antivirus security pro

[arnoldbowman@aol.com]

I would appreciate help from anyone

 

[TwinHeadedEagle]

Hi,

Can you access Safe Mode?

 

[arnoldbowman@aol.com]

Can not it starts, and then shuts down, and re-opens in regular mode

 

[TwinHeadedEagle]

Ok, we'll need to remove it outside Windows.


Please print these instruction out so that you know what you are doing

• Download OTLPENet.exe to your desktop
• Download Farbar Recovery Scan Tool and save it to a flash drive.
  
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• Wait for the CD to detect your hardware and load the operating system
• Your system should now display a Reatogo desktop
  Note : as you are running from CD it is not exactly speedy
• Insert the USB with FRST
• Locate the flash drive with FRST and double click
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

[arnoldbowman@aol.com]

It is asking for which program to run the file

 

[TwinHeadedEagle]

I do not understand. Can you explain, attach screenshot, where do you stuck...

 

[arnoldbowman@aol.com]

The OTLPENet.exe file

 

[TwinHeadedEagle]

Download ImgBurn, it will help you to burn OTLPE

http://www.dvdr-digest.com/software/download.php?sid=470&ssid=0&did=1

 

[arnoldbowman@aol.com]

It will not let me open the imgburn file

 

[TwinHeadedEagle]

Can you open Antivirus Security Pro and part to enter licence, maybe we can shut it down...

Try to enter this licence

AA39754E-715219CE

 

[arnoldbowman@aol.com]

It will not let me type in the activation code box

 

[TwinHeadedEagle]

Then you're doing something wrong, I tried it myself and I shut it down successfully...


1. Open Antivirus Security Pro
2. In the bottom right corner, click on Buy Full Edition
3. Again click on Buy Full Edition
3. Click I already have activation code
4. Type licence

 

[arnoldbowman@aol.com]

It will not accept any type in the box

 

[TwinHeadedEagle]

Ok, it is not going this way. Do you have access to another computer, blank cd and USB flash...

 

[arnoldbowman@aol.com]

yes ready to go

 

[TwinHeadedEagle]

Do you have IMG Burn installed on clean PC?

Install it, and follow instructions below

Please print these instruction out so that you know what you are doing

• Download OTLPENet.exe to your desktop
• Download Farbar Recovery Scan Tool and save it to a flash drive.
  
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• Wait for the CD to detect your hardware and load the operating system
• Your system should now display a Reatogo desktop
  Note : as you are running from CD it is not exactly speedy
• Insert the USB with FRST
• Locate the flash drive with FRST and double click
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

[arnoldbowman@aol.com]

That worked Hereis the file
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by SYSTEM on REATOGO on 21-11-2013 16:59:36
Running from F:\
WIN_XP (X86) OS Language: English(US)
Boot Mode: Recovery
Attention: Could not load system hive.
Attention: System hive is missing.

==================== Registry (Whitelisted) ==================

ATTENTION: Software hive is missing.

ATTENTION: Software hive is not loaded.


========================== Services (Whitelisted) =================


==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========


==================== One Month Modified Files and Folders =======


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\services.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\User32.dll IS MISSING <==== ATTENTION!.
C:\Windows\System32\userinit.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION!.

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon: <===== ATTENTION!
HKLM\...\exefile\open\command: <===== ATTENTION!

==================== Restore Points (XP) =====================


==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 2013.17 MB
Available physical RAM: 1796.3 MB
Total Pagefile: 1844.02 MB
Available Pagefile: 1776.66 MB
Total Virtual: 2047.88 MB
Available Virtual: 1994.25 MB

==================== Drives ================================

Drive b: (RAMDisk) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
Drive d: () (Fixed) (Total:134.94 GB) (Free:119.57 GB) NTFS
Drive e: (DATA) (Fixed) (Total:135.04 GB) (Free:83.57 GB) NTFS
Drive f: () (Removable) (Total:3.72 GB) (Free:3.41 GB) FAT32
Drive x: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 298 GB) (Disk ID: E5E84A05)
Partition 1: (Not Active) - (Size=28 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=135 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=135 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)

==================== End Of Log ============

 

[TwinHeadedEagle]

FRST didn't detected hard disk well, can you tell me why?

 

[arnoldbowman@aol.com]

I don't know. Could it be because of the booting from disc?
What would you suggest we try now? This virus has
a deep grip on my computer.

 

[TwinHeadedEagle]

Instead of FRST, I want you to download OTL on flash drive and run it.

Download OTL from here

http://www.bleepingcomputer.com/download/otl/dl/93/

Open it from flash drive, and click Run scan. Attach me the report.