it's disk or stick before reimporting. Scan the Win7 DVD too.

Boot Win7 DVD REpair console, click through to Recovery TOols list, open a Command Line , type:

DISKPART
LIST DISK
SELECT DISK # (replace # with Win7 target HD #)
CLEAN ALL
Exit

Now reboot into Win7 installer to Custom install using Drive Options to Create New partition and format.

 

[Night Hawk]

From what I've seen the Vipre is quite thorough at detection of any infected files as well as things hidden in downloads along some freewares. The restore points should be wiped by turning off the system restore feature and later back to see new ones created.

As for total nuking a drive of everything with no chance of recovering data you should a good security tool like Eraser. Eraser That one repeatedly writes patterns while others continuously write binary 0s in order to insure no traces of anything are left.

First let's see how well things go since wiping a drive is generally a last not first resort to consider.

 

[merkat106]

Okay I learned my lesson

After another broken repair install. CMD still doesn't work and now no wireless. Niether Malwarebytes nor Norton find anything. BTW: trying to install 7 sp1 failed & told me to a repair install.

So I am going to reformat and do a clean install on this laptop. Too bad I can't rep on such an old thread.

 

[Night Hawk]

It sounded all too well like you were running into all this from something being corrupted in the registry or missing system files even possible bad ram.

While you are at it you may want to run memtest or another stress tester just to rule out any possibiliy of a bad dimm being present. Bad ram is known for all kinds of headaches.

On one old old case being looked over for a few days only 512mb had been available until getting in there and reseating the pair of dimms where it now shows 1gb in System. Something you generally wouldn't look at can often be the source of numerous problems until found.

 

[gregrocker]

Be sure to wipe the HD first in case you have infection.

After install, install lean mean free Microsoft Security Essentials instead of the more bloated Norton, then use the Windows Firewall. This can improve performance greatly.

 

[Night Hawk]

The eraser tool will literally take care of "everything" on the drive as well as using the DiskPart command "clean all" while booted live from a 7 dvd. But that would be taking things a bit too far especially if you lack any recovery disk. The quick way however requires a live disk just the same to see the C primary not the recovery partition removed for a new one to be created and formatted for use.

On previous builds when simply repairing things rather then a clean install on a new primary things never did go so well. Once you have a fresh primary and good clean install on you will want to create a good image of the drive for safe keeping unless you discover the drive is having problems of it's own.

 

[merkat106]

All fixed...

1. using command prompt in my 7 disc, i issued the format command. it took several hours, but once that was done. i did a clean install of 7 pro. no problems carried over.

2. put norton is back. will never trust ms security essntials since it was its failure to stop malware which originally messed up this laptop (removing the malware messed up the following in the os: command prompt, ctrl+alt+delete, corruption is user account which affects taskbar, inability to install either adobe cs2 or 7 sp1 beta)

3. adobe cs2 installed normally now

fyi: norton isn't bloated anymore and is an effective av software. norton of several (3+) years ago was bloated. norton has saved my butt on many ocassions. i have tried many types of av.

 

[Night Hawk]

People unfortunately as you have learned place a little bit roo much confidence in "any" one program including Norton as a rule. That again is another mistake! Multiple layers will always be far more effective then pointing to one program by itself.

As far as the MS SE that only reported one trojan placed on the drive after it was already on for awhile when the former av's IE security toolbar was temporary disabled while running .... Guess what? a search on Bing! The new av program on now replaces the need for any IE secuirity bar and will actually block out any sites detected with any malous type coding before you even see it!

Again that's one program far more updated then most others also including it's own firewall. The funny thing is that you generally will forget it's even installed since it barely leaves a light foot print on resources. Is it ever 1000% fool proof? Nothing is since it clashed when going to download the WLive Essentials beta's web installer for some reason! Firewall against Live Safety scanner or something like that.

As far reformatting any drive seeing that take hours? Why? you can simply nuke any primary and create a new one to replace it in only a few minutes including the format of the file system to be used. But at lest you have that one solved.

 

[gregrocker]

I've now put MSE on about 100 installs without a single infection or issue. Replaced Avast on my Dad's computer after it failed to stop a phony virus scan alert that infected him completely.

I accepted an invitation from a colleague here to try Norton's new alleged non-bloated 24/7 protection. It felt like my Win7 was in some kind of deathgrip - no more instantaneous anything. Even uninstalling it with Revo advanced mode, then Sys Restore couldn't get me back to instant response. Had to reimage after cleaning HD.

 

[Night Hawk]

Like most av programs it failed to prevent the trojan from being placed on the system in the first place. The additional layer of protection is seen when you something referred to as IE protection which filters bad sites upon detection of malicious coding such as phising sites as one example.

On the main system here the VIPRE Premium includes a very effective firewall as well as av, adware, spyware, and rootkit protections. It's not free however with the 2yr. license. It certainly has done far more then any other av program tried out over the years being far more updated.

The good thing however is hearing the news there! Merkat106 Often it takes a full clean install if you are unable to clean off any nasty infection.