Part 1:
Last Wednesday (July 11/2012) I downloaded a file that was supposed to be a self extracting porn vid. Believe it or not, this was the first time in over fifteen years I had done something like this, and to be safe I scanned it for viruses and malware first. Both Avast and Malware Bytes reported there was no problem with the file. Then when I ran it, I Avast suggested I open the file in “sandbox” mode, which I did. Nothing happened! I opened the file twice more in sandbox mode, and both times nothing happened. Never having had reason to use the sandbox mode before, I didn’t know what to expect. But since nothing had happened and I had recieved no warnings that the file was trying to harm my computer, I opened it in normal mode. BIG mistake!!!
Within seconds of opening the file, Avast started popping up messages telling me I had just dodged a bullet. But Avast wouldn’t tell me what the bullet was and it not only kept popping up messages about bullets, it also opened Internet Explorer and connected to the Avast website every time it gave me a warning (once every 1 to 15 seconds). Avast wasn’t dealing with the problem, and I was busy closing new browser tabs, new warnings, and new instances of Internet Explorer for 45 minutes while I tried to free up resources for Trend Micro website online scanner. Unfortunately, after 45 minutes, the online scanner was still trying to index my computers files and had not yet started scanning. Finally, in frustration, I just killed the power to my computer and shut it down.
Part 2:
When I restarted my computer, in the upper left hand corner a small message box appeared (I’ve never seen a message box like that before) and it claimed it was loading personalized settings for the current user. As soon as Windows finished loading, I ran HouseCall and it claimed I had no problems. Then I ran Avast and it claimed I had no problems. So then I ran Malware Bytes, and it claimed I had no problems. But I had problems.
I couldn’t install new programs because I didn’t have “administrator rights,” I couldn’t delete suspicious files (like trojan.exe and trojan.exe.log, and the directory c:\documents and settings\owner\application data\wreq and the file uytr.exe) because I didn’t have administrator rights. Those files would disappear despite repeated searches and then reappear on the next boot. Also, on every boot up, both Windows Explorer and Internet Explorer would claim to be unable to open before the boot sequence had finished and I could try to do anything (like start Internet Explorer). I ran all three scans a second time with the same “no problem” results and did a boot scan twice. With the boot scan, Avast was claiming to delete viruses (two the first scan and one immediately after I realized the problem persisted because both Explorers were crashing) but nothing was changing.
One thing I did eventually notice was that Windows Explorer was configged very differently from my preferred settings and that since I couldn’t change anything, I started to suspect that there was some other OS running my computer and a poor, unchangeable, imitation/shell of Windows was running on top. So I tried to run in safe mode with just a command prompt. There was no safe mode with a command prompt, and Windows would just boot (approximately) normally.
I gave up. I booted from CD with my XP Pro install disk in the drive. I then deleted the partition on Drive C;, put in a new partition, formatted the drive (not quick format), and re-installed Windows.
Part 3:
I strongly suspect that there is still another OS in charge of my computer and that it may have corrupted my Windows XP Pro installation CD. The trojan.exe and uytr.exe files no longer appear on my computer, but:
- Every time my computer boots, there is a little message box in the upper left hand corner of my screen telling me that “personalized settings for Internet Explorer” are being loaded.
- When I try to go to safe mode with a command prompt, I no longer get a blank screen but a screen that claims I am in safe mode and a cmd box (like the cmd dos box you get when you “shell” out of Windows).
- When I tried to upgrade to Internet Explorer 8, if I included the Defender upgrade, Windows would crash and tell me if the problem persisted (it did) I needed to remove offending hardware or upgrade my Windows software before I could continue (the final line of the crash screen said “memory dump” and the computer would have to be rebooted).
- While doing the Windows Updates, my computer would run for a few minutes with no apparent progress, and then the progress bar would jump to somewhere between 75% and 90% done and do nothing until a new update was being installed and it would go back to being non-existant.
- Sometimes double-clicking a shortcut will activate a program, and sometimes 200-clicking a shortcut will do nothing.
- Although I no longer get messages telling me Windows Explorer has crashed during boot up, my freshly installed and updated copy of Internet Explorer 8 still crashes on every boot up. *Since writing this, it has begun to crash to the point it is no longer usable and I had to switch to Chrome (which thankfully I had already installed).
- On boot up the Windows Security Center warns me that Avast (free version but up to date) is turned off, but Avast claims to be running with all scans active.
- The “administrator password” I set up during the Windows XP Pro installation does not work. I get a warning message that the system failed to log me on and that I need to check my password and domain to be sure they are correct. Then, I can only log on if I leave the password field empty.
So, this time I have again done the boot, online, malware, and virus scans, and I also used IOBIT’s Malware Fighter because it claimed to be able to fix problems with viruses disguising themselves as svchost.exe. But all the scans have turned out negative. Still, other than a virus/malware with a different OS running a Windows shell, I cannot explain why the problems are persisting.
Any suggestions as to what I can do to fix the problem(s)?