Solved: Help two files were accidently deleted

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

taina

Thread Starter
Joined
Jan 9, 2005
Messages
75
WINDOWS\System32\smss.exe and C:\WINDOWS\system32\winlogon.exe were accidently deleted. How can I get them back. My system retore was turned off so no chance going there if this was any possibility. Help I can't even shut down my pc. Please help.
 
Joined
Apr 3, 2005
Messages
177
If unfamiliar with recovery cnsol & unable to access the web you may face a reinstall
situation.Presuming the o/s is XP or ME which I deduce.,first task is to find the Windows CD.Even to access the recovery that's the first step.If you
can,look in the recycle bin & see whats in there,'accidental deletes' should
go there.,from where they can be 'restored'.
 

taina

Thread Starter
Joined
Jan 9, 2005
Messages
75
I reinstalled windows xp and it seems fine.

EAFiedler, I didn't try your remedy. I had already reinstalled windows xp. It seems like it worked. I have a virus I am trying to get rid of and accidently highlighted the wrong info from a post when I realized what I have done I had already deleted the two files. Shame on me....I am so stressed over this virus issue and being careless in the process. I actually picked up the alcan worm and possible another I am unable to Identify. I do know that it stopped my NAV from running. I cannot seem to turn it on.

Thanks to both of you for your replies. I now have to deal with this virus. It has me almost in tears.
 
Joined
Apr 3, 2005
Messages
177
Congratulations Taina on the reinstall,the worm [email protected] microsoft might be
useful for you now,scans &removes a lot of worms.Nortons AV is not doing
its job for you(surprise) you might consider alternatives available at pcworld,
Kaspersky personal is available for trial and is excellent,also avast is good & free.http://www.pcworld.com/downloads/collection/0,collid,59,00.asp----a
good source of 'real' firewalls,which XP's isn't as it doesn't monitor outgoing
traffic,or block diallers etc.If it's disabled you can install and run others.Let
us know of any further problems if you have them,but I hope you'll be ok now.
Good LUCK.
 

taina

Thread Starter
Joined
Jan 9, 2005
Messages
75
Deodar,
Thanks for the suggestions. I will look into it.
 

EAFiedler

Retired Moderator
Joined
Apr 25, 2000
Messages
14,172
taina how is your progress so far?

Run an online Anti-Virus scan from at least one and preferably 2 of the following sites

Download, Install and check each of the following Spyware tools for updates:
(If you already have the following, please make sure it is the latest version and has been updated)

  • Ad-Aware SE 1.06:
    Click on Full System Scan and deselect Search for negligible risk entries. Have Ad-Aware SE remove what it finds.
  • Spybot-S&D 1.4:
    Have it fix what it finds marked in Red.
  • Spyware Blaster 3.4:
    Click on Updates > Check for Updates Switch to Protection
    Under Quick Tasks click Enable All Protection. Close Spyware Blaster.
  • HijackThis 1.99.1:
    Double left click on the file and it will install in:
    C:\Program Files\Hijackthis
    It will create an entry in the Start Menu and give you the option of installing a shortcut on the desktop.
    Click on the entry in the Start Menu or use the shortcut on the desktop to run HijackThis.
    This will allow HijackThis to make backups properly.

After running your online virus scans and scanning with with Ad-Aware SE and Spybot S&D,
close all programs, reboot to complete the removal process.

Start HijackThis click on Do a system scan and save a logfile.
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Close HijackThis and post your complete log file here and one of our security experts will take a look at it.
 

taina

Thread Starter
Joined
Jan 9, 2005
Messages
75
I ran Norton last night and it ran forever so I took a look at in the morning and it found (two) W32.tiot and something else-I cannot remember. I tried to have it repaired/deleted and none was successful. I followed the paths and deleted them manually. But I am not sure if its gone. I used DAP and this is one where the W32 toit was supposed to be- So that too I deleted. I have not run any other scans at this point. Another worm was found earlier was [email protected] and Alcan worm-not sure if this is gone as well.

I do have most recent of:
Ad-Aware SE 1.06
Spybot-S&D 1.4
Spyware Blaster 3.4

I have ran them all and from the beginning of all of this it had not picked up anything but NAV did.

My NAV after loggin off and then back on would not turn on as part of the problem and I found a quick fix but prefer to have it as it should be. I took the Ccapp.exe shortcut from its location C:/prog/common/symantec shared/ccapp.exe And placed in C:\Documents and Settings\All Users\Start Menu\Programs\Startup and this works. The only problem is that at startup it is the last program to startup and therefore I continue to get the warning message that it is turned off- until it auto starts at startup.

Ok- per Deodar's suggestion I did download and run worm [email protected] microsoft and nothing was found. Clean.

running PandaActiveScan now...full pc scan- It's been running for sometime...so I will update you on my progress and once I have ran HijackThis. Thanks again for all those that gave my post the attention. I am most grateful.

____________________________________________________

Ok here is what PandaActive Scan Found: Are these truely viruses?
Incident Status Location

Possible Virus. No disinfected C:\Program Files\BitPim\_libusb.dll
Possible Virus. No disinfected C:\Program Files\Mozilla Firefox\TrueImageCorporateWorkstation8.0_d_en.exe[AcronisTrueImageAgentWorkstation.msi][unk_0054][_D4A89383F06D901FA36B4C07D65D9BAC]
Possible Virus. No disinfected C:\Program Files\Mozilla Firefox\TrueImageCorporateWorkstation8.0_d_en.exe[AcronisTrueImageWorkstation.msi][unk_0056][_D4A89383F06D901FA36B4C07D65D9BAC]
Virus:Eicar.Mod No disinfected C:\Program Files\PestPatrol\Help.chm[HowCanITestDetection.html]
Possible Virus. No disinfected C:\Program Files\Susteen\Driver Installers\DP\USB Drivers\USB IrDA Driver\DATA1.CAB[resirmon.exe]


It references DataPilot and BitPim two programs I use to transfer data to and from my cell phone.
Acronis TrueImage what is this? Is it a program?

This is a full computer scan two hours worth. I guess what is left is to run HijackThis. Its pretty late now...so I will have to start up again tomorrow.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top