: For other users who are reading topics in the HJT-Malware Removal Forum
,the instructions provided in this topic are for the original topic starter ONLY
. Even if you have similar problems or even log entries to those given here, please do not follow the directions, especially those involving specific tools and scripts. Doing so can result in serious damage to your computer. Instead, please start your own topic and feel free to link to any relevant topics as needed.Please Do NOT
follow the instructions provided for this topic.
Therefore, I suggest you DO NOT follow the instructions in that topic (iaff284).
Please perform the following actions.Backup Registry with ERUNT
This tool will create a complete backup of your registry. A backup is created to ensure we have backup so encase anything goes wrong we can deal with it. Do not delete these backups until we are finished.
- Please download erunt-setup.exe to your desktop.
- Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
- Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:http://www.larshederer.homepage.t-online.de/erunt/erunt.txtHow to Restore from the ERUNT BackupOnly restore from the backups if instructed to, or you need to do so. You need it if after doing something, your computer will only boot in Safe Mode and you are unable to contact us (or anyone else) for help by other means, or if your computer will not boot into Windows at all.
To restore if you can boot, navigate to C:\WINDOWS\erdnt, choose the folder with the most recent date, and double click ERDNT.EXE. Check all boxes in the restoration options.
To restore from the Recovery Console using the Windows CD:
Create and Run batch script
- Turn on your machine with the disk in the drive.
- Type in the number of the Windows installation you want to repair (usually 1), then press Enter.
- Type in the Administrator password (leave blank if you are unsure what it is or if you do not have one) and press Enter.
- Type without quotes "cd erdnt" followed by Enter.
- Type without quotes "dir" followed by Enter. This will list out the available folders, whose names are the date on which the backup was taken in (M)M-DD-YYYY format. Try the most recent dates first.
- Type without quotes "cd **name of the folder**" followed by Enter.
- Type without quotes "batch erdnt.con" followed by Enter.
- Type without quotes "exit" followed by Enter.
- Remove your CD from the drive and reboot your computer into the restored registry. If you still cannot boot, try again with an earlier restore date.
When done properly, the icon should look like for the .bat file.
- Copy the following into a notepad (Start>Run>"notepad"). Do not copy the word "quote".
If exist "C:\looking.txt" Del /q /s "C:\looking.txt"
reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\drivers32" >> C:\looking.txt
- Click File, then Save As... .
- Click Desktop on the left.
- Under the Save as type dropdown, select All Files.
- In the box File Name, input peek.bat.
- Hit OK.
Double click on peek.bat, and Black DOS window shall appear and then notepad will soon
open. This is normal please do not panic. Once it's complete copy and paste the contents of notepad in your next reply.Note: If you closed notepad accidentally, it can also be found at C:\looking.txt
I cannot run regedit from the start\run menu but I have a copy of rehence to access the registry.
What do you mean you have a copy of rehence? Refrence you mean, if so what refrence?
Run MBAM scan again. Update it first and then do a quick scan.
Post back with:-Looking log
-MBAM Scan log