Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lose 10GB after JRT cleaning


  • Please log in to reply
7 replies to this topic

#1 familydog

familydog

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 27 May 2014 - 06:04 AM

Hi all,

I'm the new stupid who ran JRT without taking too seriously its advice "Run at your own risk". I know I'm the guitly, but notheless it never happened to me before with any other similar tool.
I was trying to remove that "swee-page.com" bleep... I unlucky disabled time ago the System Restore Point, don't even remember why, maybe to save space in HDD... didn't think about about it before to run JRT.
The first thing I notice while it runs are some reported errors ("Not accessible area" or something similar, as far as I remember)... second thing is my "quick launch bar", it disapperead. I try to run some software, but almost all links on my desktop report me "Impossible to find". Than I try to launch the softwares directly from their directory, and surprise, no CCleaner, no Photoshop (or any other software from the Adobe suite), no CorelDRAW... one of the few still there was Skype, don't know why.
I check my free space on disk C and I'm shocked, almost 10GB of data disapperead!
I would like now to restore my previous situation before to use JRT (or anything quite similar)... I read JRT save a registry backup in C:\WINDOWS\ERUNT\JRT, but have no idea which file and how to use it. Can you please give me any help?
I also guess that even if I restore registry, I won't have back all my softwares (and who knows what else I lost)... have any idea if I can use some tool to restore those files? Something like Recuva by Piriform, but with the feature to restore files in their original directory...
Thanks in advance and anyway


Edited by hamluis, 27 May 2014 - 08:53 AM.
Moved from XP to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


m

#2 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,589 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:02:35 PM

Posted 27 May 2014 - 07:23 PM

G'day familydog, and :welcome: to BC !!

 

We can start by uninstalling any of these programs......they may be present in add/remove or programs and features...depending on your OS....or they may not be......but if they are, uninstall them ....read below...

 

When the Programs and Features or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and uninstall Sweet-Page uninstaller, WPM17.8.0.3159, Sweet-Page.com Browser new tab extension, IePluginService, SupTab and any other recently installed unknown program from your computer.
To view the most recently installed programs, you can click on the “Installed On” column to sort your program by the installation date. Scroll though the list, and uninstall any unwanted or unknown programs.

 

You can post these results one at a time or altogether.....your choice !

 

Then..

..Reset your Browser/s...(whichever one/s apply to you..)

https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

http://support.microsoft.com/kb/923737

https://support.google.com/chrome/answer/3296214?hl=en

If you use Chrome....there may be an extension there called  Extended Protection 1.9, Lightning Newtab  ....get rid of it and any others that you did not install.

Be sure to reset any default search engine/home page back to Google or whatever you normally use.

 

Then..

 

Please download AdwCleaner by Xplode and save to your Desktop.
NOTE : Please close or save all work, as the computer will be Rebooted
Double-click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button. (only once)
AdwCleaner will begin...be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
If you see any which you do not want removed, remove the check mark next to it.
Next: Click on the Clean button (only once) to remove the selected items.
You will receive a message telling you that all programs will be close so that the infections can be removed.
Click on OK, and then OK again to confirm the reboot.
When cleaning process is complete a log (AdwCleaner[S0].txt ) of what was removed will be on your desktop.
Please copy and the paste this log in your next post.

 

A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

 

* Download  Malwarebytes Anti-Malware Free  and save it to your desktop
* Double click the desktop icon, click Run, then OK
* Click Next
* Select I accept the agreement then continue to click Next then finally click Install
** Uncheck Enable free trial of Malwarebytes Anti-Malware Premium if you do not want the free trial of the paid version, then click Finish
* If you are notified the Database is out of date click Update Now
* Click Scan Now >>

----------

 

** Note: If Malwarebytes will not launch please do the following to launch Malwarebytes Chameleon:
* Click Start (Start, Search, All files and folders for Windows XP) then type mbam
* Double click one of the four following files (if one does not work try the next one, and so on) - A black command window will open.

* Follow those instructions until the Malwarebytes program starts the scan

 mbam-chameleon.scr
mbam-chameleon
mbam-chameleon.exe
mbam-chameleon.com

----------

 ** When completed click the down arrow on Export Log and select Text file (*.txt)
* Save the file to your desktop as MBAM
* Click Apply Actions then restart your computer if requested
* Copy and past the contents of MBAM.txt in your reply

 

 

And.....lastly.....

 

I would like you to use the ESET OnlineScanner -
This is best done with Internet Explorer, as it uses ActineX  with the scan
How-ever alternate directions are left for thise that will not use Internet Explorer
Please read and follow How To Temporarily Disable Your Anti-virus during the scan.
1 / Hold down Control (Ctrl) key and click on This Link to open ESET OnlineScan in a new window.
2 / Click the  ESET Onliner Scanner button.
3 / For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

3.1 - / Click on This Link to download theExternal ESET Smart Installer.
3.2 - / Save it to your desktop.

4 / Double click on the  icon on your desktop.
5 / Check "YES, I accept the Terms of Use."
5 / Click the Start button.
6 / Accept any security warnings from your browser.
7 / Under scan settings, check "Scan Archives" and "Remove found threats"
8 / Click Advanced settings and select the following:
* Scan potentially unwanted applications
* Scan for potentially unsafe applications
* Enable Anti-Stealth technology
9 / ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this will take some time.
10 / When the scan completes, click List Threats
11 / Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12 / Click the Back button.
13 / Click the Finish button.
NOTE:Sometimes if ESET finds no infections it will not create a log.


Condobloke

Outback Australian  

 

fed up with Windows antics...??

 

LINUX IS THE ANSWER

 

I USE LINUX MINT 18.3  EXCLUSIVELY.

 Failure is not an option. It comes bundled with your Microsoft product.

 

Success is not Final, Failure is not Fatal,

 

It is the Courage to Continue that Counts.

W.C. 4th June 1940

 

 

 


#3 familydog

familydog
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 27 May 2014 - 08:13 PM

Thanks for participating Condobloke, but as I wrote: "I would like now to restore my previous situation before to use JRT (or anything quite similar)", the priority is no more that little Sweet-page, I've lost 10GB of data...

#4 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,589 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:02:35 PM

Posted 27 May 2014 - 08:50 PM

What exactly do you mean by data ??....pics, documents....

How certain are you that it is actually gone.....it is quite possible that sweet etc has altered the shortcuts to the programs you use....

 

Go to your browser shortcut (Desktop, Taskbar or Start Menu Shortcut), then right click on it and select Properties.

 

(To view the Properties menu for the browser shortcuts pinned to your Task Bar, right-click on the browser shortcut from the Taskbar, then right-click again on the browser icon as see in the below image. Alternatively, you can just Unpin the browser shortcut from your task bar, then you can add it back after you have removed the “Sweet-Page.com” argument from the original browser shortcut.)

 

In the Shortcut tab, in the Target field, remove the http://Sweet-Page.com argument. Basically, there should be only the path to the browsers executable file. Nothing more.
These are the default shortcut path that should be in your Target box, if the Sweet-Page.com argument is there, then you should remove it.

Internet Explorer “C:\Program Files\Internet Explorer\iexplore.exe” Chrome “C:\Program Files\Google\Chrome\Application\chrome.exe” for Windows 32 bit OR “C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” for Windows 64-bit Firefox

“C:\Program Files\Mozilla Firefox\firefox.exe” for Windows 32-bit OR “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” for Windows 64-bit

 

....and similar for any other shortcut you may choose...C:\program Files\CCleaner.exe.......

 

I may be on the wrong track here....but here's hoping !


Condobloke

Outback Australian  

 

fed up with Windows antics...??

 

LINUX IS THE ANSWER

 

I USE LINUX MINT 18.3  EXCLUSIVELY.

 Failure is not an option. It comes bundled with your Microsoft product.

 

Success is not Final, Failure is not Fatal,

 

It is the Courage to Continue that Counts.

W.C. 4th June 1940

 

 

 


#5 familydog

familydog
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 28 May 2014 - 05:58 AM

What exactly do you mean by data ??....pics, documents....

For sure, executable files... also if not all of them. But from Photoshop to Outlook Express, they've gone. Not sure if during the same cleaning by JRT also libraries and other kind of files have been deleted... but from a scanning with Recuva, I could see many files deleted recently, not only executables.

How certain are you that it is actually gone.....it is quite possible that sweet etc has altered the shortcuts to the programs you use....

Maybe my english is not good enough, sorry. In my first message I tried to explain that having been seen shortcuts were not working, I tried to search for executables in their own installation folders, finding them empty (or anyway, not with executable files, with few exceptions).



#6 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,589 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:02:35 PM

Posted 28 May 2014 - 06:04 AM

I think you should allow the Experts here to take a look for you. ....and btw your English is quite good !

 

Please Fully read and follow the instructions in the Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help starting at Step #6.

    Note :If you are unable to complete any step, still post the topic and leave a full description of your problems.

    

    When you have done that, start a new topic and post the required logs to
  Virus, Trojan, Spyware, and Malware Removal Logs forum forum, NOT Here, for assistance by the Malware Response Team Experts.

    

    Please Use Copy / Paste for your responses, and Do Not Attach them unless your helper requests this.

    

    If HelpBot responds to your topic, please follow his Step #1 so the team will be notified.

    

    After doing this, please reply back in this thread with a link to the new topic so we can close this one.


Edited by Condobloke, 28 May 2014 - 06:09 AM.

Condobloke

Outback Australian  

 

fed up with Windows antics...??

 

LINUX IS THE ANSWER

 

I USE LINUX MINT 18.3  EXCLUSIVELY.

 Failure is not an option. It comes bundled with your Microsoft product.

 

Success is not Final, Failure is not Fatal,

 

It is the Courage to Continue that Counts.

W.C. 4th June 1940

 

 

 


#7 familydog

familydog
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 28 May 2014 - 06:04 AM

Sorry if I try to make it shorter: I'm now basically looking for a way to restore the back-up registry file created by JRT and a software that could restore all deleted files in their original folder. In other words, I'm trying to have back my laptop as before using JRT, I will think about Sweet-page.com a next time...
Thanks again



#8 familydog

familydog
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 28 May 2014 - 06:05 AM

Thanks Condobloke, I will follow your suggestion.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users