Problems after re-install of XP

rmg1

Hi all

I've just got my machine back after having it "mended" by the shop.
Basically, they've formatted the HDD and reinstalled XP Home.
Now I can't access regedit to re-enable Task Manager.

Any ideas on how to get round this one?
I've checked some for the options via Google but they don't seem to work after a reboot.
Anyone have any permanent solutions?

I've solved the "My Documents" and "My Computer" icons missing from the desktop but I'm also missing "My Network Places" as well.

Any suggestions gratefully received.

::edit::
I'm set up as an admin on here if it helps.

rmg1

I'm also getting warnings from Avira about a DLL file in the system32 folder. It is vakzakt87.dll and apparently contains the WORM/Ambler.A.23 worm recognition pattern.
I've been quarantining it every time, but it just keeps popping up.

closed

Do you have the XP disc or restore partition to reinstall yourself. If it's a bodged or infection installation, it might be better to start again.

Regedit not working is sometimes a sign of a virus, has it got all the service packs installed to sp2 or 3? rrt tool may help fix the regedit problem


http://www.sergiwa.com/modules/mydownloads/singlefile.php?cid=2&lid=1


Do you have a router?

If you want to have a go at cleaning up, rather than reinstall, try downloading malwarebytes, and do a scan, and/or scan with avira in safe mode

You can solve my network places missing with tweakui, from microsoft, see the desktop section after installing

zartub

if you have too press f10 on the boot up screen to go into reinstall mode ( if you have nothing on there anyway ) then that will do a fresh install anyway.

rmg1

I do have some stuff on here that I can't afford to lose.
I just want my system back the way it was.

Closed: it shouldn't have a virus (although Avira is scanning now), it's only just been reinstalled.

closed

It shouldn't, but it sounds like it has.

Is your data still there on the c drive?

rmg1

Data is still on the C: drive, yes.

rmg1

So much for a clean install - Avira's found 9 problems so far, and it's not finished yet!

fiddiwebb

Once Avira's finished (I presume you updated it first before the scan) download the latest version of Malwarebytes from filehippo.com.
Once downloaded open it and update first before running a full scan.

rmg1

Don't know if it's connected, but CDs won't auto-play any more either. Just running the scan now, will post the results.

rmg1

Here's the logfile fro Malwarebuyes:-
Malwarebytes' Anti-Malware 1.44
Database version: 3731
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13/02/2010 00:42:56
mbam-log-2010-02-13 (00-42-56).txt

Scan type: Full Scan (C:\|)
Objects scanned: 147173
Time elapsed: 41 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db2e2d5d-d74a-4a88-822e-c6928f59e4df} (Password.Stealer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\CS14 (Spyware.Ambler) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{81217960-B48D-4727-837D-45619E9A57C2}\RP12\A0001570.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81217960-B48D-4727-837D-45619E9A57C2}\RP12\A0001571.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81217960-B48D-4727-837D-45619E9A57C2}\RP12\A0001572.dll (Spyware.Ambler) -> Quarantined and deleted successfully.

I've clicked to fix the problems and I'm just about to reboot.