Re: Started with many virii, worms, adware that were hard to ID

**Belahzur** · by **Belahzur** on Thu 08 Oct 2009, 1:24 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u

This will also reset your restore points.

How is the machine running now?

robs27 · by robs27 on Thu 08 Oct 2009, 1:39 pm

I will try this when I get home in a few hours and see how things are. In the meantime, I have two questions: 1) Because ComboFix was renamed, you do mean Combo-Fix /u, right? Also, is ComboFix "smart enough" to realize that the piggybacked USB drive is also a standalone bootable hard drive (i.e. did it also scour its registry entries and restore points)? I have it piggybacked because it doesn't let me into Windows otherwise. This will be easy enough to check when I get home. Thanks!

**Belahzur** · by **Belahzur** on Thu 08 Oct 2009, 1:40 pm

Hello.
Combofix is smart enough to realize the change, just because of how it does this in it's code.

Combofix will have checked the external drive too, it checks for autorun infection, which includes every drive it finds connected.

robs27 · by robs27 on Thu 08 Oct 2009, 7:57 pm

Thanks for your reply to my questions. I ran ComboFix and it uninstalled. I removed the drive and remounted it in its case with the same results. It boots normally to the Welcome Screen and allows me to click the user I want to login with. It then displays a blank desktop, runs for maybe 15 seconds and then says logging off. It then backs out to the Welcome Screen again. Any additional thoughts? I will keep the drive in the other system unless you tell me to do otherwise. If you can, please continue to help. I appreciate it!

robs27 · by robs27 on Tue 13 Oct 2009, 11:52 pm

**Belahzur** · by **Belahzur** on Thu 15 Oct 2009, 11:03 am

Sorry for the delay.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u

This will also reset your restore points.

How is the machine running now?

robs27 · by robs27 on Thu 15 Oct 2009, 11:48 pm

Already did that. Please see my reply previous to "bump".

**Belahzur** · by **Belahzur** on Sat 17 Oct 2009, 5:41 am

Hello.
Do you have your XP disc?

robs27 · by robs27 on Sat 17 Oct 2009, 11:18 pm

No. XP Media Center was factory installed. All I have are the recovery discs (which I believe will reset everything to the way it was when I first received it). If I am right about that, I could just as easily restore from an image I took with Acronis, but I was trying to avoid that. I also believe I set an administrator password, but I can't find or recall what that was.

**Belahzur** · by **Belahzur** on Sun 18 Oct 2009, 8:58 am

Hello.
Is there anything you don't want to lose on this machine? can you back up anything you want? we can try an image restore if you want to try that.

robs27 · by robs27 on Mon 19 Oct 2009, 10:04 am

Unfortunately, I was trying to keep a bunch of programs that I had gotten on Giveaway of the Day. That was why I was trying to just get rid of my infection without restoring from an image that does not have all of these programs. Are we saying that it looks like my Windows installation is damaged and that is what is causing my computer's behavior now? If so, I looked into doing a Windows Repair, but I don't have the disc nor remember my Administrator password. If I could, I suppose I would really like to try to repair my Windows without data loss if possible. My image restore would be my last resort.

**DragonMaster Jay** · by **DragonMaster Jay** on Mon 19 Oct 2009, 7:19 pm

Go ahead with repair and let us know how that goes for you.

robs27 · by robs27 on Mon 19 Oct 2009, 8:20 pm

Any suggestions on how to go about that without an administrator password or a Windows disc for that machine? As I mentioned earlier, it came preinstalled with an OEM copy of Windows XP Media Center and I cannot recall my administrator password.

**DragonMaster Jay** · by **DragonMaster Jay** on Mon 19 Oct 2009, 10:40 pm

If you are not willing to do the image restore, then what would be your approach.

robs27 · by robs27 on Tue 20 Oct 2009, 4:45 pm

I would like to try to do a Windows Repair that would not wipe out all my data first. But I already mentioned my issues with that. I know there may be some free or low cost utilities out there that will recover or reset your administrator password and possibly also something to enable a Windows Repair, but I could use some help in identifying those. Any ideas? Do you know of anything?