Virus hampering boot on Windows Vista

Solved/Closed
Report
Posts
37
Registration date
Thursday March 27, 2014
Status
Member
Last seen
April 15, 2014
-
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
-
My laptop Windows Vista opens to a gray screen with the words Microsoft windows Vista at the top and Memory diagnostic tool at the bottom. Memory diagnostic tool said no errors. Ran diagnostic on F12 key -- said no problem. Ran Avast anti virus -- found nothing. The only way to open computer is to select Microsoft Windows Vista -- select Enter and wait through numerous beeps. I got instructions from Ambucias to download ZHPDiag2, start a new topic in virus-security and send the URL from the test.

HTML link<a href="http://speedy.sh/rqd5z/ZHPDiag.txt">Download at SpeedyShare</a>

download link http://speedy.sh/rqd5z/ZHPDiag.txt


I hope this is what you need. It still installed with mostly French so I had to guess a little.

103 replies

At first it was as a user. Now I do it as an administrator. Some of the early manipulations were certainly done as a user. The ones you got yesterday were done as admin.
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hello,

No no I meant an administrateur user, not run as an administrator. Look at this if you don't understand : http://ccm.net/faq/3407-administrator-or-user-mode-under-xp

Gabriel.
Now when you tell me to do something I sign on as administrator user because many times that is the only way I can download and install many items. In the beginning I tended to just use user.

However what confuses me is that when Dell directed me in a total re-install of Vista 2 or 3 years ago, I ended up with Beth and Ruth as just users and Elizabeth as administrator user and at times it seems as though there is an owner account although there is not an owner account when either of us logs in.

Sorry, I got in the habit of using admin when I was the admin of my workplace and did sign in that way at times when my ISS supervisor told me to do so.

At home I am administrator user. I know in the beginning I used just the Beth-user account, however..
to clarify I don't use the administrator - user mode if I am just working on the machine. I use it only when I have to download or do something and right clicking on "run as administrator" does not work.
When I right click on Explore, under users, there are Beth, Owner, Public and Ruth - no Elizabeth..
On the Control Panel under user accounts there are Beth, Elizabeth, Ruth and Guest(disabled).

Why the difference
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hello,

OK, and you run the tools from the user that has problems ?

Gabriel.
I have checked and all three users have the same problems -- Beth, Ruth, and Elizabeth. I don't know what to do about Owner since there is no account for it.,

I didn't think of running each one three times but I certainly will if you think it will help. At this time I run them all from the administrator - user account. In the beginning I know I used my user account but I found that many of the tools you gave me would not run unless I used the administrator-user account.
Shall I go back and run ZzhPDiag on all three users?
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hello,

Can you try to run again ZHPDiag in safe mode with networking ?

Gabriel.
Sure. Do you want me to run it as administrator-user or what? Do you want Avast disabled?

thank you. I know this us taking a lot of your time I do appreciate your efforts.
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Yes, with administrateur user, and with Avast disabled.

This situation is strange, I don't really understand why all is reappearing...

Gabriel.
Here is exactly what I did in case I did anything wrong. I logged on in safe mode with networking. I chose Elizabeth which is my administrator-user account. I ran ZHP with full options chosen. I did not choose search or configure. Here is what I got

http://speedy.sh/WPja6/ZHPDiagsafenet-May-7.txt

The weird thing was when I was in safe mode with networking, I could not go to the network. I had to save the report, restart, log on as Elizabeth, and upload the report from there.
I forgot to tell you -- Avast was disabled. Not by me. It simply would not let me lick and disable it. It came up saying Avast is not working which I assume is right for Safe Mode.
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hi,

Good news, Speed cleaner is missing. :)

Just run again ZHPFix with this lines and paste the report :

Script ZHPFix
G2 - GCE: Preference [User Data\Default] [booedmolknjekdopkepjjeckmjkdpfgl] Extutil v.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [flpcjncodpafbgdpnkljologafpionhb] Managera v.0.1 (Activé)
[HKCU\Software\Reimage]
[HKCU\Software\SpeedyPC Software]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E0C8759C69912A4485AD49572CE7CA3]
G1 - GCS: Preference [User Data\Default] http://search.conduit.com
[HKCU\Software\Condut]
O43 - CFD: 10/27/2013 - 9:43:06 PM - [2.755] ----D C:\Users\Beth\AppData\Local\CRE
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect]



Gabriel.
Rapport de ZHPFix 2014.3.25.5 par Nicolas Coolman, Update du 25/03/2014
Fichier d'export Registre :
Run by Beth at 5/7/2014 11:02:42 AM
High Elevated Privileges : OK
Windows Vista Home Premium Edition, 32-bit Service Pack 1 (Build 6001)

Recycle Bin emptied (Canceled by user)

========== Registry keys ==========
REMOVES: HKCU\Software\Reimage
REMOVES: HKCU\Software\SpeedyPC Software
REMOVES: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E0C8759C69912A4485AD49572CE7CA3
REMOVES: HKCU\Software\Condut
REMOVES: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect

========== Folders ==========
REMOVES: C:\Users\Beth\AppData\Local\CRE

========== Files ==========
REMOVES: c:\users\beth\appdata\local\google\chrome\user data\default\preferences


========== Summary ==========
5 : Registry keys
1 : Folders
1 : Files


End of clean in 06mn AMs

========== Path to file report ==========
C:\Users\Beth\AppData\Roaming\ZHP\ZHPFix[R1].txt - 5/2/2014 5:24:25 PM [2154]
C:\Users\Beth\AppData\Roaming\ZHP\ZHPFix[R1]may 2.txt - 5/2/2014 5:24:59 PM [2154]
C:\Users\Beth\AppData\Roaming\ZHP\ZHPFix[R3].txt - 5/7/2014 11:02:48 AM [1141]

This was all done in administrator-user mode but not safe mode.

C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\yewimmxqbs32.exe.VIR,c:\program files\002\yewimmxqbs32.exe
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\002.DIR,C:\Program Files\002
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\RrFilter.DIR,C:\Program Files\RrFilter
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\SpyAlert.DIR,C:\ProgramData\SpyAlert
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\cltmngsvc.exe.VIR,c:\program files\searchprotect\main\bin\cltmngsvc.exe
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\searchprotect.DIR,c:\program files\searchprotect
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\searchprotect.DIR,c:\users\owner\appdata\local\searchprotect
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\preferences.VIR,c:\users\beth\appdata\local\google\chrome\user data\default\preferences
C:\Users\Beth\AppData\Roaming\ZHP\Quarantine\CRE.DIR,C:\Users\Beth\AppData\Local\CRE
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
OK, and all is good or not ?

Gabriel.
No. Unfortunately, the original problem still remains. When I turn the computer on it goes to the Dell Splash Screen. Then Windows Boot Manager appears not Vista. I get a choice of Vista and Memory Diagnostics. I have to click on Vista and after about 100 clicks Vista comes up. Something is wrong with the Boot Process or what lets Vista come up automatically.

Sorry
Also I have French Google but not Google Chrome. Of course I can tell it to translate but how do I get Chrome back. I tried through Internet Explorer and the machine locked up.
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hello,

You have to click 100 times before Windows boot ?

Gabriel.
No. I was not clear.

I turn on the machine. Windows Boot Manager Appears giving me two choices:

Microsoft Windows Vista

and Memory Diagnostics.

I then select Microsoft Windows Vista and press the Enter key on the laptop keyboard one and only one time. Then the machine beeps about 100 times. I can't be sure of the number.

After that the screen opens that lets me choose which account I want and Vista opens and works very well since you have cleaned it up.

I press the Enter key one time. The machine beeps about 100 times and then Vista opens. That is the only way to get Vista.

Sorry I was not clear
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hello,

No problem it was me, I didn't understand. Maybe it is a hardware problem.

And what about Speed Cleaner, and when the computer is open ?

Gabriel.
Speed Cleaner appears to gone. It no longer starts when the machine starts., if that is what you mean.

The only problem is the original one. The computer boots to Windows Boot Manager not Vista.

What hardware problem could it be?
The beeps last for 30 seconds exactly. That is the time out under msconfig. Is this a coincidence?
Bing popped up again today. I have never ever used that. I was able to get back to Google however.
OK. I will. Thank you so much for your help. My machine works much better know once it starts. I had it in hardware in the beginning. I don't remember the person's name but he transferred it to virus. Anyway, Thanks very much.

As to removing Bing. No, I can't. It does not show up.

Do you know how I can get the English Google Chrome?
Correction: Bing is gone and I have Chrome. Thanks again
Posts
4
Registration date
Saturday May 10, 2014
Status
Member
Last seen
May 15, 2014

Do I need to close this out on this forum somehow. If so, how do I do it. I tried to transfer to hardware but had to enter a different nickname. Is that normal?

Again thanks. I just don't know who else to ask the questions in this comment.

by the way, Bing is gone. I still have Chrome only if I click on a different icon than the one on my desktop.
Posts
13334
Registration date
Saturday January 29, 2011
Status
Security contributor
Last seen
December 24, 2016
39
Hello,

Yes, it was maybe Ambucias who has redirected you in this category, but it was a good idea because your computer was a little infected.

I think you can answer in your first topic and explain that your computer is now clean : http://ccm.net/forum/affich-752736-dell-inspiron-laptop-boots-to-windows-boot-manager-not-vista

For the icon which doesn't work on your desktop, it's probably the shortcut which is corrupted. Delete it, and after recreate it and it will be probably good. Do a right click and then "Create a shortcut".

Gabriel.
Posts
4
Registration date
Saturday May 10, 2014
Status
Member
Last seen
May 15, 2014

I am a little confused. Bing is back and I really don't want it. I can't find it listed anywhere to get rid of it. I also cannot get Internet Explorer to work. I don't use it but there have been a few sites I needed to get into that required it. Are these covered under hardware?
Posts
306
Registration date
Saturday March 27, 2010
Status
Member
Last seen
June 8, 2014
21
have u run MBAM yet as he tod you to run it n let it scan??