Fix 1: Get the computer to boot:

Does the computer boot? If not, what messages (if any) are you getting? If you are getting error messages, Google them; most likely, you are not the first person to experience this problem. Careful where you click, though. Assuming you have eliminated the possibility of hardware failure (and that you have properly backed your important documents up): if the computer doesn’t boot, you could have a boot sector virus. To get rid of these, load the Windows CD and press ‘R’ when prompted to enter the Recovery Console. Type these commands:

• fixmbr
• bootcfg /list
  • If no entries are listed, type bootcfg /rebuild
  • Enter the numerical identifier for your Windows installation (likely the number 1)
  • Type Y or Yes to add installation to boot list
  • Provide a load identifier (e.g. Windows XP)
  • Enter /fastdetect

Fix 2: Finding the culprits:

If it’s possible, hook the infected hard drive up to a different machine and scan it using MalwareBytes, removing any infected objects it finds. Now, knowledge of an approximate time the virus was contracted is REALLY helpful here, though not necessary. If you can’t hook it up to another computer, boot the computer into safe mode (press F8 as the computer is booting) and choose Safe Mode (with Networking).

Whether you have booted to this hard drive or are viewing it from a different computer, take the following actions:

Open My Computer > C:. Go to Tools > Folder Options > View tab > Check “Show hidden files and folders”; uncheck “Hide extensions for known file types”, “Hide protected operating system files” and “Use simple file sharing”. > Change to detail view and sort by Date Modified, more than likely, all of the virus files are going to have the same date in this field. Now is the tedious process of looking (and deleting/renaming), be sure you aren’t deleting important system files by using Google. Here are the important places to look, though they can be anywhere:

• C:\
• C:\WINDOWS\
• C:\Recycler\S-1-{RANDOM}\
• C:\WINDOWS\Tasks
• C:\WINDOWS\system32\
• C:\WINDOWS\system32\drivers\
• C:\Program Files\{ANY RECENT SOFTWARE THAT IS NEW AN YOU DIDN’T CHOOSE TO INSTALL}
• %TEMP% (Start > Run > %TEMP% > OK)
• %USERPROFILE%\Desktop (look for installer files)
• “%USERPROFILE%\Local Settings\Temporary Internet Files\”

Open Windows Firewall through Start > Control Panel > Windows Firewall, click on the Exceptions tab and check for any programs that you didn’t specifically authorize, remove the exception if there are unknown entries.

Fix 3: Stop the rogue processes from loading at startup

Download Autoruns from Sysinternals. Run the program and select the Logon tab. Check for malicious software under the headings listed below, unchecking each malicious item:

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• C:\Documents and Settings\All Users\Start Menu\Programs\Startup
• C:\Documents and Settings\username\Start Menu\Programs\Startup

Move to the Services tab and look for items where the Publisher is missing, these items are frequently (not always) suspect. Remove malicious services by unchecking them

Select the “Image Hijacks” tab, the only item that should be present is “Your Image File Name Here without a path”. If anything else is present, uncheck it.

Close Autoruns

Cleanup

Download CCleaner, install and run it with the default settings to remove all of your temporary files. If you don’t have a good Firewall and don’t have money to spend, download Comodo or ZoneAlarm. Turn off System Restore by right-clicking My Computer and selecting Properties. Select the System Restore tab and check the Turn off System Restore checkbox > Select Apply (may take a moment or two). Once it is responding again, uncheck the box and it will create a new restore point (that doesn’t have the virus files).

http://mediamemo.allthingsd.com/20090913/home-delivery-the-new-york-times-serves-up-some-malware/

fixtm.reg


REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-

FixExe.reg


REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

Batch file

<@echo off
:: SET_NO_DRIVE_OTORUN
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 0x0ff /f

:: GET_DRIVES
for /f "tokens=1 delims=:" %%j in ('reg query hklm\system\mounteddevices ^| findstr \DosDevices\') do (
echo %%j >> drives
)

:: REMOVE_\DosDevices\_PREFIX
for /f "tokens=3 delims=\" %%j in (drives) do (
echo %%j >> drives.txt
)
del /q /f drives > nul

:: REMOVE_SPACE
for /f "tokens=1 delims= " %%j in (drives.txt) do (
echo %%j: >> drives
)
del /q /f drives.txt > nul

:: CHECK_DRIVE_TYPE
for /f %%j in (drives) do (
fsutil fsinfo drivetype %%j | findstr "Fixed " >> fdtype
fsutil fsinfo drivetype %%j | findstr "Removable " >> frtype
)
del /q /f drives > nul

:: GET_FDRIVES
for /f "tokens=1* delims= " %%j in (fdtype frtype) do (
echo %%j >> dtype
)
del /q /f fdtype > nul
del /q /f frtype > nul

:: REMOVE_SPACE1
for /f "tokens=1 delims= " %%j in (dtype) do (
echo %%j >> drives
)
del /q /f dtype > nul

:: DEL_DRIVE_A_FROM_LIST
sort drives >> sort
type sort | findstr "A" > nul
if errorlevel 0 for /f "tokens=1 skip=1" %%j in (sort) do (
echo %%j >> sorted
)
del /q /f drives > nul
del /q /f sort > nul

:: CREATE_OTORUN_FOLDER
for /f %%j in (sorted) do (
md %%j\AUTORUN.INF
attrib +s +h +r /d /s %%j\AUTORUN.INF
)
del /q /f sorted > nul

echo Press any key to close this window..
pause > nul>