Posts by gerbil

You will need to download these files onto a thumbdrive; rename the mbam and hiujackthis exe files before running them in safe mode [eg, mm.exe and ht.exe]:
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then...
-in that folder start HijackThis by dclicking the .exe
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file: http://www.gt500.org/malwarebytes/database.jsp , both to a thumbdrive.
Run the installer, when it completes uncheck the Launch and Update boxes to …

In safe mode.. rename your MBAM and hijackthis exe files to say, mm.exe and ht.exe, try then to run them.

There is this:
http://blaize.net/cms/index.php?option=com_content&task=view&id=617&Itemid=10
But you still need XP cd and a writer to make an iso file for placing on the thumbdrive.

I bet heaps that Crunchie is going to ask for that comboFix log... it's in C:\.

I am surprised that you bothered posting to ask ... if you must borrow a sys to use an optical drive to load up a pendrive .... why not just borrow the optical drive? I am not sure on this... but I have a feeling that windows only installs from cds. Someone else may know for sure.

For your sys a 350W job would be fine, 400W if not a much greater cost. Corsair are very good, an Anandtech equivalent would be of the same quality but cheaper, CoolerMaster Green are efficient enough, too, and cheaper still. With that CPU the boys won't be nagging for a more powerful video card for gaming.

First off, if you mostly boot from a hdd then it is just a sensible thing to have that hdd as First Boot Device. That way you won't get false starts from bootable cds forgotten in the drive etc. You have a Superdrive as 2nd boot device...
Drive setup:
Primary Master 80GB hdd
Secondary Master Optical Combo
Secondary Slave Optical ROM
...and a floppy drive.

I think a better way is : First HDD; Second CD; Third LS120 , assuming that you use the superdrive for data only.
Anyway.... looking down the BIOS list:
!!! +12V VOLTAGE 2.54V !!!
And that is why you get this error: "no error code just says windows reboots from a power outage".
Further, you have QFan enabled, but all your fans are at max speed.... at 42degC your CPU fan should be idling, maybe 700rpm. To get that I use Silent mode. Optimal would give the same.
Anyway, your mb will get along without 12V, but not your hdd. New Power Supply will solve your problem, I think? It could be some card pulling it down, but I doubt it.. there would be smoke. 12V supply trying to pump 25 - 30 amps into something that drags the V down to 2 1/2 -> heat and smoke for sure.

I'm hoping so.
Cheers.

"i have 10 years of info on the computer that i can't lose" Oh, yes you can.... but probably not from this problem. Did the error screen list any codes, name any files? too fast to read? You can use the Pause key, hit Enter to continue.
That board has integrated graphics.... so you can unplug your graphics card and use the IGP socket. If you have 2 sticks making up that 1Gig try swapping them out. All this is just guessing without that error code.... it could be your OS that is problematic. Are both drives listed in BIOS?
Do you have a bootable disk such as the Windows XP Pro installation cd? Is there a partition on either hd into which you could install another copy of the OS temporarily [ie one with junk in it, temporary or uninmportant files]?

It is probably the log that some installer makes and refers to when installing software, also may be used by an uninstaller. If you are concerned about malware run a scan.

Well, that is interesting behaviour, not at all what I expected.
This is the file that concerned me.. it is a virus capable of spawning 100s of other files: C:\WINDOWS\system32\fokubino.dll
It was initiated by these keys:
O4 - HKUS\S-1-5-19\..\Run: [luwahejeso] Rundll32.exe "C:\WINDOWS\system32\fokubino.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [luwahejeso] Rundll32.exe "C:\WINDOWS\system32\fokubino.dll",s (User 'NETWORK SERVICE')
MBAM would not touch them; I expected to see them listed in the Combofix report, but no. And they are gone from your last HJT log.
All appears good with the logs now; i note that FF is working for you, how about IE?
If that file, fokubino.dll is inside the Combofix quarantine at C:Qoobox would you please go to this web page http://virusscan.jotti.org/, click browse and submit it for examination [instructions are on the page].
Post any positive result.
Then, go Start, Run..
combofix /u
Diablo II. Dated, but I still love that game. It's the scenery [or some of it], the concepts. I don't think any other game has come close. The writers really researched mid-eastern history and mythology.

Ok, we shall try this, MBAM is blind to them for some reason.
==Download this file to your DESKTOP: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
.....or this file: http://subs.geekstogo.com/ComboFix.exe
-IMPORTANT! : disconnect from the web, turn off your Antivirus, Antispyware and Firewall for the duration of this scan. Don't forget to reset them before you go back on the web!
- to run it dclick the Combofix.exe icon and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply, with a fresh hijackthis log.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.

And so give administrator privileges to any malware that would be interested in possessing them.

Days with restore points are in bold type. Check in CP, System that you have restore enabled for drives you wish it to be on, and that you have provided sufficient disk space so that points will be made.

Bit of infection still in there, so for a start:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file: http://www.gt500.org/malwarebytes/database.jsp , both to a thumbdrive.
Run the installer, when it completes uncheck the Launch and Update boxes to finish. Next, dclick the mbam-rules.exe file, it will install into MBAM.
Start MBAM via the icon and ...
Finally, another HJT log plus your comments.

Well, simplest way is to rclick your IE icon, go Properties, Shortcut, Advanced. You will work it out from there.

Do i agree that it is a painfully long process...? Yep, getting your sys setup back how you like it certainly is.
So first, I wouild try system file checker... you know, Run..
sfc /scannow
And then I would "reinstall" IE...
Rclick Windows\inf\IE.inf, choose Install, point it to the i386 folder on the installation disk.
Then i might consider a recovery. Might.

Hello, Ed, let's assume for a start that DEP is doing the right thing, and saving you from some malware that your AV does not see. It happens.... and you CAN turn DEP off, but as I said, let's assume that it is doing the good job that it should do. Your IE may be being used by another program to its own ends. On the other hand, it may be a legitimate plugin that is causing it. But try this scan first, please:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file: …

:)
I did mean the firewall, not utorrent.
Which, I guess, means KIS itself. you are going to need the cleaning tool to do it properly.

Dead is easy. But if you want to get it going.. and are not too fussed about what is on it, and have some form of boot disk available like Recovery Console... or can borrow an XP disk.... just use it to copy these files from Windows\repair to system32\config [you can do them one at a time, checking if the sys functions upon restart after each copy]. It is just wise to rename the original system32\config files first.
security system sam software default.
These files were the state of your registry when last you did a Repair or Installation of the OS. So using them should get things going, but later software installations etc will not be recognised, although data files will be intact.
This, if saved as a batch file to your desktop, will do it all:

cd c:\
cd %windir%
md tmp
copy system32\config\default tmp\default.bak
copy system32\config\sam tmp\sam.bak
copy system32\config\security tmp\security.bak
copy system32\config\software tmp\software.bak
copy system32\config\system tmp\system.bak

delete system32\config\default
delete system32\config\sam
delete system32\config\security
delete system32\config\software
delete system32\config\system

copy repair\default system32\config\default
copy repair\sam system32\config\sam
copy repair\security system32\config\security
copy repair\software system32\config\software
copy repair\system system32\config\system

Dead is easy. But if you want to get it going.. and are not too fussed about what is on it, and have some form of boot disk available like Recovery Console... or can borrow an XP disk.... just use it to copy these files from Windows\repair to system32\config [you can do them one at a time, checking if the sys functions upon restart after each copy]. It is just wise to rename the original system32\config files first.
security system sam software.
These files were the state of your registry when last you did a Repair or Installation of the OS. So using them should get things going, but later software installations etc will not be recognised, although data files will be intact.

98 is way before my time with computers. To wipe a drive you need software which will repetitively write ones and zeroes to all of it. It's out there. Some firewall apps include it as a tool. But why would you wish to do that if not to hide tracks? Certainly, a new installation does not demand it. It is a lengthy waste of time, unless the FBI is after you.
Quick format: erases the file allocation table. That's it. But without forensic tools, the files are for all purposes lost, even though stil on the disk. A new installation will not see them.
Full format: does the same, plus checks the integrity of the disk surface.. eg with chkdsk.
Restore. Your sys should make a restore point [if set to make them] whenever you attempt to install software [ ie the point is made so that you can roll back to the previous state if necessary; it is made before the installation proceeds]. Otherwise, not all days have a "just for the fun of it" point made... the sys must be idle before it will do it, plus you must have enough disk space allocated to Sys Restore.

Perhaps it is due to RAM errors. Try swapping it out if you have multiple sticks.

It would be a hell of a day... explorer.exe should load inside a second.

Plastered, that does look like a firewall problem. But shutting it down likely will not fix it- you must uninstall/reinstall it.

Most usually external, hails. And you do not say what connection you have from your modem, or whether your modem is internal.. ie a card. But if so, it would have a socket on it protuding to rear. So. Some modems use USB, or Ethernet cables, some offer both. If yours is USB, just plug it to any USB port. Ethernet is just like a slightly larger phone connector.
Grounding yourself means occasionally touching the bare metalwork of the tower.

Hello, pete, I tend to agree with Kraai. In OE go Tools, Accounts, lclick the old account if it is there and Remove it. Then get email details from your new ISP [I'm thinking POP3 and SMTP URLS, whether authentication is necessary...], CLick Add button and use those details to create a new account. And that should pull emails from your ISP email account.

Or you could get this tool, Autoruns, from:
http://technet.microsoft.com/en-us/sysinternals/default.aspx
When it starts it will open in the window you want [the Logon tab]. Just uncheck the ones Judy has listed above.
Be careful with it... don't uncheck anything else. You can prevent pgms that are essential for startup from starting!

Your mb manuf. site should have one such. eg ASUS Probe II
But no emails, just popups/noise.

Well, there ya go, just as it should be. I don't know why hijackthis picked it up.... perhaps a Vista64 compatibility issue. I'll butt out, now. but first I shall insult you by asking if you have played with mouse setttings in control Panel?
Back to you, Judy.

"My PC's had it"
Does BIOS list your hd? Yes... then BIOS cannot actually access it because if it was doing so but failing, say, to find an OS it would mention it with an error message.
No?... then maybe fool about with the cables WITH POWER OFF, PLUG PULLED. Not so much concerned about your safety here, rather that of the pc.
Still doesn't work? Try the drive in a pc that boots.
Try starting the pc without your hd inside... what does BIOS report?
Unplug all hardware but memory.
Try starting it with a known good hd.

"safe mode just gives me a black screen and safe mode in each corner of monitor" ...that sounds like Safe mode, alright, but without Explorer running, cos you should see maybe a few of your icons there, plus the Start button. So at the blinking prompt, type:
explorer.exe -and press enter.
When you have an av service installed browsers go through it into the net... the av serves as a browser proxy, and a firewall would show that the av service was actually accessing the net, not the browser. sounds like Vipre didd not correctly uninstall.
Have a look at what the pink angelcake wrote:
http://getsatisfaction.com/sunbeltsoftware/topics/cannot_uninstall_vipre
Gawd.
Read the whole thread... the orange angelcake gives this piece of software to automate the procedure:
http://www.sunbeltsoftware.com/ihs/cs&vclean.exe

Josh... services.exe... go into system32 and rename any services.exe you find there, say to servicesA.exe and so on. The real services.exe will be replaced in a few seconds by Windows File Protection System from a copy in cache. You will only be able to delete the renamed ones after a restart. There should be none in c:\Windows\
services.exe should be run by the System, not by a User...?!
But first, get hold of MBAM, and run it after renaming those files.
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file:

Hmm. the cmd.exe window should remain open... that is the purpose of the pause command. And showkey.txt should pop to your desktop. Is it not in C:\desktop? Find it there with Explorer, and open it.
You can save that batch file to anywhere.. eg C: root, I just put it to your desktop for the sake of ease. You could instead try this:
=save this as C:\showkey.bat

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V "Userinit" >>C:\showkey.txt
start C:\showkey.txt
pause

F2 - REG:system.ini: UserInit=userinit.exe
This entry appears wrong to me. The now defunct system.ini: Userinit entry was to point the system to the userinit files to use.. this is now done by registry keys, not an ini file.
That entry points to a particular key's value [name, if you like], userinit. The relevant part of the key is [should be in this case]:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
If hijackthis displayed the correct values instead of ignoring them if not abnormal, the log entry would look like this:
F2 - REG:system.ini: UserInit=userinit,
What i mean is the sys is getting userinit.exe when it should receive C:\Windows\system32\userinit.exe. The path variable should take the sys to the correct file immediately... but I don't know if paths are loaded at this stage... :(
Perhaps export and post the key . This will do it:
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as showkey.bat to your desktop; dclick it to run, then post the file showkey.txt

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V "Userinit" >>showkey.txt
start showkey.txt
pause

I may be so far up the wrong tree, but it's all fun.

Some deep lil memory about sound cards doing this nags at me, but won't come into the light. Check to see if they share interrupts [they will not if it is a PS2 mouse] - you do that in Device Mgr, View, Resources by Type/Connection. Try pulling the soundcard and running with embedded sound for a while; see if the problem returns.

Okay. It does look like a few keys in registry are not being cleaned, and Windows Security is picking up on them. More worrying is the inability to run anti-malware scans, loss of restore points. Let's try a couple in safe mode as an initial check:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file: http://www.gt500.org/malwarebytes/database.jsp , both to a thumbdrive.
Run the installer, when it completes uncheck the Launch and Update boxes to finish. Next, dclick the mbam-rules.exe file, it will install into MBAM.
Start MBAM via the …

Please remove/uninstall either Avira or aSquared - only one AV service may be installed at any time; they interfere unpredictably [you may very well need to reinstall the one you wish to keep].
And while they were squabbling, your sys got infected. They should have detected this.
Start hijackthis, use it to fix the following entries:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O4 - HKUS\S-1-5-21-1935655697-1220945662-682003330-1005\..\Run: [Secure64] C:\WINDOWS\system32\dllcache\Regedit32.com StartUp (User 'Aleksi')
O4 - HKUS\S-1-5-21-1935655697-1220945662-682003330-1005\..\Run: [Secure32] C:\WINDOWS\system32\dllcache\Shell32.com StartUp (User 'Aleksi')
O20 - AppInit_DLLs:

Good. Now delete these two files[the cache is hidden, but you can otherwise use the cmd window and the delete command]:
ie.. Start, and Run cmd, then:
del /f C:\WINDOWS\system32\dllcache\Regedit32.com
del /f C:\WINDOWS\system32\dllcache\Shell32.com

Then, as Hackepell suggests, run MBAM. Post that log, plus anew hijackthis log [with format - wordwrap Unchecked, please].
I am not sure that I would be running so much other protection software... personally, I would cut Adaware.

You possibly have some sort of proprietary file system software in there, or something like U3 which permits you to run special sware from your thumbdrive. The U3 host files, for example, are hidden, but can be removed if not wanted, freeeing up the space they take. You should find the correct tool to do this at the website of the sware installed.
And again, it might just be the file system software without which your thumbdrive becomes a nice addition to your rubbish bin.
But maybe I am way off-beam with all this.

Good-oh. You might try running the correct removal tool from this site, and then attempt to reinstall KIS.
http://support.kaspersky.com/faq/?qid=208279463
Good luck. And please come back if that does not solve your problem.

Is that a program? It looks like a webpage to me... and even if it uses ActiveX it won't appear in installed pgms list. But you may make shortcuts to such pages on your desktop... just check that in desktop properties you have not set the sys to regularly clean little-used shortcuts [it will run every 60 days].

Firewalls integrate themselves pretty deeply into the sys [well, comprehensive ones do...] along the lines of AV services. Always check for removal tools from the makers sites when wanting to unistall such services. Here is one such for you:
http://www.zonealarm.com.au/special_tools/ZA_CLEAN.exe
Run it, and let it restart the sys.

Roz, do you have an antivirus service installed [just the one...]?
I assume that BIOS runs at normal speed [say, 10 secs to where it commences Windows loading]?------
And then windows takes forever loading? Try to start in Safe mode; watch the drivers scrollling by on the black screen - should be too fast to read. Do you reach the final Safe mode screen in just a minute or so?
You might try disconnecting any USB devices, your modem/router also, and then try a restart.

SyncBack.

Rclick in the area you wish to modify [eg a free spot on the desktop, or in the start menu..], choose Properties, and the options to select/customise will be there.

..or perhaps you installed the AV into an infected system, or perhaps you have become infected with some malware which your AV does not detect.
Tell which AV you uninstalled.

You're very welcome, Claire.
Cheers.

Which AV. Some, eg, Norton, AVG, require a special uninstaller tool to be run. The slowness is most likely due to a confused AV installation - all file activity, traffic is monitored by the AV.

My fingers... I write with a pen and there is absolutely NO confusion with their and there. I type, and it's a 50-50 chance it gets set down correctly. How can that be? Does typing use a different part of the brain, or what? Course, some of my fingers are speed freaks an hit he keys outa turn, and that doesn't help.
AVG fights to the end.. yep.
Most AV's [all?] interactively scan files as they are opened for use, so you will get a notice, and the file will be frozen until you reply. Avast works like that. I don't do regular scanning at all now.
Windows FW for XP only checks incoming streams... basically if something was not requested then it is ignored, not even acknowledged. If it wants to get out, no interference from the FW, and that is a big weakspot. Vista's FW is different, but it appears to not learn, so it is a pest. Comodo will learn if you use it correctly. And it can wee people off in half an hour... you gotta appreciate what it is doing for you, learn about it and accept that you must use it as a tool.
Good luck wiv it.

Noted, JudY... :)
I don't know how Windows interferes with driver loading for other applications in Safe Mode... but that is just one more thing that I don't know. I'm getting used to seeing the list grow.