Computer Help forum

General discussion

Prunnet.exe, popups, Spybot S&D won't run, other problems..

So I've had quite a few problems with my computer recently, it started when random ads would pop up using iexplorer, even though I always use firefox and never had iexplorer opened, when this was going on, iexplorer.exe would still run in my task manager even though I had closed all the windows, and would be running in the background on startup. Then my computer starting freezing a lot, not restarting, not starting at all...etc

I also found 3 foreign .exe files in my task manager, one of which was prunnet.exe (can't remember the other 2) and found them in C:/WINDOWS/system32 and deleted all three, this seemed to stop the freezing but the pop ups still happened (along with random sound clips), I then found 'RON ads by agadoo' in my control panel and uninstalled that which stopped the ads.

This was all in the last week and ever since then my internet is extremely slow, and whenever I do a search on google or yahoo, when I click on a normal result link I always get redirected to random pages (and this happens for any link result, i could search for google and click on the link for google.com and end up on some church site...), this doesn't happen if I copy paste the URL from the search results and just go to the site. (Also if I do a search after just restarting my computer I can get to the correct page, but after a minute or two the redirecting starts)

One more thing is that ever since this started my spybot S&D will not run, if I click on it, it runs in my tast manager but does nothing, and Mcafee can't find anything else wrong.

I know this is a lot but if anyone has any ideas on how to fix my problems that would be greatly appreciated!!!

Discussion is locked
You are posting a reply to: Prunnet.exe, popups, Spybot S&D won't run, other problems..
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Prunnet.exe, popups, Spybot S&D won't run, other problems..
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
This might work for you. It worked for me

In reply to: Prunnet.exe, popups, Spybot S&D won't run, other problems..

Collapse -
Removal of prunnet.exe

In reply to: Prunnet.exe, popups, Spybot S&D won't run, other problems..

I just got hit with this one. Fortunately I was able to completely remove it. First of all, I immediately stopped what I was doing when the very first pop up hit. I checked the task manager and noticed the prunnet.exe, along with several .tmp processes. A search revealed the exe file in system32, and I notied the created date was within minuets. Just killing it won't work, as it starts right up again, even if you delete its entries in the "Run" key in the registry. I noticed several other things to, it installs itself in the add/remove programs list as "advertisement service" There is also an accompanying "gadcom.exe" in the users profile under either local settings or application data. Finally, it puts several dlls in the system32 folder. Here is the method I used to remove it.

I used a tool called BartPE to remove everything. You can find more info at http://www.nu2.nu/pebuilder/ It allows you to boot from a CD and access the file system. First step: Start>Run and type regedit to get to the registry. Be very careful. you can do alot of damage to your computer here. I recommend backing up the registry. Then, go to hkey_local_machine>software>microsoft>windows>current_version>run. Under this key delete the strings that contain prunnet, gadcom and any rundlls. Second step: search in explorer for prunnet. it should be in system32. There are several accompanying dlls, so sort by date created, and look for the ones created at the same time as prunnet. For me there were 6 of them with names consisting of completely random characters. Write these down. There was also a batch file associated with one of the dlls. Third Step: restart and boot to the BartPE cd (I did a cold shutdown to make sure all the files I was going after were frozen.) Now I did several things. 1) Using the file manager search for the dlls from before. Delete them all, along with any .bat files of the same name, if any. 2) Search for prunnet, and delete it. 3) delete all of the contents in the folder c:\windows\prefetch 4) go to the users profile in Documents and settings. Search for gadcom, and delete it. 5) In the users profile, delete all of the contents of Local Settings\Temp.

This should be enough to kill it. When you reboot, go back into the registry and search for prunnet, and gadcom, deleting any instances of them. Also in add/remove programs, remove advertising service if it is still there, and confirm that you want to remove it from the list. This was enough to completely remove it for me.

Collapse -
Jim - I also have Prunnet.exe but I can't run PE Builder

In reply to: Removal of prunnet.exe

Jim: I just got hit as well by the Prunnet.exe virus, and found your post by searching Google. I'm having a problem following your solution using PE Builder, and here's why.

1. I live in the US and purchased my computer new in 2002 from Gateway. Windows XP came pre-installed, and I did not get the original Windows XP CD with the computer. Instead, they sent a Gateway CD that says "Operating System (Windows XP - Home Edition)". However, this apparently is not what PE Builder requires to create a bootable CD, since PE Builder says it finds 0 valid source locations, even though this Gateway CD is in the drive. When I insert this CD into a drive, however, it autoruns, and a window comes up that says Welcome to Microsoft Windows XP, with the following choices: 1) Install Windows XP, 2) Install Optional Windows Components, 3) Perform Additional Tasks, 4) Check System Compatibility. So, it SEEMS that it has Windows XP on it, but PE Builder is not recognizing it as a valid source.

2. Just for fun, I clicked on the Install Windows XP option on the Gateway CD, and I get a message that says "Setup cannot continue because the version of Windows on your computer is newer than the version on the CD". This is because I bought the computer 6 years ago, and several updates to the XP service packs have been done over the years. So, even if I were able to create a bootable CD with PE Builder, it would be an outdated version of what my computer is running right now.

Do you have any suggestions on how I can proceed, if at all, to get rid of this pain in the *ss virus? I have Avast Anti-Virus installed, and it was running when I picked up the virus, so I don't know why it didn't prevent it. I've also run a full Avast can (as well as a full Ad-Aware scan) since getting it, and even though they found find and "delete" the virus, I'm still finding prunnet.exe and the dll's running in my task manager.

Thank you.

Shawn Good

Collapse -
I had it and killed it...

In reply to: Jim - I also have Prunnet.exe but I can't run PE Builder

Vundo aka virtumonde... running windows xp sp3

I used a combination of Jim's info and some innovation. I had a BartPE cd handy, did what Jim said to do -- this killed the popups, but my auto updates (windows, symantec, etc) were still being blocked by the virus. I asked an IT guy from my company about it, and he said to download malwarebytes. I did so, but I installed it to a THUMBDRIVE, instead of my system (C) drive. This made all the difference in the world - I could run the anti-malware from the thumbdrive without the virus detecting my connection to definition updates and so on - it ran, found something like 64 infected files, and quarantined them. I rebooted and found that I COULD update my symantec antivirus software, and ran it and the anti-malware one more time to make sure.

Here's the logfile hoping it helps.

Malwarebytes' Anti-Malware 1.31
Database version: 1597
Windows 5.1.2600 Service Pack 3

1/2/2009 2:39:16 PM
mbam-log-2009-01-02 (14-39-14).txt

Scan type: Quick Scan
Objects scanned: 57214
Time elapsed: 3 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 42
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 20

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/popcaploader.dll (Adware.PopCap) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{80a6ce6c-090b-4906-a069-493ab2f3aedf} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{80a6ce6c-090b-4906-a069-493ab2f3aedf} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\gevimasi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\isamiveg.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> No action taken.
C:\WINDOWS\system32\hizidaku.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\luzilufe.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\senekaqgxulmcj.dll (Trojan.Seneka) -> No action taken.
C:\WINDOWS\system32\bosurezo.dll (Trojan.Vundo) -> No action taken.
C:\RECYCLER\S-1-5-18\Dc3.dll (Trojan.Vundo) -> No action taken.
C:\RECYCLER\S-1-5-18\Dc4.dll (Trojan.Vundo) -> No action taken.
C:\RECYCLER\S-1-5-18\Dc162.tmp (Trojan.Downloader) -> No action taken.
C:\RECYCLER\S-1-5-18\Dc164.tmp (Trojan.Agent) -> No action taken.
C:\RECYCLER\S-1-5-18\Dc2.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\senekaodkjwspv.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekasmydjjjk.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekadf.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\seneka.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekalog.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\seneka.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\senekauvptdwya.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msiconf.exe (Trojan.Downloader) -> No action taken.

Collapse -
Lost 2 hours to this yesterday, but...

In reply to: I had it and killed it...

I got prunnet.exe at work yesterday and spent the first hour investigating all the processes running in Task Manager while also running a full scan with Symantec Antivirus. I aborted that scan when I came upon this post and immediately downloaded Malwarebytes. In only one more hour and two quick scans with Malwarebytes 43 trojans were detected and removed.

Thank you SO MUCH, cnet community!

Chadwick ~avid Buzz Out Loud listener

Collapse -
Saving Data from prunnet.exe

In reply to: I had it and killed it...

Got prunnet.exe on 4 yr old Gatway Laptop (Win XP Home).

Classic symptoms. Bogus links in browser. Can't update Symantec AV. etc.

Postings here very helpful.

Currently running Malwarebytes on infected machine, though I'm running from C drive. Tic, tic, tic... running for 54 mins. Has found 23 infected objects already. Will later try to run from thumb drive as recommended on posts here.

We have two questions:

1. Can anyone tell us if between scans we can *safely* copy data files (MS-Word files we're most concerned about, though jpg and mp3 also would be nice) to a flash drive?

2. This is the first time we've ever been hit with this type of thing. We run Symantec and ZoneAlarm. Does anyone know how we might have gotten this thing? We only surf to professional sites, Netflix, and news sites for the most part, we don't open unknown e-mail attachments etc. How is this thing getting through?

Collapse -
yes

In reply to: Saving Data from prunnet.exe

You should have no problem making a backup, just as long as you manually copy. Do not use a backup utility because it will bring Prunnet with everything else.

You can save anything that you wish, just consider the flash drive infected until you do a scan on a machine that is not infected. Repeat the process as much as you like and fix the Gateway knowing your files are safe.

Collapse -
other issues with prunnet

In reply to: Removal of prunnet.exe

When you were infected with prunnet.exe, were you still able to visit any anti-viral sites such as Trend Micro or symantec? It seems whenever I try to go to a site that contains any brand named anti-viral programs I am redirected somewhere else, either towards an ad site or simply the page doesn't load.
Can anyone help me with this? =/ I got the prunnet.exe like 3 hours ago.. and have been racking my wracking my brain over what to do.

Collapse -
Prunnet issue

In reply to: Prunnet.exe, popups, Spybot S&D won't run, other problems..

I am sorry to says this but if you have had this issue for a few days already you system may have already be too far gone for the regular pc user to fix. I would suggest going to a computer shop but they would more than likely just ghost your machine which would ultumately mean all or some of your work inforamtion on your computer would be lost. I took the other raod and went to Cyber defender and for a nominal fee they remote access my machine and fixed the issue. I would strongly suggest this route because the longer you wait is the more corrupt your machine will ultimately get until it no longer works and THEN you will need a whole new hard drive.

Collapse -
I seem to have killed it with malwarebytes

In reply to: Prunnet issue

Actually, two days ago I downloaded and ran Malwarebytes as Vundokiller suggested. It found 27 trojans and viruses, quarantined and/or deleted most of them, then deleted the rest of them upon reboot, and everything seems to be fine. I've done 2 full scans since (with malwarebytes and Avast), each of which took more than 6 hours apiece, and no problems have been encountered. Seems to be cleared up.

Thanks !

Collapse -
awesome

In reply to: I seem to have killed it with malwarebytes

I'm glad we can kill these things. I have had no issues since I ran the malwarebytes as well. Everything updates like normal. I know the trojan came from OKCupid as a drive-by infection they have had for a while. Thanks for reposting the result!

Collapse -
Vundo Trojan/Prunnet/ bunch of crazy dlls

In reply to: awesome

I just got rid of it, really annoying I used Malwarebytes recommended on here ( which was amazing as Norton internet securty & antivirus didn't detect at all, even tho it had the latest update) - last time I use NAV gona switch to just a firewall & malwarebytes.

I used a full system malwarebytes scan cleaned everything restarted - ran a second scan there was quite alot of stuff still existing as it reboots on start up - so i Turned System Restore OFF than ran a scan again and malwarebytes said it would delete infected files on boot up as these files are ment to reboot themselves on start up - pretty nifty

and so far so good!

Collapse -
Trojan

In reply to: Vundo Trojan/Prunnet/ bunch of crazy dlls

Also had it not been for Forum discussion like this I would have not resolved the problem - its great that things threads like this exist - Please contribute your experiences and help others

(i just created an account rite now to post my experience hope it
helps)

Collapse -
Additional tools

In reply to: Trojan

I am working on this virus now, what a pain in my ****. I would like to offer that a lot of this can be done by booting into safe mode rather than using bartPE. Press F8 during boot up and select safe mode with networking. This lets you do web research while working on the issue. Also, I find the sysinternal tool "autoruns" extremely valuable. The first thing to do is look for entries that have no publisher. Search any suspicious entries on the web (thats how I found this forum about prunnet)From autoruns you can either disable or delete entries. Prunnet showed up with 3 different entries in my various run locations. Thanks for the tip about malware. when I am all done with my current process I will spin that as well.

Collapse -
prunnet.exe

In reply to: Additional tools

I have the same issues however I can't even run Malwarebytes. It won't install on the infected computer so I installed it onto a flash drive. The computer won't run the program because of an error message about stack overflow. I tried it in safe mode but it says it can't start the service. I can't run Adaware because I get a million error messages popping up.

Any suggestions?

Collapse -
good luck

In reply to: prunnet.exe

It seems you're screwed. Once Prunnet gets to the stage you're at, it protects itself. Windows would not let me delete it. Prunnet cuts off all communications with outside sources and convinces certain versions of windows that it is a windows component. It is just the same as other program files that the admin level can't delete. The files that are strings of seemingly random characters are windows components as well, and admin can't delete those either.

What I would recommend doing is letting windows boot up. Click start. Type "r".
A dialog box will come up. Type "CMD" or "command".
This will bring a DOS Prompt.
Type "del c:\windows\system32\prunnet.exe"
If it deletes the file, you should be able to run a restore or reinstall the damaged programs. But make sure to run a virus scan and ensure that prunnet doesn't have any other components left by doing a search and going into the add/remove programs in the control panel.

I started a restore, realized I clicked the wrong one and hadn't backed up recently and my wife has five weddings worth of pictures and so on. This gave me the infamous "hal.dll" error which can mean a number of things.
My problem is that I can't get the DOS prompt to let me use wildcards or move folders to my thumb drive. I would have to move thousands of pictures one by one, typing the date stamp for each individual copy I want to make.
I need to figure out how to get a DOS boot disk without using a floppy in a different version of DOS than the one that's embedded in the recovery console.

If anyone knows how to do that, please inform.

As for Pmart15, the DOS prompt is your friend right now, but it might not fix your problem. Deleting Prunnet won't undo the damage, but you can reinstall IE and such. If not, you will have to do a destructive restore. I am in that boat and manually backing up data is no fun ride.

Collapse -
Good luck

In reply to: good luck

Ok, so I fixed my problem and got rid of prunnet.exe and all associated files. I reluctantly connected the computer to the Internet and ran an online scan from I think http://eset.com/onlinescan and it found a bunch of infected files. After a restart it was running soooooo much better. I was able to install and use Malwarebytes and that found even more. McAfee is now installed and scanning regularly.

All this to say, each instance seems different so don't give up, keep trying different programs.

Collapse -
prunnet

In reply to: prunnet.exe

In safe mode you can run AVG Free in command mode (C:\Program Files\AVG8\avgscanx.exe). You cannot run the GUI version though. The command line version uses the same virus files though. Also in safe mode you can do a regedit and remove prunnet entries, you can run autoruns to find wacked startup issues as well. Good luck. I seem to have removed mine.

Collapse -
Well, it's not just that. Nothing ever is

In reply to: prunnet

That's the problem, In safe mode or in the recovery console(New name for DOS Prompt, also command prompt) the dos doesn't allow for executables. There's no run, exe, execute, or other variant of that command allowed. Also, it allows no wildcards(*.jpg or file.*) or folder transfers. I have to pick one file at a time and transfer them over.
I would like to use my thumb drive or a CD as a boot disk. I can easily change the bios and tell it to use whatever drive I want. I just can't find the right CMD.CMD or command.cmd file that will boot up. The closest I've got is a blank screen with a blinking cursor. There's also the risk of the software being malware, disguised as a helpful, free boot disk.

I can't figure out why it's not working for me. The OS is moot, it's a boot. My PC should boot up any version that I have on a disk. There are very few compatibility issues, if any. I am just at a loss.

Maybe I have the idea wrong. I haven't actually utilized dos in about a decade. The electronics technician I did on the sub was totally different stuff and the database stuff I'm doing now is Microsoft Access and a few other pseudo-dos programs. But none of them run like dos or act like dos. So I'm really pissing in the dark here...
Is a dos boot disk just command.cmd on a disk or is there more to it? I have done a zip package that had more files than that, but it did the blank screen thing.

Once I get a working DOS boot program, I fully intend on simply saving the important files and doing a clean wipe, or a destructive restore. I want to be very sure that there's no remnant of the Prunnet virus left.

Collapse -
hmmm

In reply to: Well, it's not just that. Nothing ever is

So you are telling me that when you F8 into safe mode that you go to start>run>cmd. Once in that command prompt, you cannot execute any files like calc? You don't have to type "run calc" or anything like that. Also if you start "safe mode with networking" you should be able to use IE to grab stuff from the net. If your command prompt is that hosed, you do have serious issues. Type echo %PATH% and tell me what it returns. I'll help if I can.

Collapse -
that's correct

In reply to: hmmm

No version of dos I've ever used has been this frustrating. I type help for the command list and it's barely over a page long. Most of it is recovery and config stuff. Nothing has helped.
to make it worse, no exe, run or other command function exists. I've also tried to use copy and it will not allow copying folders or using wildcards. This sucks. If I want to copy a folder, I don't see a single reason I shouldn't be able to. They actually have to do extra work to program it that way. I have to copy one file at a time and it's not fun.
But if I can get a different version of dos to boot and change the bios to use my flash drive, which it does see and will use, then I should be able to get all my wife's files backed up in twenty minutes. Then I could start the destructive restore, walk away and come back to a PC with factory settings.
That shouldn't be such a big "IF" but it is what it is.

If anybody knows of a site I can trust that will provide working DOS boot software, I would be very appreciative and much happier.

The VA is buying me a new laptop for college, but that is not going to be the community computer. That one will be for me only, so I need this PC back up. I can do the restore, but I don't want to destroy all my wife's pictures. She's got most of them backed up, but two or three weddings and a couple of folders with family stuff haven't been backed up. So there's the dilemma.

Collapse -
None will work

In reply to: hmmm

The only thing that can start is the dos prompt. Anything with windows won't start because of the hal.dll error. hal.dll has been rebuilt and replaced, so I know it is something else, like a boot.ini issue. I've done the boot reconfig as well and that doesn't help.

So the explore grab doesn't work. I could just remove the hard drive and have some pc shop back up the data, but this should be simple.

I'll run the %path% tonight if I can, but once again, I don't think echo is a command allowed in this dos.

The windows xp is media center, and it should work better than this. I don't think there's anything wrong with dos, all the commads it allows work fine, but it's just really limited.

I appreciate the help. I'm just pissed because I know what I'm doing, one wrong click in the restore menu did this. I hoped that I powered down the PC before it did anything, but apparently not. Oh well, we pay for the stupid things we do.

Collapse -
boot disk

In reply to: None will work

Collapse -
so...

In reply to: prunnet

the echo command is not available in my dos either. The link you gave looks good. On my Vista laptop, the command prompt doesn't allow making bootsectors in removable devices, so I'm trying to get it on a CD using the bootdisks site, I am not entirely sure if it'll work. It seems the term "Boot Disk" means something entirely different than I think when I say it.

I just want a dos prompt that works as I know it should. This is apparently a complicated task now that we don't use floppy disks anymore. The only computer I know of right now with a floppy is the one on my desk at work in the navy. They always use old, outdated stuff. They've got window's 2000 on them and have only had dvd-rw drives for a few years for us pawns to use.

Oh well... If there's a simple way to make a CD boot, please let me know.

Collapse -
linux

In reply to: so...

If your just after some files, then it might be easiest to just boot to a linux live-CD (runs the complete OS from the CD), transfer the files over the network or to a usb device and then proceed with re-installing. Using a Live-CD doesn't mean you have to know linux, it looks basically the same as windows. Many even prefer it. Here is a link to my favorite. http://www.knopper.net/knoppix-mirrors/index-en.html

Collapse -
ubd

In reply to: linux

Collapse -
Thank you

In reply to: ubd

I will try this as soon as I get some time. I've tried two different versions and I'm unsure what would cause a dos boot disk to fail.
The second attempt was a CD with an image file on it.

Is there any real reason why one version would work on my PC and another wouldn't? I thought the version of windows makes no difference because that's not what the machine is looking at with a dos boot...

Any thoughts?

Collapse -
read the whole thread

In reply to: prunnet.exe

Sounds like you are having similar issues and I dont want to retype everything.

Collapse -
No, but thanks

In reply to: read the whole thread

Yes, I did have Prunnet, but I made a mistake.

I chose to do a destructive restore to get a clean slate for the PC. I couldn't get rid of all the adware anyway. But I started the wrong one and powered the PC down ASAP. Apparently, it was too late because I now have a "hal.dll" error, which isn't a problem with hal.dll.
So my problem now is getting DOS to boot up from a disk.
The installed dos will not do any functions that are actually helpful like wildcards or folder copies. It will only copy one file at a time and has a very short list of commands. Hence the search for a DOS only boot disk. Hopefully the link provided above works for me.

Collapse -
Prunnet - my experience

In reply to: Prunnet.exe, popups, Spybot S&D won't run, other problems..

I got this virus and everything with this virus with me avg internet security fully operational. I use firefox but internet exomplrer windows was opening like mad. I ran my scan first while normally logged into the computer. My avg virus scan found everything but said it needed a restart. i restarted the computer and thats when all H*** broke loose. my computer woud not start back up, not in safe mode, last know good config or any other variation of safemode. actually had to put in a windows disk, boot into recovery counsol and run chkdsk /r. after that i was able to go back into the computer and start the clearing out process. Went into safe mode and ran avg and adaware and this did not clear it. found this post an downloaded malwarebytes and 2 other applications and ran those and that seemed to fix the issue. dont forget to go into msconfig and stop the startup processes for the prunnet and other applications. Thanks for the help, just wantd to add my 2 cents into the mix

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

DEALS, DEALS, DEALS!

Best Black Friday Deals

CNET editors are busy culling the list and highlighting what we think are the best deals out there this holiday season.