Solved: Help two files were accidently deleted

[taina]

WINDOWS\System32\smss.exe and C:\WINDOWS\system32\winlogon.exe were accidently deleted. How can I get them back. My system retore was turned off so no chance going there if this was any possibility. Help I can't even shut down my pc. Please help.

 

[Deodar]

If unfamiliar with recovery cnsol & unable to access the web you may face a reinstall
situation.Presuming the o/s is XP or ME which I deduce.,first task is to find the Windows CD.Even to access the recovery that's the first step.If you
can,look in the recycle bin & see whats in there,'accidental deletes' should
go there.,from where they can be 'restored'.

 

[EAFiedler]

Hi taina

If the files can not be Restored from the Recycle Bin,

Run the System File Checker to restore the files, you may need your Windows XP disk.

Start > Run
key in:
sfc /scannow

Note the *Space* between sfc and /scannow.

Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)

Scannow sfc

Let us know if that works for you or not.

 

[taina]

I reinstalled windows xp and it seems fine.

EAFiedler, I didn't try your remedy. I had already reinstalled windows xp. It seems like it worked. I have a virus I am trying to get rid of and accidently highlighted the wrong info from a post when I realized what I have done I had already deleted the two files. Shame on me....I am so stressed over this virus issue and being careless in the process. I actually picked up the alcan worm and possible another I am unable to Identify. I do know that it stopped my NAV from running. I cannot seem to turn it on.

Thanks to both of you for your replies. I now have to deal with this virus. It has me almost in tears.

 

[Deodar]

Congratulations Taina on the reinstall,the worm [email protected] microsoft might be
useful for you now,scans &removes a lot of worms.Nortons AV is not doing
its job for you(surprise) you might consider alternatives available at pcworld,
Kaspersky personal is available for trial and is excellent,also avast is good & free.http://www.pcworld.com/downloads/collection/0,collid,59,00.asp----a
good source of 'real' firewalls,which XP's isn't as it doesn't monitor outgoing
traffic,or block diallers etc.If it's disabled you can install and run others.Let
us know of any further problems if you have them,but I hope you'll be ok now.
Good LUCK.

 

[taina]

Deodar,
Thanks for the suggestions. I will look into it.

 

[EAFiedler]

taina how is your progress so far?

Run an online Anti-Virus scan from at least one and preferably 2 of the following sites

• Trendmicro HouseCall
• PandaActiveScan
• SymantecSecurityScan
• RavAntiVirusScanOnline
  Allow them to clean/delete any spyware/malware or viruses/trojans they may find.
  Make a note of any files flagged that were unable to be cleaned or deleted.

Download, Install and check each of the following Spyware tools for updates:
(If you already have the following, please make sure it is the latest version and has been updated)

• Ad-Aware SE 1.06:
  Click on Full System Scan and deselect Search for negligible risk entries. Have Ad-Aware SE remove what it finds.
• Spybot-S&D 1.4:
  Have it fix what it finds marked in Red.
• Spyware Blaster 3.4:
  Click on Updates > Check for Updates Switch to Protection
  Under Quick Tasks click Enable All Protection. Close Spyware Blaster.
• HijackThis 1.99.1:
  Double left click on the file and it will install in:
  C:\Program Files\Hijackthis
  It will create an entry in the Start Menu and give you the option of installing a shortcut on the desktop.
  Click on the entry in the Start Menu or use the shortcut on the desktop to run HijackThis.
  This will allow HijackThis to make backups properly.

After running your online virus scans and scanning with with Ad-Aware SE and Spybot S&D,
close all programs, reboot to complete the removal process.

Start HijackThis click on Do a system scan and save a logfile.
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Close HijackThis and post your complete log file here and one of our security experts will take a look at it.

 

[taina]

I ran Norton last night and it ran forever so I took a look at in the morning and it found (two) W32.tiot and something else-I cannot remember. I tried to have it repaired/deleted and none was successful. I followed the paths and deleted them manually. But I am not sure if its gone. I used DAP and this is one where the W32 toit was supposed to be- So that too I deleted. I have not run any other scans at this point. Another worm was found earlier was [email protected] and Alcan worm-not sure if this is gone as well.

I do have most recent of:
Ad-Aware SE 1.06
Spybot-S&D 1.4
Spyware Blaster 3.4

I have ran them all and from the beginning of all of this it had not picked up anything but NAV did.

My NAV after loggin off and then back on would not turn on as part of the problem and I found a quick fix but prefer to have it as it should be. I took the Ccapp.exe shortcut from its location C:/prog/common/symantec shared/ccapp.exe And placed in C:\Documents and Settings\All Users\Start Menu\Programs\Startup and this works. The only problem is that at startup it is the last program to startup and therefore I continue to get the warning message that it is turned off- until it auto starts at startup.

Ok- per Deodar's suggestion I did download and run worm [email protected] microsoft and nothing was found. Clean.

running PandaActiveScan now...full pc scan- It's been running for sometime...so I will update you on my progress and once I have ran HijackThis. Thanks again for all those that gave my post the attention. I am most grateful.

____________________________________________________

Ok here is what PandaActive Scan Found: Are these truely viruses?
Incident Status Location

Possible Virus. No disinfected C:\Program Files\BitPim\_libusb.dll
Possible Virus. No disinfected C:\Program Files\Mozilla Firefox\TrueImageCorporateWorkstation8.0_d_en.exe[AcronisTrueImageAgentWorkstation.msi][unk_0054][_D4A89383F06D901FA36B4C07D65D9BAC]
Possible Virus. No disinfected C:\Program Files\Mozilla Firefox\TrueImageCorporateWorkstation8.0_d_en.exe[AcronisTrueImageWorkstation.msi][unk_0056][_D4A89383F06D901FA36B4C07D65D9BAC]
Virus:Eicar.Mod No disinfected C:\Program Files\PestPatrol\Help.chm[HowCanITestDetection.html]
Possible Virus. No disinfected C:\Program Files\Susteen\Driver Installers\DP\USB Drivers\USB IrDA Driver\DATA1.CAB[resirmon.exe]

It references DataPilot and BitPim two programs I use to transfer data to and from my cell phone.
Acronis TrueImage what is this? Is it a program?

This is a full computer scan two hours worth. I guess what is left is to run HijackThis. Its pretty late now...so I will have to start up again tomorrow.

 

[taina]

Posted HJT Log in a new thread because I had already put the status on this one as solved and wanted to be sure my log was viewed.

posted here: http://forums.techguy.org/showthread.php?p=2756827#post2756827