BleepingComputer.com: Xp Does't Start After Combofix Run

Hello ,

sorry,I know, I had to ask for expert advise earlier, but here it goes:

I had my Windows XP pro SP2 infected with Virtumonde malware
and after my unsuccessful attempt to remove it using FSecure I
decided to try Combofix to fix it and I’m now totally terrified by the result
as the XP doesn’t start, OS loader appears, but later I can see only
a black desktop.
In the end of Combofix clean there were a few error messages regarding windows security
files back-up and smth else, but I cannot recall them exactly.

I did not swith antivirus (FSecure) and did not install XP recovery console before running ComboFix.


I'm terrified by the thought that I 'll lose all the files on my harddrives. Please help me if you can!

Atriad, your new topic is here:

http://www.bleepingcomputer.com/forums/topic138002.html

Laska, please be patient while we get someone to help you.

Hi, Laska

Welcome to Bleeping Computer.

In order to restore your computer, we will need the XP Installation CD to boot the computer to the Recovery Console.

Boot the computer using the XP CD. You may need to change the boot order in the system BIOS so the CD boots before the hard drive. Check your system documentation for steps to access the BIOS and change the boot order.

At boot, you will be prompted with the following options:

A. To setup Windows XP, press Enter.
B. To repair Windows XP installation using recovery console, press R.

Choose the option, "To repair the Windows XP installation using recovery console", press R. If an Administrator Password have been established, you will be prompted to type it in. If no Administrator Password exists, just press ENTER.

You will be presented with the following:

Quote

Press the number 1 on your keyboard and hit Enter.

At the command prompt, type the following command and press Enter:

cd erdnt\hiv-backup

At the next prompt, type the following bolded text, and press Enter:

batch erdnt.con

The erunt backups will begin copying.

Type exit when finished, and then press ENTER to quit Recovery Console. Remove the CD and let the computer start.

Let us know how it goes.

Hi JSntgRvr
thanks a lot for this , you made my day! I did as instructed and everything seems to be running fine now
and those nasty Virtumonde pop-ups went away ,
but I keep getting 2 strange error messages on the start up though:

RUN DLL
Error loading C:\WINDOWS\system32\gytjjrhx.dll

The specified module cannot be found

RUN DLL

Error loading C:\WINDOWS\system32\joycsaio.dll

are they related to the infection? and how can I check that my machine is 100% clean now?

Many thanks again for your help!

Hi, Laska

You are welcome!

I would suggest you open a topic in the Malware forum and have that computer check by one of the authorized team members (You must include a Hijackthis log when posting):

http://www.bleepingcomputer.com/forums/forum22.html

Best wishes!