System restore in a corrupted situation

[rubenba]

Today I have download a rar file. It passed my Avira test but when I opened it I was full of virus and software like animalvirus doctor. Consequently, when I sign into my session I only see the wallpaper. Start menu, windows bar and icons are gone.

?Fortunately? I can open software by means of Ctrl+Alt+Delete, new task. I opened Avira and run a test but it didn?t help. I opened Ccleaner (2.29.1111) and I see in Tools/System Restore that I have a system restore point early this morning but its in grey and says ?Manage all your system restore points (the lasted one is disabled for system safety). Unfortunately, I just have one so I would like to know how could I use this disabled restore point kept in Ccleaner?

 

Thank you very much. Any help will be really appreciated.

 

Rub?n

[DennisD]

Hi Ruben, and welcome to the forum.

 

The last Restore Point will be disabled in CCleaner in case you accidentally delete it.

 

You could access it in the normal way (not via CCleaner), but you don't mention your Operating System, and the method may differ slightly from my XP.

 

But, that Restore Point may now contain the malware you downloaded.

 

Your best option is to follow the instructions as best you can in this section of the forum ...

 

http://forum.piriform.com/index.php?showtopic=20120

 

... and then post the logs in a new topic in our Spyware Hell section here where our malware expert will help you ...

 

http://forum.piriform.com/index.php?showforum=12

 

If you can't follow any of it, just do what you can, and post the results.

[rubenba]

Hi,

 

First of all, thank you for your help. I have passed through all the steps described (erunt,tfl,rooter,locksearch,cks,Gmer and otl). Finally I did a system restore by means of "%systemroot%\system32\restore\rstrui.exe). I don?t know if it worked or not... during all the scans several virus were found and deleted but once neither after all the scans nor after the last restoration has changed anything in the computer. The icons, the windows start and the bottom bar are gone. I can only see my wallpaper and I need to open everything by means of Ctrl+Shifth+Delete. I have to download all the software to a USB memory, open it by means of Ctrl+Shifth+Delete and so on... I kept severeal txt files with the results of the scans but I cannot copy them to the stick. Besides, I can?t access to internet since the computer corrupted although I can see, exploring by means of firefox, that my files still are in my C:\.

 

Sincerely, I don?t know what else could I do. Would it be possible to simply erase every single file or data created during the last 48h?

 

*My operating system is windows XP Home Edition bought in late 2005 in Spain.

 

Thank you for all your help.

 

Ruben

 

Hi Ruben, and welcome to the forum.

 

The last Restore Point will be disabled in CCleaner in case you accidentally delete it.

 

You could access it in the normal way (not via CCleaner), but you don't mention your Operating System, and the method may differ slightly from my XP.

 

But, that Restore Point may now contain the malware you downloaded.

 

Your best option is to follow the instructions as best you can in this section of the forum ...

 

http://forum.piriform.com/index.php?showtopic=20120

 

... and then post the logs in a new topic in our Spyware Hell section here where our malware expert will help you ...

 

http://forum.piriform.com/index.php?showforum=12

 

If you can't follow any of it, just do what you can, and post the results.

[DennisD]

Hi Ruben.

 

As explained above, you need to start a new topic and post the logs from the scans you did in the Spyware Hell section of the forum here ...

 

http://forum.piriform.com/index.php?showforum=12

 

... and then Rorschach112, our malware removal expert, will examine the logs, and then advise you of the next steps.

 

Simply running the various scans is only part of the process.

 

Have a look at this thread in Spyware Hell, which will show you what I mean.

 

http://forum.piriform.com/index.php?showtopic=29514

 

And don't worry, these things can be fixed but you need to be guided through the process by an expert, which Rorschach112 is.

 

If you have a problem with any of it, then mention that in your Spyware Hell topic.

[DennisD]

I'm making a new post in case you've been back here Ruben, and miss any edit I did of the post above.

 

This part of your last post has just registered with me ...

 

I kept severeal txt files with the results of the scans but I cannot copy them to the stick.

 

It's difficult to picture exactly what your situation is from here, but can you boot into safe mode?

 

How to get into Safe Mode:

 

If so, you may be able to copy the logs (scans) onto your USB stick without any problems.

 

If you cannot get into Safe Mode, do you have any form of "Rescue CD" to boot your computer with, and get the logs that way?

 

If you don't, I think I can help you out with that, and hopefully guide you if you get stuck.

 

In the meantime, I'll pm Rorschach112, and point him to this thread. He may have some better ideas.

 

And try not to worry, we'll do our best to get you fixed up.

[Rorschach112]

Plenty of options we can do don't worry. You need to follow Dennis's advice and post in the Spyware Hell forum though.