skip to main content

System Restore doesn't work even in Safe Mode???

12 years ago

Woke up this morning with what appears to be a Nasty Virus (System Check scam). after research, I've learned the first step to get rid of it is to do a System Restore to an earlier date.

I've tried repeatedly, using different dates, to do the Restore in Safe Mode, because the virus won't let me do anything in Windows....nothing.

Any idea what I'm doing wrong? Any ideas for how I fix this? thanks.

Cathy

Dell, Windows 7 XP

Sort by:Oldest

Comments (9)

ravencajun Zone 8b TX
12 years ago
oh man that is one nasty bugger. You will have to go to LzD and let the team there help you with this one, there is no other alternative that I would recommend. You need to go and register there then post your own thread in the area I link you to the malware removal area, tell everything you can about your pc and what happened, the team will lead you step by step running special scans to rid you of this bad infection. Do NOT run anything till you go there and do NOT follow any other instructions you may see that sound like your problem each pc needs individual directions.In this type of infection running removal programs could make things worse till the proper steps have been taken.
Analysis and Malware Removal

If you need any help getting there let me know I am over there too.
This will take some time but you can do it and if you have any questions at all just ask them there.
mikie_gw
12 years ago
Tap F8 repeatedly during start up will give you the option of a restore point.

If you have a seperate user account.. try using it.
Related Discussions
System Restore does not work
Q
Comments (30)
Quite a read, but the only thing I see that might apply to my situation is that I have free Zone Alarm as my firewall. It never caused a problem in the past, but I'm wondering if the latest update has something to do with this. By the way, another recent thread referring to firewalls had some interesting information indicating that ZA might not be such a good choice any more. I tried Comodo and found it nagged too much, but I'm thinking of trying the one a poster on that thread recommended. Since I have a firewall via a router, maybe I'll shut down ZA and try the System Restore. I still like having a software firewall on each computer, however.
...See More
scandisk in safe mode
Q
Comments (11)
Thanks Terry. That brought up a folder in the System folder. I don't know exactly what they mean. Not sure if this stp log will help. NORMAL : [10/13/2000 17:00:45:980] SFP FirstRun - OS Version Major=4 Minor=90 Build=3000 NORMAL : [10/13/2000 17:06:54:420] Invalid file C:\WINDOWS\FONTS\TAHOMABD.TTF, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:06:54:590] SFP restored file C:\WINDOWS\FONTS\TAHOMABD.TTF to version 0.0.0.0 NORMAL : [10/13/2000 17:07:06:070] Invalid file C:\WINDOWS\SYSTEM\CP_949.NLS, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:06:120] SFP restored file C:\WINDOWS\SYSTEM\CP_949.NLS to version 0.0.0.0 NORMAL : [10/13/2000 17:07:06:230] Invalid file C:\WINDOWS\SYSTEM\CP_936.NLS, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:06:340] SFP restored file C:\WINDOWS\SYSTEM\CP_936.NLS to version 0.0.0.0 NORMAL : [10/13/2000 17:07:06:620] Invalid file C:\WINDOWS\SYSTEM\CP_1258.NLS, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:06:620] SFP restored file C:\WINDOWS\SYSTEM\CP_1258.NLS to version 0.0.0.0 NORMAL : [10/13/2000 17:07:06:780] Invalid file C:\WINDOWS\SYSTEM\CP_1256.NLS, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:06:780] SFP restored file C:\WINDOWS\SYSTEM\CP_1256.NLS to version 0.0.0.0 NORMAL : [10/13/2000 17:07:07:000] Invalid file C:\WINDOWS\SYSTEM\CP_1250.NLS, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:07:060] SFP restored file C:\WINDOWS\SYSTEM\CP_1250.NLS to version 0.0.0.0 NORMAL : [10/13/2000 17:07:07:110] Invalid file C:\WINDOWS\SYSTEM\CP_950.NLS, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:07:170] SFP restored file C:\WINDOWS\SYSTEM\CP_950.NLS to version 0.0.0.0 NORMAL : [10/13/2000 17:07:42:980] Invalid entry for file C:\WINDOWS\FONTS\TAHOMA.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:42:980] Invalid entry for file C:\WINDOWS\SYSTEM\CP_1252.NLS, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:07:43:030] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMA.TTF=C:\WINDOWS\FONTS\TBM6351.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:07:43:030] SFP removed invalid entry C:\WINDOWS\SYSTEM\CP_1252.NLS=C:\WINDOWS\SYSTEM\TBM7051.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:09:31:020] SFP installed catalog C:\WINDOWS\MSDOWNLD.TMP\AS00BF34.TMP\ie.cat NORMAL : [10/13/2000 17:09:41:450] SFP installed catalog C:\WINDOWS\msdownld.tmp\AS011C73.tmp\mobilepk.cat NORMAL : [10/13/2000 17:09:43:100] Invalid file C:\WINDOWS\SYSTEM\esenu.dll, version 1998.9.1003.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:09:43:160] SFP installed catalog C:\WINDOWS\msdownld.tmp\AS012736.tmp\advauth.cat NORMAL : [10/13/2000 17:09:43:160] SFP restored file C:\WINDOWS\SYSTEM\esenu.dll to version 1998.9.1003.0 NORMAL : [10/13/2000 17:09:43:710] SFP installed catalog C:\WINDOWS\msdownld.tmp\AS012A37.tmp\msident.cat NORMAL : [10/13/2000 17:09:44:090] Invalid file C:\WINDOWS\SYSTEM\COLOR\sRGB Color Space Profile.icm, version 0.0.0.0 copied. New file has correct version but invalid hash NORMAL : [10/13/2000 17:09:44:090] SFP restored file C:\WINDOWS\SYSTEM\COLOR\sRGB Color Space Profile.icm to version 0.0.0.0 NORMAL : [10/13/2000 17:09:44:200] SFP installed catalog C:\WINDOWS\msdownld.tmp\AS012A37.tmp\ie_extra.cat NORMAL : [10/13/2000 17:11:26:030] Invalid entry to delete file C:\WINDOWS\SYSTEM\ACTXPRXY.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:200] Invalid entry to delete file C:\WINDOWS\SYSTEM\BROWSEUI.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:310] Invalid entry to delete file C:\WINDOWS\SYSTEM\COMCTL32.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:360] Invalid entry to delete file C:\WINDOWS\SYSTEM\CORPOL.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:420] Invalid entry to delete file C:\WINDOWS\SYSTEM\SHDOCVW.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:690] Invalid entry to delete file C:\WINDOWS\SYSTEM\SHLWAPI.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:800] Invalid entry to delete file C:\WINDOWS\SYSTEM\URLMON.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:26:860] Invalid entry to delete file C:\WINDOWS\SYSTEM\WININET.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:27:070] Invalid entry to delete file C:\WINDOWS\SYSTEM\WEBCHECK.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:27:180] Invalid entry to delete file C:\WINDOWS\SYSTEM\MSIDLE.DLL has been written in wininit.ini NORMAL : [10/13/2000 17:11:27:510] Invalid entry for file C:\WINDOWS\FONTS\TAHOMA.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:11:27:790] Invalid entry for file C:\WINDOWS\FONTS\TAHOMABD.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:11:27:840] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\ACTXPRXY.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:840] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\BROWSEUI.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:840] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\COMCTL32.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:840] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\CORPOL.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:840] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\SHDOCVW.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:840] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\SHLWAPI.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:900] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\URLMON.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:900] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\WININET.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:900] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\WEBCHECK.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:27:900] SFP removed invalid entry NUL=C:\WINDOWS\SYSTEM\MSIDLE.DLL in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:28:010] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMA.TTF=C:\WINDOWS\FONTS\TBMA050.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:11:28:060] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMABD.TTF=C:\WINDOWS\FONTS\TBMA051.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:13:24:400] Invalid entry for file C:\WINDOWS\FONTS\TAHOMA.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:13:24:510] Invalid entry for file C:\WINDOWS\FONTS\TAHOMABD.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:13:24:560] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMA.TTF=C:\WINDOWS\FONTS\TBMC090.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:13:24:560] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMABD.TTF=C:\WINDOWS\FONTS\TBMC091.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:14:54:030] Invalid entry for file C:\WINDOWS\FONTS\TAHOMA.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:14:54:090] Invalid entry for file C:\WINDOWS\FONTS\TAHOMABD.TTF, version 0.0.0.0 made in wininit.ini. New file has correct version but invalid hash NORMAL : [10/13/2000 17:14:54:090] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMA.TTF=C:\WINDOWS\FONTS\TBMD1E1.TMP in the [Rename] section from wininit.ini NORMAL : [10/13/2000 17:14:54:090] SFP removed invalid entry C:\WINDOWS\FONTS\TAHOMABD.TTF=C:\WINDOWS\FONTS\TBMD1E2.TMP in the [Rename] section from wininit.ini NORMAL : [04/21/2001 09:04:05:400] SFP FirstRun - OS Version Major=4 Minor=90 Build=3000 NORMAL : [11/23/2001 17:32:30:970] Invalid file C:\WINDOWS\SYSTEM\itircl.dll, version 4.72.7277.0 copied. New file has correct version but invalid hash NORMAL : [11/23/2001 17:32:35:960] SFP restored file C:\WINDOWS\SYSTEM\itircl.dll to version 4.72.7277.0 NORMAL : [11/23/2001 17:32:36:950] Invalid file C:\WINDOWS\SYSTEM\itss.dll, version 4.72.8085.0 copied. New file has correct version but invalid hash NORMAL : [11/23/2001 17:32:38:050] SFP restored file C:\WINDOWS\SYSTEM\itss.dll to version 4.72.8085.0 NORMAL : [10/19/2003 18:14:36:550] Invalid entry for file C:\WINDOWS\SYSTEM\MSVCRT.DLL, version 6.1.8924.0 made in wininit.ini. Correct version is 6.1.8637.0 NORMAL : [10/19/2003 18:14:37:920] SFP removed invalid entry C:\WINDOWS\SYSTEM\MSVCRT.DLL=C:\WINDOWS\SYSTEM\Msvcdf88.rra in the [Rename] section from wininit.ini NORMAL : [02/25/2004 13:41:45:130] SFP installed catalog C:\WINDOWS\TEMP\IXP000.TMP\wdsetupm.cat NORMAL : [02/25/2004 13:42:06:330] SFP installed catalog C:\WINDOWS\TEMP\IXP000.TMP\mdacxpkm.cat NORMAL : [02/25/2004 13:42:55:820] SFP installed catalog C:\WINDOWS\TEMP\IXP000.TMP\sqlnetm.cat NORMAL : [02/25/2004 13:43:02:850] SFP installed catalog C:\WINDOWS\TEMP\IXP000.TMP\sqlodbcm.cat NORMAL : [02/25/2004 13:43:07:300] SFP installed catalog C:\WINDOWS\TEMP\IXP000.TMP\sqloldbm.cat
...See More
How to get it out of Safe Mode
Q
Comments (4)
Sorry, just a little more information.... When it comes up in safe mode, you still see all the safe modes in all the corners and the XP build number at the center top....the display is working. As soon as it boots up it comes up and asks do you want to try System Restore or do you want to continue in safe mode....I have tried everything before sending this message. I have rebooted into Setup and tried to get it to reboot to the default settings, but that didn't work either....
...See More
screen appears different after safe mode
Q
Comments (11)
Yes,I've rebooted.I went to where I get SafeMode & entered "Start normal" PC seems to be functioning OK.No more "shut downs",blue screens. Desktop looks better.Now need to get icons a tad larger.But side bar is in correct proportions.It was way off. This forum looks pretty normal.Gmail is wonky.Home page is strange.Facebook looks pixelated. I will do what Mikey suggested after morning walk.When this thing isn't right it drives me nuts! On desktop there is a white border at bottom that wasn't there before. Thanks for help.Will be back later. rose
...See More
maddielee
Original Author
12 years ago
Thanks Raven...I will go to that site when I can see straight again.

Mikie, doing the repeated F8 just opened Safe Mode for me.

ML
zep516
12 years ago
Here is the skinny, Get yourself to the site raven suggested.

If you are infected with System Check it is important that you do not delete any files from your Temp folder or use any temp file cleaners. This is because when the infection is installed it will delete shortcuts found in various locations and store backups of them in the %Temp%\smtmp folder. It does this so that you when try to launch a program from your start menu, none of your shortcuts will appear and thus making you think that your computer has a serious problem. Therefore, you do not want to delete any of the files in your Temp folder as it will remove the backups that we will use later in the guide to restore your Windows Start Menu.

To make matters worse, recent variants of this family have been know to install the TDSS or ZeroAccess rootkits as well. These rootkits will attempt to stop you from using security programs that may help you to remove this infection.

Good luck.

Joe
maddielee
Original Author
12 years ago
Thanks Joe...I have posted over on LzD. Waiting for help before I touch the infected computer.
corrine_mvp
12 years ago
Thanks for posting that advice Joe. Maddielee has been given the instructions to follow at LzD.
maddielee
Original Author
12 years ago
Many thanks to raven and zep for referring me to the Lzd site. Corrine guided me through the process (with much patience) and my computer seems healed.

thanks agin,
ML
ravencajun Zone 8b TX
12 years ago
I am proud of you, I have been there watching your progress, I was right that was one seriously nasty infection. You were a trooper and kept going strong. Excellent work by you and the LzD team.
zep516
12 years ago
Great news! :) Glad it's resolved for you....

Joe

Related Stories

GARDENING AND LANDSCAPING 11 Ways to Make Your Sleeping Porch Even Better

By Becky Harris

Turn off that air conditioner and tune in to the delights of slumbering in the nighttime breeze

TRADITIONAL HOMES Houzz Tour: Historic Concord Grapevine Cottage’s Charms Restored

By Becky Harris

This famous property had fallen on hard times, but passionate homeowners lovingly brought it back

TRADITIONAL HOMES Houzz Tour: Connecticut Farm Restored for Generations to Come

By Mary Jo Bowling

A man renovates his extended family’s stately farmhouse and land. Sustainable practices are used in gardens, wetlands and recreation areas

FEEL-GOOD HOME Designing for Pleasure: A Safe and Sound Perch

By Design With Science

Canopy beds, low ceilings, high-back sofas: When it comes to comfort at home, we have something in common with our ancient ancestors

LIFE 10 Ways to Keep Your Home Safe While You're Traveling

By Laura Gaskill

Set off on your trip with peace of mind, knowing you've taken the right steps toward keeping your home secure

HOUZZ TV FAVORITES Houzz TV: See How Early Settlers Lived in This Restored Pilgrim House

Passionate restoration and preservation efforts give a 1665 home an honored place in the present

BEFORE AND AFTERS Kitchen of the Week: Classic White Farmhouse Style Restored

By Sarah Greenman

A couple remodel their kitchen to better match their 19th-century Oregon home’s style

BEFORE AND AFTERS Restoration Rallies a 1790 Stone Springhouse

By Becky Harris

An old outbuilding gets a new purpose — several purposes, that is — thanks to careful efforts by stonemasons and architects

ARCHITECTURE Back to the Futuro: Tour a Lovingly Restored ‘Spaceship’ Home

By Victoria Harrison

Travel back to the ’60s Space Age with a rare glimpse inside an original House of the Future

REMODELING GUIDES Major Remodel: Restoring a Queen Anne to Glory

By Becky Harris

Misguided 1970s changes marred this Victorian-era home in Portland, until a dedicated family moved in

Sponsored

More Discussions

Hard drive removal

5

UPS needed - which ones?

9

sound missing on Dell

3

Problems with Outlook 2013

1

Any suggestions for a very secure non-web-based email?

3