BraveSentry removed? - problems remain

[jholland1964]

You might see if you can try steps given here
http://support.microsoft.com/default...;en-us;Q307545

[jholland1964]

Don't type c:\windows\explorer.exe

Just do File, New Task, explorer.exe

[pkraft]

Same error. I found this - what do you think?

"If u are getting this error Explore.exe is not a valid win32 application do the following

insert the winxp cd in the cd drive and run this command sfc /scannow from a dos prompt. this will restore any corrupt files if needed. you need to be an administrator to do this. Of course this will remove the updates that u have installed and you wil have to redo the updates"

I'm still looking at the ms link you sent - From what I'm reading it doesn't seem to describe what's going on with my pc. Plus although the first part of the instructions say to boot with the install disk but then on reboot to safe mode I'd need to be able to see the desktop to complete the next step.?? I certainly trust your judgement & if you think this is what I need to do I'll try it.

pk

[jholland1964]

Hey PK at this point ???

"If u are getting this error Explore.exe is not a valid win32 application do the following

insert the winxp cd in the cd drive and run this command sfc /scannow from a dos prompt. this will restore any corrupt files if needed. you need to be an administrator to do this. Of course this will remove the updates that u have installed and you wil have to redo the updates"

You really have nothing to lose...the system is obviously very, very corrupted. You have been working at a really disadvantaged position from the beginning, not being able to even get online. Obviously multiple viruses and trojans. That was shown even after all the manual removals and finally the Kaspersky scan showing even more than we first realized.
I am so darned "ticked" I could spit and I know you feel the same too.

I wonder if the Norton Anti-virus program worked at all, especially seeing those infected emails that Kaspersky found that were nearly 2 years old.
If it were me, I would go ahead and try the possible solution you have found. I found that also and was hesitant to suggest it seeing as my suggestions have evidently taken you to the brink of destruction.
Try it and see...I swear I will also keep looking.
Judy

[pkraft]

Judy:

At this point my main concern is to not lose my data files. Right now the files are intact even though it's a tough road to get to them. I just don't want to try anything that might destroy them. I'm thinking the above solution wouldn't hurt the files??? Wanted to see what you think before I give it a go.

I did find this also on the MS WinXp newsgroup where the gal described a problem that matched mine exactly.

http://kgiii.info/windows/XP/general/xprepair.html and then a malware scan was the response.

Unfortunately for her it didn't work & she ended up replacing the harddrive & making the infected one a slave to retrieve her files.

And, yes, I'm thinking Norton is not doing a good job at all!

[jholland1964]

I really think this is your best bet at this point. I do have several others looking over this thread if you wish to wait until later this evening to get their thoughts.
A Repair Install will replace the system files with the files on the XP CD used for the Repair Install. It will leave your applications and settings intact, but Windows updates will need to be reapplied.
A Repair Install will replace files altered by adware and malware, but will not fix an adware, malware problem.

[pkraft]

Judy,

I'll wait to see if anyone has any suggestions. In the meantime, I'll pick up a new hardrive & have it at the ready if needed!!

Thanks, pk

[ShadowPuterDude]

Start the Recovery Console, and then replace the Explorer.exe file

1. Put the Windows XP CD into the CD ROM tray and close the tray. You may get a popup window asking about installing Windows XP. If you do, just close that window.
2. Then restart your computer
3. This should cause your computer to boot from the CD instead of the hard drive..(if not your you'll need to enter the BIOS and set the boot order so the CD ROM is first in the list.)
4. You should get a "Press any key to boot from CD" message! Press a key to do that otherwise it will by pass the CD boot.
5. After it boots up, you will see it load a bunch of files (be patient it can take a little while) and eventually you will see a menu where you can select the "Recovery Console" by pressing R It is normally the middle item in the list. Press R
6. You will see a list of possible Windows partitions with numbers next to them. Select your Windows Installation (which is C:\Windows) by typing the number next to it (which should be 1) and press enter.
7. It will ask you for the Administrator password is next (so make sure you know it). It you never gave it a password it is probably blank. If it is blank, just press enter. If you have set one then type it in and hit enter. It will tell you if you enter the wrong password.
8. When you enter the correct password you will get a prompt that looks like this: C:\WINDOWS>

Now from this command prompt window, here is what I want you to do. Enter the below commands (the commands are in bold black, comments in purple text).
copy c:\windows\system32\dllcache\explorer.exe c:\windows\explorer.exe
exit <--- this will exit the Recovery Console and boot to Windows

Restart the computer to Normal Mode.

W32.Sasser Removal Tool

To prevent shutdown:
Start -> Run
Type cmd
click "OK"

At the command prompt:
Type shutdown -a
Press the Enter key
Type exit
Press the Enter key

Download and Run the FxSasser.exe file from: http://securityresponse.symantec.com...r/FxSasser.exe.

The process will take around 15 minutes to complete!

Download and Run the MS Patch: http://www.microsoft.com/technet/sec.../ms04-011.mspx

[pkraft]

Will need some help with changing the boot order in the BIOS.

At Boot Device Priority it shows:
1st Boot Device - [Removable Dev.]
2nd Boot Device - [Hard Drive]
3rd Boot Device - [ATAPI CD-Rom]
4th Boot Device - [IBA GE Slot 0228 v1109]

I've tried changing the order but can't figure out how to do that. The only thing I can do is to highlight the 2nd Boot Device - Hard Drive and 'Disable'. I didn't save the changes yet. I don't see how to enable it again if I do.

Am I on the right track with this?

Thank you, pk

[ShadowPuterDude]

What is the make and model of the computer? If custom built, what is the make and model of the motherboard?