[Inactive] google redirect virus

Printable View

Show 40 post(s) from this thread on one page

July 1st, 2012, 06:23 PM
Broni
You will need a USB flash drive.

Download GETxPUD.exe to the desktop of your clean computer
- Run GETxPUD.exe
- A new folder will appear on the desktop.
- Open the GETxPUD folder and click on the get&burn.bat
- The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
- Click on Start and follow the prompts to burn the image to a CD.
- Next download rst.sh to your USB flash drive
- Remove the USB & CD and insert it in the sick computer
- Boot the Sick computer with the CD you just burned
- The computer must be set to boot from the CD
- Gently tap F12 and choose to boot from the CD
- Follow the prompts
- A Welcome to xPUD screen will appear
- Press File
- Expand mnt
- sda1,2...usually corresponds to your HDD
- sdb1 is likely your USB
- Click on the folder that represents your USB drive (sdb1 ?)
- Confirm that you see rst.sh that you downloaded there
- Press Tool at the top
- Choose Open Terminal
- Type bash rst.sh
- Press Enter
- After it has finished a report will be located on your USB drive named enum.log
- Remove the USB drive and insert it back in your working computer and navigate to enum.log
  
  Please note - all text entries are case sensitive
Copy and paste the enum.log for my review
July 2nd, 2012, 11:49 PM
vbforge

clarify

please be specific do I need a CD OR DVD Can it have prior information that was deleted or must it be new and blank. Is there a size minimum. Sorry I don't know much about this.
July 2nd, 2012, 11:54 PM
Broni

Blank CD R would be the best.
July 6th, 2012, 06:13 PM
vbforge

her it is

27.4M Jul 1 03:29 /mnt/sda2/WINDOWS/system32/config/SOFTWARE
7.8M Jul 1 03:29 /mnt/sda2/WINDOWS/system32/config/SYSTEM

25.3M Apr 18 00:30 /sda2/~/RP1108/~SOFTWARE
25.9M Apr 19 01:31 /sda2/~/RP1109/~SOFTWARE
25.9M Apr 20 02:56 /sda2/~/RP1110/~SOFTWARE
25.9M Apr 21 03:31 /sda2/~/RP1111/~SOFTWARE
25.9M Apr 22 05:21 /sda2/~/RP1112/~SOFTWARE
25.9M Apr 23 07:21 /sda2/~/RP1113/~SOFTWARE
25.9M Apr 24 14:39 /sda2/~/RP1114/~SOFTWARE
25.9M Apr 25 00:54 /sda2/~/RP1115/~SOFTWARE
26.1M Apr 26 03:03 /sda2/~/RP1116/~SOFTWARE
26.1M Apr 27 03:37 /sda2/~/RP1117/~SOFTWARE
26.1M Apr 28 04:18 /sda2/~/RP1118/~SOFTWARE
26.1M Apr 29 05:35 /sda2/~/RP1119/~SOFTWARE
26.1M Apr 30 07:35 /sda2/~/RP1120/~SOFTWARE
26.1M May 1 21:09 /sda2/~/RP1121/~SOFTWARE
26.1M May 2 22:50 /sda2/~/RP1122/~SOFTWARE
26.1M May 4 00:50 /sda2/~/RP1123/~SOFTWARE
26.1M May 5 01:52 /sda2/~/RP1124/~SOFTWARE
26.1M May 6 03:52 /sda2/~/RP1125/~SOFTWARE
26.1M May 7 06:24 /sda2/~/RP1126/~SOFTWARE
26.1M May 8 07:19 /sda2/~/RP1127/~SOFTWARE
26.1M May 10 07:00 /sda2/~/RP1129/~SOFTWARE
26.1M May 11 07:22 /sda2/~/RP1130/~SOFTWARE
26.1M May 12 09:22 /sda2/~/RP1131/~SOFTWARE
26.1M May 14 02:26 /sda2/~/RP1132/~SOFTWARE
26.2M May 15 06:32 /sda2/~/RP1133/~SOFTWARE
26.2M May 16 07:26 /sda2/~/RP1134/~SOFTWARE
26.2M May 17 09:26 /sda2/~/RP1135/~SOFTWARE
26.2M May 18 11:30 /sda2/~/RP1136/~SOFTWARE
26.2M May 19 11:54 /sda2/~/RP1137/~SOFTWARE
26.2M May 20 13:54 /sda2/~/RP1138/~SOFTWARE
26.2M May 21 16:13 /sda2/~/RP1139/~SOFTWARE
26.2M May 22 19:13 /sda2/~/RP1140/~SOFTWARE
26.2M May 24 02:23 /sda2/~/RP1141/~SOFTWARE
26.2M May 25 14:44 /sda2/~/RP1142/~SOFTWARE
26.2M May 25 14:51 /sda2/~/RP1143/~SOFTWARE
26.2M May 25 14:53 /sda2/~/RP1144/~SOFTWARE
26.3M May 25 15:01 /sda2/~/RP1145/~SOFTWARE
26.3M May 26 07:00 /sda2/~/RP1146/~SOFTWARE
26.3M May 27 05:47 /sda2/~/RP1147/~SOFTWARE
26.3M May 27 13:40 /sda2/~/RP1148/~SOFTWARE
26.3M May 29 13:40 /sda2/~/RP1150/~SOFTWARE
26.3M May 30 13:40 /sda2/~/RP1151/~SOFTWARE
26.3M May 31 13:40 /sda2/~/RP1152/~SOFTWARE
26.3M Jun 1 13:41 /sda2/~/RP1153/~SOFTWARE
26.3M Jun 2 13:40 /sda2/~/RP1154/~SOFTWARE
26.3M Jun 3 05:46 /sda2/~/RP1155/~SOFTWARE
26.3M Jun 3 13:40 /sda2/~/RP1156/~SOFTWARE
26.3M Jun 4 07:00 /sda2/~/RP1157/~SOFTWARE
26.3M Jun 5 07:22 /sda2/~/RP1158/~SOFTWARE
26.3M Jun 5 07:30 /sda2/~/RP1159/~SOFTWARE
26.3M Jun 5 20:26 /sda2/~/RP1160/~SOFTWARE
26.3M Jun 6 20:26 /sda2/~/RP1161/~SOFTWARE
26.3M Jun 7 20:26 /sda2/~/RP1162/~SOFTWARE
26.3M Jun 8 20:26 /sda2/~/RP1163/~SOFTWARE
26.3M Jun 9 20:27 /sda2/~/RP1164/~SOFTWARE
27.3M Jun 10 04:35 /sda2/~/RP1165/~SOFTWARE
27.3M Jun 10 06:38 /sda2/~/RP1166/~SOFTWARE
27.3M Jun 11 13:22 /sda2/~/RP1167/~SOFTWARE
27.3M Jun 11 14:02 /sda2/~/RP1168/~SOFTWARE
27.3M Jun 12 21:41 /sda2/~/RP1169/~SOFTWARE
27.3M Jun 13 18:54 /sda2/~/RP1171/~SOFTWARE
27.3M Jun 14 01:26 /sda2/~/RP1172/~SOFTWARE
27.3M Jun 14 03:23 /sda2/~/RP1173/~SOFTWARE
27.3M Jun 14 07:00 /sda2/~/RP1174/~SOFTWARE
27.3M Jun 15 07:36 /sda2/~/RP1175/~SOFTWARE
27.3M Jun 15 17:15 /sda2/~/RP1176/~SOFTWARE
27.3M Jun 16 17:12 /sda2/~/RP1177/~SOFTWARE
27.3M Jun 17 17:12 /sda2/~/RP1178/~SOFTWARE
27.3M Jun 18 03:29 /sda2/~/RP1179/~SOFTWARE
27.3M Jun 19 04:29 /sda2/~/RP1180/~SOFTWARE
27.3M Jun 19 09:20 /sda2/~/RP1181/~SOFTWARE
27.4M Jun 20 14:29 /sda2/~/RP1182/~SOFTWARE
27.4M Jun 21 02:12 /sda2/~/RP1183/~SOFTWARE
27.4M Jun 22 03:24 /sda2/~/RP1184/~SOFTWARE
27.4M Jun 22 17:02 /sda2/~/RP1185/~SOFTWARE
27.4M Jun 23 17:03 /sda2/~/RP1186/~SOFTWARE
27.4M Jun 23 19:21 /sda2/~/RP1187/~SOFTWARE
27.4M Jun 24 03:48 /sda2/~/RP1188/~SOFTWARE
27.4M Jun 24 05:34 /sda2/~/RP1189/~SOFTWARE
27.4M Jun 24 12:24 /sda2/~/RP1190/~SOFTWARE
27.4M Jun 24 14:50 /sda2/~/RP1191/~SOFTWARE
27.4M Jun 24 15:10 /sda2/~/RP1192/~SOFTWARE
27.4M Jun 24 17:31 /sda2/~/RP1193/~SOFTWARE
27.4M Jun 24 17:32 /sda2/~/RP1194/~SOFTWARE
27.4M Jun 24 17:53 /sda2/~/RP1195/~SOFTWARE
27.4M Jun 25 17:57 /sda2/~/RP1196/~SOFTWARE
27.4M Jun 25 18:04 /sda2/~/RP1197/~SOFTWARE
27.4M Jun 26 17:54 /sda2/~/RP1198/~SOFTWARE
27.4M Jun 27 16:44 /sda2/~/RP1199/~SOFTWARE
27.4M Jun 28 16:43 /sda2/~/RP1200/~SOFTWARE
27.4M Jun 29 06:10 /sda2/~/RP1201/~SOFTWARE
27.4M Jun 30 06:11 /sda2/~/RP1202/~SOFTWARE
27.4M Jun 30 07:12 /sda2/~/RP1203/~SOFTWARE
25.1M Apr 17 21:37 /sda2/~/RP1107/~SOFTWARE
26.1M May 9 09:19 /sda2/~/RP1128/~SOFTWARE
26.3M May 28 13:41 /sda2/~/RP1149/~SOFTWARE
27.3M Jun 12 22:12 /sda2/~/RP1170/~SOFTWARE
25.1M Apr 14 19:10 /sda2/~/RP1104/~SOFTWARE
25.1M Apr 15 19:37 /sda2/~/RP1105/~SOFTWARE
25.1M Apr 16 21:01 /sda2/~/RP1106/~SOFTWARE
7.6M Apr 18 00:30 /sda2/~/RP1108/~SYSTEM
7.6M Apr 19 01:31 /sda2/~/RP1109/~SYSTEM
7.6M Apr 20 02:56 /sda2/~/RP1110/~SYSTEM
7.6M Apr 21 03:31 /sda2/~/RP1111/~SYSTEM
7.6M Apr 22 05:21 /sda2/~/RP1112/~SYSTEM
7.6M Apr 23 07:21 /sda2/~/RP1113/~SYSTEM
7.6M Apr 24 14:39 /sda2/~/RP1114/~SYSTEM
7.6M Apr 25 00:54 /sda2/~/RP1115/~SYSTEM
7.6M Apr 26 03:03 /sda2/~/RP1116/~SYSTEM
7.6M Apr 27 03:37 /sda2/~/RP1117/~SYSTEM
7.6M Apr 28 04:18 /sda2/~/RP1118/~SYSTEM
7.6M Apr 29 05:35 /sda2/~/RP1119/~SYSTEM
7.6M Apr 30 07:35 /sda2/~/RP1120/~SYSTEM
7.6M May 1 21:09 /sda2/~/RP1121/~SYSTEM
7.6M May 2 22:50 /sda2/~/RP1122/~SYSTEM
7.6M May 4 00:50 /sda2/~/RP1123/~SYSTEM
7.6M May 5 01:52 /sda2/~/RP1124/~SYSTEM
7.6M May 6 03:52 /sda2/~/RP1125/~SYSTEM
7.6M May 7 06:24 /sda2/~/RP1126/~SYSTEM
7.6M May 8 07:19 /sda2/~/RP1127/~SYSTEM
7.6M May 10 07:00 /sda2/~/RP1129/~SYSTEM
7.6M May 11 07:22 /sda2/~/RP1130/~SYSTEM
7.6M May 12 09:22 /sda2/~/RP1131/~SYSTEM
7.6M May 14 02:26 /sda2/~/RP1132/~SYSTEM
7.6M May 15 06:32 /sda2/~/RP1133/~SYSTEM
7.6M May 16 07:26 /sda2/~/RP1134/~SYSTEM
7.6M May 17 09:26 /sda2/~/RP1135/~SYSTEM
7.6M May 18 11:30 /sda2/~/RP1136/~SYSTEM
7.6M May 19 11:54 /sda2/~/RP1137/~SYSTEM
7.6M May 20 13:54 /sda2/~/RP1138/~SYSTEM
7.6M May 21 16:14 /sda2/~/RP1139/~SYSTEM
7.6M May 22 19:13 /sda2/~/RP1140/~SYSTEM
7.6M May 24 02:23 /sda2/~/RP1141/~SYSTEM
7.6M May 25 14:45 /sda2/~/RP1142/~SYSTEM
7.6M May 25 14:51 /sda2/~/RP1143/~SYSTEM
7.6M May 25 14:53 /sda2/~/RP1144/~SYSTEM
7.6M May 25 15:01 /sda2/~/RP1145/~SYSTEM
7.6M May 26 07:00 /sda2/~/RP1146/~SYSTEM
7.6M May 27 05:47 /sda2/~/RP1147/~SYSTEM
7.6M May 27 13:40 /sda2/~/RP1148/~SYSTEM
7.6M May 29 13:40 /sda2/~/RP1150/~SYSTEM
7.6M May 30 13:40 /sda2/~/RP1151/~SYSTEM
7.6M May 31 13:40 /sda2/~/RP1152/~SYSTEM
7.6M Jun 1 13:41 /sda2/~/RP1153/~SYSTEM
7.6M Jun 2 13:40 /sda2/~/RP1154/~SYSTEM
7.6M Jun 3 05:46 /sda2/~/RP1155/~SYSTEM
7.6M Jun 3 13:40 /sda2/~/RP1156/~SYSTEM
7.6M Jun 4 07:00 /sda2/~/RP1157/~SYSTEM
7.6M Jun 5 07:22 /sda2/~/RP1158/~SYSTEM
7.6M Jun 5 07:30 /sda2/~/RP1159/~SYSTEM
7.6M Jun 5 20:26 /sda2/~/RP1160/~SYSTEM
7.6M Jun 6 20:26 /sda2/~/RP1161/~SYSTEM
7.6M Jun 7 20:26 /sda2/~/RP1162/~SYSTEM
7.6M Jun 8 20:26 /sda2/~/RP1163/~SYSTEM
7.6M Jun 9 20:27 /sda2/~/RP1164/~SYSTEM
7.6M Jun 10 04:35 /sda2/~/RP1165/~SYSTEM
7.6M Jun 10 06:38 /sda2/~/RP1166/~SYSTEM
7.6M Jun 11 13:23 /sda2/~/RP1167/~SYSTEM
7.6M Jun 11 14:02 /sda2/~/RP1168/~SYSTEM
0 Jun 12 21:41 /sda2/~/RP1169/~SYSTEM
7.6M Jun 13 18:54 /sda2/~/RP1171/~SYSTEM
7.6M Jun 14 01:26 /sda2/~/RP1172/~SYSTEM
7.6M Jun 14 03:23 /sda2/~/RP1173/~SYSTEM
7.6M Jun 14 07:00 /sda2/~/RP1174/~SYSTEM
7.6M Jun 15 07:36 /sda2/~/RP1175/~SYSTEM
7.6M Jun 15 17:15 /sda2/~/RP1176/~SYSTEM
7.6M Jun 16 17:12 /sda2/~/RP1177/~SYSTEM
7.6M Jun 17 17:13 /sda2/~/RP1178/~SYSTEM
7.6M Jun 18 03:29 /sda2/~/RP1179/~SYSTEM
7.6M Jun 19 04:29 /sda2/~/RP1180/~SYSTEM
7.6M Jun 19 09:20 /sda2/~/RP1181/~SYSTEM
7.6M Jun 20 14:29 /sda2/~/RP1182/~SYSTEM
7.6M Jun 21 02:12 /sda2/~/RP1183/~SYSTEM
7.6M Jun 22 03:24 /sda2/~/RP1184/~SYSTEM
7.6M Jun 22 17:02 /sda2/~/RP1185/~SYSTEM
7.6M Jun 23 17:03 /sda2/~/RP1186/~SYSTEM
7.6M Jun 23 19:21 /sda2/~/RP1187/~SYSTEM
7.6M Jun 24 03:48 /sda2/~/RP1188/~SYSTEM
7.6M Jun 24 05:34 /sda2/~/RP1189/~SYSTEM
7.6M Jun 24 12:24 /sda2/~/RP1190/~SYSTEM
7.6M Jun 24 14:50 /sda2/~/RP1191/~SYSTEM
7.6M Jun 24 15:10 /sda2/~/RP1192/~SYSTEM
7.6M Jun 24 17:31 /sda2/~/RP1193/~SYSTEM
7.6M Jun 24 17:32 /sda2/~/RP1194/~SYSTEM
7.6M Jun 24 17:53 /sda2/~/RP1195/~SYSTEM
7.6M Jun 25 17:57 /sda2/~/RP1196/~SYSTEM
7.6M Jun 25 18:04 /sda2/~/RP1197/~SYSTEM
7.6M Jun 26 17:54 /sda2/~/RP1198/~SYSTEM
7.6M Jun 27 16:44 /sda2/~/RP1199/~SYSTEM
7.6M Jun 28 16:43 /sda2/~/RP1200/~SYSTEM
7.6M Jun 29 06:10 /sda2/~/RP1201/~SYSTEM
7.6M Jun 30 06:11 /sda2/~/RP1202/~SYSTEM
7.6M Jun 30 07:12 /sda2/~/RP1203/~SYSTEM
7.6M Apr 17 21:37 /sda2/~/RP1107/~SYSTEM
7.6M May 9 09:19 /sda2/~/RP1128/~SYSTEM
7.6M May 28 13:41 /sda2/~/RP1149/~SYSTEM
7.6M Jun 12 22:12 /sda2/~/RP1170/~SYSTEM
7.6M Apr 14 19:10 /sda2/~/RP1104/~SYSTEM
7.6M Apr 15 19:37 /sda2/~/RP1105/~SYSTEM
7.6M Apr 16 21:01 /sda2/~/RP1106/~SYSTEM
July 6th, 2012, 08:12 PM
Broni

Please open the terminal again from your USB device and type:

bash rst.sh -r

Press Enter.

Type 1203 and press Enter.

When done restart your computer normally and see if you can successfully log on now.
July 6th, 2012, 10:42 PM
vbforge

is there a space between sh and -

do I type 1203 after r(no space) and hit enter?

please be specific
July 6th, 2012, 10:52 PM
Broni

Sorry about it. Typo.
Edited my previous post.
July 6th, 2012, 10:53 PM
vbforge

I typed bash rst.sh -r
then (enter) then 1203 (enter)

it repopulated hives

restart failed same blue screen and message as before
July 6th, 2012, 10:58 PM
Broni

Do a very same thing but this time type:
1202

If that doesn't help try:
1201
July 6th, 2012, 11:51 PM
vbforge

tried all three numbers

no change cannot boot same error message any other ideas
July 6th, 2012, 11:59 PM
Broni
Let's try to boot your computer using the Ultimate Boot CD for Windows (UBCD4win).

Please print this guide for future reference!

You will need a blank CD, a clean computer and a flash drive.

Please follow the steps below and let me know if you were successful. If you were unable to create the UBCD4win, please tell me what error messages you got and/or what steps you got hung up on.

:step1:

1. Download and Run Ultimate Boot CD for Windows
- Save it to your Desktop.
- Double-Click on the UBCD4Win.EXE that you just downloaded to your desktop.
- Follow all of the instructions/prompts that come up.
  NOTES:
  - Do not install to a folder with spaces in it's name.
  - Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read HERE for information regarding the files that normally trigger AV software.
2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive
- Double-Click on UBCD4WinBuilder.exe located in your C:\ubcd4win folder.
- Click "I agree" to the Builders License.
- Click NO to Search for Windows Installation Files
- Make the following selections from the Main Screen that pops up:
  - Builder
    Source:(path to Windows installation files)
    Enter the path to the drive where your XP CD is located.
    You can click on the "..." button on the right to navigate to the path as well.
    Custom: (include files and folders from this directory)
    No information is necessary, leave blank.
    Output: (C:\ubcd4win\BartPE)
    Keep the default BartPE
  - Media output
    Choose Create ISO image
    Do not choose Burn to CD/DVD
    
    Please note: If your XP install disc is SP1 then please .....
    
    Disable- DComLaunch Service
    Enable- LargeIDE Fix
    
    This can be done by pressing the "Plugin" button and checking or unchecking the appropriate selections
    
    Also note: If you have a Dell XP install disc you will need to follow the instructions here
    http://www.ubcd4win.com/faq.htm#dell
  3. Click on the "Build" button
  - You will see the Windows EULA message. Click on I Agree
  - You will now see the Build Screen. Let it run it's course
  - When the Build is finished you can click close, then exit
  4. Burn your ISO file to CD
  - Please see HERE on how to burn an ISO to CD.
==========

:step2:

Next, from your clean computer:

Download Farbar Recovery Scan Tool
and save it to your flash drive.

Now plug your flashdrive back into your sick computer and follow the next instructions:

==========

:step3:

1. Restart Your sick Computer Using the UBCD4Win Disc That You Have Created
- Insert the UBCD4Win disc in to one of your CD/DVD drives.
- Restart your computer.
  - The computer should choose to boot from the UBCD4Win CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
- In the window that pops up select Launch The Ultimate Boot CD For Windows and press Enter.
  - It may take a little longer for the Desktop to appear than it does when you start your computer normally. Just let the process run itself until the desktop appears.
- Once the desktop appears, you will receive a message asking: Do you want to start Network support?
  - Click on Yes if you want to use the PE environment to get online post your log and reply by way of an Ethernet connection.
- You should now have a desktop that looks like this:
  
  https://discussions.virtualdr.com/im.../2012/07/2.jpg
==========

:step4:
- Single click My computer from your UBCD4W desktop to navigate to the Farbar Recovery Scan Tool you saved to your flash drive.
- Double click on it to begin running the tool.
- When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your next reply.
July 7th, 2012, 01:37 AM
vbforge

sorry I don't have an xp disk
July 7th, 2012, 07:47 PM
Broni

You'll have obtain one.
Ask around. Some friend may have one.
July 7th, 2012, 11:20 PM
vbforge

ok I'll try to find one.
July 9th, 2012, 08:23 PM
Broni

OK.
July 12th, 2012, 01:18 AM
vbforge

still looking. what about xp boot disks or recovery disks. They are cheap. will something like that work or do I need the whole operating system
July 12th, 2012, 01:30 AM
Broni

Recovery disk MAY work.
July 15th, 2012, 06:47 PM
vbforge

What recovery disk should I look for. Be specific. Is there a specific tool or console that it needs? I saw where a set of 6 recovery disks for xp can be downloaded free from microsoft. Have you heard about that. Could you offer some suggestions, alternatives to an xp operating system disk the cost of which is not worth the computer.
July 15th, 2012, 06:55 PM
Broni

It'd have to be recovery CD for your computer.
You can also borrow XP CD with SP1/SP2/SP3
July 18th, 2012, 11:40 AM
vbforge

what do you mean recovery cd for my computer? I read the recovery disk should match the version of xp i am running such as home or professional but what else do I need to know about a resce disk.
Please explain about the sp123. If I find an xp disk to use must it have all three service packs.
July 18th, 2012, 05:47 PM
Broni

Recovery CD is a CD which normally comes with your computer when you buy it.
It's designed to work with just your computer.

If you can borrow Windows XP Home Edition CD with at least SP1 on it, that will work as well.

Show 40 post(s) from this thread on one page