An "NTLDR is missing" error message

[Nick]

Way to go Grasshopper, avast was giving you a false positive .

Try the OTL again with avast disabled , and the other ones i posted .

 

[Darol Wester]

Both OTL's get to the test page and once I press them to go, it just locks the pc up. I have to reboot to get out of it. The ESET won't let me get past the Terms of Use page. That's all with Avast disabled.

 

[Nick]

Try the other ones in post 42

 

[Darol Wester]

That's what I did. On #42, the 2 OTL's won't go, we got Security Check and FARBAR to work and ESET won't.

 

[Nick]

I reported Security Check issue to Avast.



As for Eset try different browser.

 

[Darol Wester]

Is it one of their programs?

 

[Nick]

It is a issues with Avast . they will update the fix for you .

Did you delete OTL , and try IE ?

 

[Nick]

Try running Temp file cleaner , and junkfile remover . [JRT].

 

[Darol Wester]

TFC won't run, but here's the other.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Microsoft Windows XP x86
Ran by Wester on Thu 01/09/2014 at 18:01:30.81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{562B9317-C08A-444A-9482-62080DD851AE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\im



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\mypc backup"





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 01/09/2014 at 18:14:19.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[Nick]

Running any better ? Try TFC again in safe mode .

 

[Nick]

Also try Eset under a different browser . It is a online scanner for infections . the best out there . It will take a hour or two depending on your computer [etc].

 

[Darol Wester]

Running any better ? Try TFC again in safe mode .

Much better than it was. Tried TFC in SM but the icon on desktop isn't there as in regular mode????? No access to the internet. Looked in downloads for it, but the page was blank.

Also try Eset under a different browser . It is a online scanner for infections . the best out there . It will take a hour or two depending on your computer [etc].

Tried ESET with IE but I got the same response. Can't get past the Terms of Use page????

I'm going to have to put this on pause Nick. I have to leave in an hour for 4 days. I'll jump back on it when I return.

I also want to say how very VERY much I appreciate your help and all the time you've invested in this. I wouldn't want to be a virus with you on my trail. Thanks my friend.

 

[Nick]

Welcome , We'll get you up and running when you get back . When you say you have no access to the net how are you posting ?

 

[Floorist]

Welcome , We'll get you up and running when you get back . When you say you have no access to the net how are you posting ?

Smoke signals?

 

[Nick]

Him gave em strong medicine .

 

[Nick]

Darol, Run this instead...



Please run F-Secure Online Scanner
http://www.f-secure.com/en/web/home_us/online-scanner


Disable your Antivirus program.
Click on Run now button.
NOTE. If you're using non-IE browser you'll be asked to download small file (F-SecureOnlineScanner.exe). After downloading double click on the file to run the scan.
Click on Start button.
Click on "Accept" button.
When scan is done, in Step 3: Clean the files, leave all settings as they're.
Click Next button.
Click Full report... button.
Copy report's content and paste it into your next reply.

--------------------------------------------------------------------------------

 

[Darol Wester]

OK. Back on it. First, the only place I haven't been able to access the internet is in Safe Mode when trying things there. Second, I tried the f-secure and while it was checking for conflicts, it came up with just one, Avast. It says it needs to uninstall the software for it to be able to continue and I did have avast turned off. ???????

 

[Nick]

Uninstall it using revo uninstaller. Check the advance circle , and delete everything in bold . You can reinstall it after the software runs .

http://www.majorgeeks.com/files/details/hijackthis.html

Then run A quick scan on Hi Jack this and post the log .

http://www.majorgeeks.com/files/details/hijackthis.html

 

[Darol Wester]

Before I lose this.


Scanning Report
13 January 2014 17:57:08 - 18:03:39

Computer name: HOMESYSTEM
Scanning type: Virus and spyware scan
Target: System
Result: 1 malware found
TrackingCookie.Webtrends (Tracking cookie)

Action: quarantined

Statistics
Scanned:

Files: 4241
Not scanned: 0

Result:

Viruses: 0
Spyware: 1
Suspicious items: 0
Riskware: 0

Actions:

Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 1
Failed: 0

Boot Sectors:

Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0

Options
Definitions version:

Viruses: 2014-01-13_01
Spyware: 2014-01-13_01

Scanning Engines:

F-Secure Hydra: 5.05.7110, 2014-01-13
F-Secure Online: 13.40.159, 0-00-00
F-Secure Gemini: 3.02.208, 2014-01-10

Scanning options:

Scan defined files: ANI ASP AX BAT BIN BOO CHM CMD COM CPL DLL DOC DOT DRV EML EXE HLP HTA HTM HTML HTT INF INI JOB JS JSE LNK LSP MDB MHT MPP MPT MSG MSO OCX PDF PHP PIF POT PPT RTF SCR SHS SWF SYS TD0 VBE VBS VXD WBK WMA WMV WMF WSC WSF WSH WRI XLS XLT XML CLASS ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
Scan inside archives

Actions:

Viruses: Ask after scan
Spyware: Ask after scan

 

[Nick]

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL



Under the Custom Scans/Fixes box at the bottom, paste in the following:



:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]


Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.


2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:


Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.


If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)