windows diagnostic virus, hijackthis log

Earlier this month, before you came here, did you have an Antivirus alert that flagged multiple files as being "infected"?

No, everything was fine until about two weeks ago when 'windows diagnostic' kept popping up saying I had issues with my hard drive, the windows don't pop up any more, I was able to find my files after the OTL but now they are gone again

i searched a filed and included hidden files, one i found the file I went to under the file tab, i checked include hidden files, now I can see everything under my documents from the start menu

redbull,
We need to do what we can to enable the installation of the new Java.
Be sure to follow these instructions exactly.
-------------------------------------------------------------
Now, run the Windows Installation Cleanup Utility, this will remove the registry entries for the Software.
Microsoft has officially retired this product. It evidently has some risk of failure.
It does not work properly for MS Office 2007 products, but we are only using it for Java.

You can download the Utility from the given link below. Use Firefox for this, so you can find the file, named msicuu2.exe
http://majorgeeks.com/Windows_Installer ... d4459.html
Click "Download at Major Geeks"
Double click it and let it install itself where it wishes. Accept the license, and click OK. Click Finish. It should report that it has been installed.
Go to Start, All Programs and click Windows Install Cleanup. It will likely be that last program on the list
The Windows Installer CleanUp Utility provides a dialog box where you can select one or more programs that were installed by Windows Installer.
You select the programs from the list in the Windows Installer CleanUp dialog box.
After you make this selection, the utility removes only the Windows Installer configuration information that is related to those programs.
In your case, select those items with Java, JRE, or J2SE in the name. You can select multiple items at once using the Control Key and a click.
Make SURE that Java, JRE and J2SE items are the ONLY ones selected, and click Remove

Removes the files and registry settings that make up the Windows Installer configuration information for programs that you select.
This may now enable the selected programs to Install or Uninstall properly.
-----------------------------------------------------------
REBOOT (RESTART) Your Machine
------------------------------------------------------------
Download and Install the latest version of Java Runtime Environment from here : http://java.sun.com/javase/downloads/index.jsp, and install it to your computer.
In the first section on the page, labeled JDK 6 Update 24 (JDK or JRE), click on the button labeled Download JRE. Do NOT choose the button labeled "Download JDK".
Select the Platform Windows and check the box to agree to the license.
Choose the Windows Offline installation version and click on the link.
Download it, choose Save, and save it to your desktop.
Then doubleclick it on your desktop, (or right click and choose "Run as administrator") and it will install the newest version of Java for you to use.
During the Installation, be sure to UNCHECK any offer for McAfee Security Scan Plus. It's just adware.
When it finishes, you can remove the Installer from your desktop.
askey127

it still didn't work, i then changed the destination folder and selected my documents and it successfully downloaded

redbull,
I think your machine is free of malware.

Let's clean up the tools we used.
Please start OTL on your desktop, and click the button labeled "Clean UP".

Good luck.
askey127

I still can't see any of my programs, all of my documents I can see now are shaded compared to any new ones I have added and also show on my desktop, desktop is also still a grey background.
as well when i tried to run zzz.exe the initial warning that I saw when I first had the problem showed up and then shut down my computer.
also now on startup is shows the options for which operating system to use

redbull,
The brief "black Screen" you see at startup is from the Recovery Console.
The Recovery Console produces a brief (2 second) black screen at bootup which allows an additional technical resource for repair by a technician in case of a major failure. In regular operation, you can ignore it.

You can show all files (except System Files) this way:
---------------------------------------------
Show All Files
Open Windows Explorer (My Computer)
In the top menu, choose Tools, Folder Options
Click on the View tab
In the list, under Hidden Files and folders, Check Show hidden files and folders
Uncheck Hide extensions for known file types
Click OK
---------------------------------------------
There is a possibility that the infections changed this item in your registry. Let's check and see.
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  
  
  :reg
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File ExecutionOptions /sub
  
  
  
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

At some point in time, you used Bittorrent, and also at some point clicked when asked to "update" your codec to watch a video or similar. Either of these actions will get your computer infected, and did.
Some of the system operation problems you are having may well be caused by damage to your system files from the infections.
If they can't be identified, you won't have any realistic choice but to reinstall Windows, or use the Manufacturers System Recovery to put the machine back to its "as purchased" state.

If this happens to be caused by an infection in the Master Boot record of the hard drive, we can try to repair it using that Recovery Console at bootup. It is not without risk, however, so you would need to backup your critical documents first, and be willing to take the risk to achieve success.
A failure would mean an inability to boot the machine, and the only option would be the HP disk or System Recovery.
Success would mean TDSSKiller and ComboFix would both subsequently run correctly and quickly fix any remaining problems in your machine.
askey127

My computer will not get past the black screen on start up, it says I need to reinstall the file <Windows root>\system32\ntoskrnl.exe

redbull,
I have no idea why the system deteriorated like that.

IF you still get the brief startup screen that offers a choice between Microsoft Windows XP and Microsoft Windows Recovery Console,
reboot the machine and quickly use the arrow key to choose Microsoft Windows Recovery Console.
(The recovery console is also a black command screen, but will show a cursor.)
You will be prompted for the Administrator password. If there is no password, just hit <Enter>
You will likely get a prompt labeled C:\Windows >
type the following at the cursor:

fixmbr

It will complete quickly and return to cursor. Then type:

Exit

The machine will reboot, and you may be able to start in Windows this time.
-------------------------------------------------------------------
If you cannot get the Recovery Console option at bootup per above, you will need to perform a Complete System Recovery.
There realistically are no other choices.
Your machine appears to be an HP model.
HP customer support can help with how to do this on your model number.
It usually involves hitting a certain Function key as the boot process starts, and choosing Complete System recovery.
You programs and an antivirus will have to be installed again.

askey127