Ultimate Boot CD

I've got myself in quite the pickle.

First, some very nasty malware snuck its way onto my laptop through a auto-download PDF. That embedded itself nicely before I could stop it.

One of the affected files was services.exe in system32, which was causing XP to auto shut-down. So I <wisely> chose to rename it to services.old

This, I suspect, now prevents my XP from booting in any mode (safe or previous). The OS boots, but freezes on a black screen with a white cursor.

So, first things first, working backwards, I would like to get in to DOS to rename services.exe back.

I have UBCD, but whenever I choose a DOS boot, the only drives it reveals to me are T, Q and A (CD, RAM and something else I forget right now..).

I can't seem to find any discussion on this issue. Any help?

Thanks.

If you have the newer UBCD5B12 boot to Parted Magic and you should have access to the system drive. Just use that to get to the file and change the name.

Thanks, got in and changed it back.

Booting now, so can get in and clean up what looks like Antivirus Pro 2010, but perhaps some others. Will clean it like I'm wielding a steel scrubbing brush

apocrypha wrote:Thanks, got in and changed it back.

Booting now, so can get in and clean up what looks like Antivirus Pro 2010, but perhaps some others. Will clean it like I'm wielding a steel scrubbing brush

Just a heads up, make sure you are NOT connected to the internet while you are cleaning your computer (seems like you would already know this) because that specific adware program updates it self automatically when connected to the internet. I recommend running spybot search and destroy in safe mode and remove everything it finds then reboot and run your normal scanners. Should make things easier.

Also recommend you get spywareblaster (freeware) and malwarebytes antispyware (free for personal use). Great programs as spyware blaster blocks from going to known bad websites, and malwarebytes detects things that spybot doesnt (not many but a few). Be sure to immunize with spybot if you havent already.