[Resolved] Cannot Post Log

[jrhodes]

I'm not sure. It was scanning and the a dialog box appeared saying that it had located a rootkit virus and had to reboot. I clicked "OK" and after the reboot my mouse and keyboard were dead. The program went thru all of the stages and then brought up the logs in notepad, but I could not do anything with them since my mouse was not working. So I rebooted without any success.

[Hoov]

Are they USB devices? Do you have an older keyboard or mouse that is not USB?

[jrhodes]

yes they are the older (non-USB) devices.

[Hoov]

When you go to the screen to select safe mode, does the keyboard work?

[jrhodes]

yes, it allows me to toggle down via the arrow keys, but once I'm in safe mode it stops working.

[Hoov]

When you try to start windows, do you have an option to boot to the recovery console? Do you have an XP install CD?

[jrhodes]

No, it doesn't have the recovery console option and I do not have a XP install CD.

[Hoov]

Use the arrow keys to select the Safe mode with a Command prompt option.
If you are prompted to select an operating system, use the arrow keys to select the appropriate operating system for your computer, and then press ENTER.
Log on as an administrator or with an account that has administrator credentials.
At the command prompt, type C:\system32\restore\rstrui.exe, and then press ENTER

When system restore starts up, do a system restore to the point before you ran combofix.

Let me know how that goes.

[jrhodes]

How can I log in as administrator if I have no control of my mouse?

[Hoov]

GRR! Sorry, I am trying to think of a way around this. Do you have a USB keyboard handy? Or a USB Mouse?

[jrhodes]

Alright HOOV. The good news is that I was grumbling so much about not having a USB mouse and keyboard so my wife gave me my Christmas present early...a new HP desktop with a USB mouse and keyboard. I connected them to my existing desktop and I now have control of my computer.

The bad news is that I entered "C:\system32\restore\rstrui.exe" in the command prompt and it tells me that it cannot locate that filepath.

[jrhodes]

I went into normal mode and tried to restore, And it says that it can't restore to that restore point. I tried it again at three different restore points and it keeps giving me the same message.

I also went back into safe mode and tried to restore and I still get the same message.

[Hoov]

Can you run the computer normally and use it with the USB keyboard?

[jrhodes]

Yes

[Hoov]

Good, we will go from there. Can you go to c:\qoobox and open combofix.txt and copy the log and paste it up (if it will not paste up, zip it and attach it as before). Then go to the control panel, then to the system control panel, then to the hardware tab, then click the device manager button and see if there are any devices with a yellow exclamation mark or a red x next to them. If there are, let me know which.

I need you to go to the administration tools in XP. They are in the Control Panel. Open the Admin tools, then open the event viewer. Over on the left hand side and click on System. Then up at the top click on Action and then click on Save Events As, type in system as the file name,  make sure file type EVT is selected, and then navigate so it will save the file to your desktop, then click save. Over on the left hand side and click on Application. Then up at the top click on Action and then click on Save Events As, type in application as the file name,  make sure file type EVT is selected, and then navigate so it will save the file to your desktop, then click save. Zip them both up into a single zip file, post them back here in your next reply as attachments. If they are two big to attach, let me know and I will tell you what to do with them.