I just realized that I don't need to write the script I was because there was another tool used this forum where I think it's allowed since it was used before. Please do the following.Backup Registry with ERUNT
This tool will create a complete backup of your registry. A backup is created to ensure we have backup so encase anything goes wrong we can deal with it. Do not delete these backups until we are finished.
- Please download erunt-setup.exe to your desktop.
- Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
- Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:http://www.larshederer.homepage.t-online.de/erunt/erunt.txtHow to Restore from the ERUNT BackupOnly restore from the backups if instructed to, or you need to do so. You need it if after doing something, your computer will only boot in Safe Mode and you are unable to contact us (or anyone else) for help by other means, or if your computer will not boot into Windows at all.
To restore if you can boot, navigate to C:\WINDOWS\erdnt, choose the folder with the most recent date, and double click ERDNT.EXE. Check all boxes in the restoration options.
To restore from the Recovery Console using the Windows CD:
- Turn on your machine with the disk in the drive.
- Type in the number of the Windows installation you want to repair (usually 1), then press Enter.
- Type in the Administrator password (leave blank if you are unsure what it is or if you do not have one) and press Enter.
- Type without quotes "cd erdnt" followed by Enter.
- Type without quotes "dir" followed by Enter. This will list out the available folders, whose names are the date on which the backup was taken in (M)M-DD-YYYY format. Try the most recent dates first.
- Type without quotes "cd **name of the folder**" followed by Enter.
- Type without quotes "batch erdnt.con" followed by Enter.
- Type without quotes "exit" followed by Enter.
- Remove your CD from the drive and reboot your computer into the restored registry. If you still cannot boot, try again with an earlier restore date.
Please download OTMoveIt3 by OldTimer
and save it to your desktop. How to Boot into Safe ModeI suggest you read over the instructions on how to boot into Safe Mode and then print these instructions out or save them in Notepad because you won't have access to this page while in Safe Mode.
Start in Safe Mode Using the F8 method:
Your computer will proceed to booting into Safe Mode. During the boot process, you may see random code go past your screen. Simply wait for it to pass. Your computer should boot like usually, except with Safe Mode written in the corners of your screen. Your screen may also appear to be a different size because the video drivers are not loaded properly in Safe Mode.
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
- Use your arrow keys to navigate and highlight Safe Mode.
- Hit Enter.
- You will now be asked to choose your operating system. Again, use the arrow keys to select Microsoft Windows XP.
- Hit Enter.
After the boot, you will be asked whether you wish to use system restore, or to continue to Safe Mode. Select OK to choose Safe mode.
Additional instructions on booting into Safe Mode
can be found hereDownload and Run OTMoveIT3Note:If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Post back with the:-OTMoveIT log
-Does MBAM still detect those entries?