Nothing works and cannot find anything! - UnSpyPC and WareOut ?

[Guest]

A friend has a PC which does almost nothing, usually giving the message
"Windows cannot find XXX. Make sure you type the name correctly..." etc.
I found he has UnSpyPC.exe and WareOut.exe on there which I've since learned
are malware masquerading as anti-malware! (and gives false positives and may
damage legitimate software). Web advice I've seen so far suggests using
Add/Remove to get rid of them, reboot and then tidy up any DLL, TMP etc.
However, he can't run Add/Remove! We can't even use Windows Explorer - XP
says it cannot find it. Search cannot find things either.
Help! Any ideas ? Does he need to reload the whole of XP, losing
everything on there ? (I think he doesn't have any System Restore points as
he's not had the PC very long.) Nothing seems to work even in Safe Mode and
we've tried running the NAV CD but that doesn't fix anything. Thanks, Gerry
)

 

[Galen]

In GerryP777 <[email protected]> had this to say:

My reply is at the bottom of your sent message:

A friend has a PC which does almost nothing, usually giving the
message "Windows cannot find XXX. Make sure you type the name
correctly..." etc.
I found he has UnSpyPC.exe and WareOut.exe on there which I've since
learned are malware masquerading as anti-malware! (and gives false
positives and may damage legitimate software). Web advice I've seen
so far suggests using Add/Remove to get rid of them, reboot and then
tidy up any DLL, TMP etc. However, he can't run Add/Remove! We can't
even use Windows Explorer - XP says it cannot find it. Search cannot
find things either. Help! Any ideas ? Does he need to reload the
whole of XP, losing everything on there ? (I think he doesn't have
any System Restore points as he's not had the PC very long.) Nothing
seems to work even in Safe Mode and we've tried running the NAV CD
but that doesn't fix anything. Thanks, Gerry

He'll have system restore points if the malware didn't disable them. However
the first step would be, in this case, to download some apps and install
them and use them in safe mode... You can also try the add/remove applet in
safe mode which might be effective or at least a decent start.

Malware Cleaners and Repair :
http://kgiii.info/windows/all/general/malwarefix.html

Safe Mode :
http://kgiii.info/windows/all/general/safemode.html

If that does NOT work then it's probably a good idea to try a repair
installation next.

Repair Installation of XP :
http://kgiii.info/windows/XP/general/xprepair.html

Galen
--

"You know that a conjurer gets no credit when once he has explained his
trick; and if I show you too much of my method of working, you will
come to the conclusion that I am a very ordinary individual after all."

Sherlock Holmes

 

[NotMe]

If possible, boot to safe mode and delete or rename those 2 spyware files.
Generally if renamed, they won't be able to run at startup.

I would then install & run the MS Antispyware tool and Lavasoft's Adaware
and Safer Networking's Spybot Search & Destroy.
The last two are both are available from http://www.majorgeeks.com...left
column, spyware tools.

 

[Guest]

Hi NotMe, thanks for that.
I tried things in Safe Mode (e.g. Add/Remove Progs) but nothing worked.
I'll try the DOS commands in Safe Mode to get rid of them.
D'you think Explorer and search etc. will start working again or might
they have been permanently damaged ?
NAV & Spybot were already installed on there, not sure about MS antispyware.
Thanks, Gerry ) ps: I'll report back soon.

 

[NotMe]

From what you've said, I think you may have to do a repair install at the
least, possibly a wipe & reinstall.
Have you tried to run SFC?

 

[NotMe]

I forgot to include the command line...
from a cmd prompt it is sfc /scannow

 

[Guest]

Hi Galen, thanks for that.
There were no Sys Restore points (it's a fairly new PC - he's very
unlucky!)
So far, in Safe Mode, I've not been able to get anything to work e.g.
Control Panel's Add/Remove Progs (can I run that specifically from somewhere
?).
When I try eg Start/Run regedit, that doesn't work either.
I'm planning on trying Safe Mode CMD to delete the UnSpyPC.exe and
WareOut.exe and see if I can then do anything. I'm beginning to fear that
it's really deleted a lot of good stuff (eg regedit, explorer) in which case
I'm next thinking of trying a repair install of XP. Does that sound
reasonable ?
At the moment, we can't download anything because even simple operations
don't work. Thanks for the links. bw, Gerry )

 

[Guest]

Hi NotMe,
I don't know what SFC is. Is it standard or would I need to download
something (eg on my own and then somehow transfer it to his PC) ?
I'm kinda trusting so, if it's already there, I'll give it a whirl.
Thanks for that, Gerry )

 

[NotMe]

SFC, System File Checker, it should be included in any XP install and is run
from a command prompt, not from in Windows.

 

[Galen]

In GerryP777 <[email protected]> had this to say:

My reply is at the bottom of your sent message:

Hi Galen, thanks for that.
There were no Sys Restore points (it's a fairly new PC - he's very
unlucky!)
So far, in Safe Mode, I've not been able to get anything to work e.g.
Control Panel's Add/Remove Progs (can I run that specifically from
somewhere ?).
When I try eg Start/Run regedit, that doesn't work either.
I'm planning on trying Safe Mode CMD to delete the UnSpyPC.exe and
WareOut.exe and see if I can then do anything. I'm beginning to fear
that it's really deleted a lot of good stuff (eg regedit, explorer)
in which case I'm next thinking of trying a repair install of XP.
Does that sound reasonable ?
At the moment, we can't download anything because even simple
operations don't work. Thanks for the links. bw, Gerry )

Download them on your PC and either burn them to CD and bring them over or
bring your box over and network them.

Galen
--

"You know that a conjurer gets no credit when once he has explained his
trick; and if I show you too much of my method of working, you will
come to the conclusion that I am a very ordinary individual after all."

Sherlock Holmes

 

[Guest]

Hi NotMe,

I tried sfc /scannow on his PC in CMD mode but I got an error ...
Windows File Protection could not initiate a scan of protected system files
specific error code 0x000006ba [The RPC server is unavailable]

I renamed the two bad EXE's but it still seems a mess. From Start /
Programs, most of the groups show (empty) ! - including Norton!
Still can't figure out if the bugs are hiding the progs or whether they've
really deleted them! grrr! aargh! as Joss Wheedon would say!

Ay ideas ? Thanks, Gerry )

 

[Guest]

Interim Update ...

I renamed the two bad EXE's but it still seems a mess. From Start /
Programs, most of the groups show (empty) ! - including Norton! Can't figure
out if the bugs are hiding the progs or whether they've really deleted them!

Explorer doesn't work but so long as I know the filenames I hope to be able
to get things off CD ok.