Posts by gerbil

The Java auto-update plays cute sometimes.. just go CP > Java, Update tab and press Update Now.
When you have installed the update go CP > Add/Remove Pgms and uninstall all old versions of Java listed there.

They are not long logs, Scott, they are just what we expect. And they are clean. Do you still use EvilLyrics? It is showing as a malware detection but I have no knowledge of it being bad, so you may ignore that log entry. It is listed as Spyware:SafeSurf.
You could experiment with uninstalling it, but it was not a running process when you made the hijackthis log so I see it as mot imposing any undue sys load.
Dunno, your sys appears clean... update your Java...

Michael, you have what appears to be a vundo infection, and probably it changes filenames at each startup. So let's try this tool first:
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
Post with a fresh hijackthis log, please.

[Malware reg entries and running files:]
O4 - HKLM\..\Run: [lphcvepj0el1n] C:\WINDOWS\System32\lphcvepj0el1n.exe
O4 - HKLM\..\Run: [SMrhcrepj0el1n] C:\Program Files\rhcrepj0el1n\rhcrepj0el1n.exe

C:\WINDOWS\System32\lphcvepj0el1n.exe
C:\Program Files\rhcrepj0el1n\rhcrepj0el1n.exe
C:\WINDOWS\System32\pphcvepj0el1n.exe

Michael, run this scan and post the log so that we may see the items to fix. We are a bit blind atm..
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.

Format? What the...?
To remove Combofix and its files, just go Start, Run, type or paste in...
C:\Documents and Settings\Francis\Desktop\ComboFix.exe /u
Change Folder Options to the View setting for Hidden Files that you prefer.
Uninstall MBAM.
And your sys will be normal again. No fancy reg settings have been made.
Cheers.

OPHCrack is known... but I thought it had problems with passwords over a certain length.. 12 charactrers or so? And you need a fast processor.. and a lot of RAM to get it to do it before you die. For a fast job the rainbow table download is um... big. Huge.

Good-oh. I didn't see any other way of recovering from that one. A Repair will not remove any malware that is active, so you just get back into the same leaky boat. A format and fresh installation loses their files.
Get a decent AV... Avast is pretty good [I switched from AVG because I did not like the slowness of the new AVG8, plus when I modified its check mode settings it changed its tray icon to a fault icon, so I could not tell if it was reporting my changes or some new problem without opening up the interface. Silly of em.

Okay..... seen the pics... so you have one Sata hdd and the IDE CDRom. Connections, jumper are fine. A couple of things... because you have only one hdd you won't be using RAID at least for the time being... and choosing AHCI does not get you out of the jam [with Intel AHCI is included in the RAID setting] because there is still a need for a driver file to be loaded by floppy. Of course, there are ways around this when no floppy drive is fitted:
-temporarily add a floppy drive just for installation..
-slipstream the required file onto your installation cd..
-change the Sata configuration in BIOS to IDE emulation, ignore the F6 prompt during Setup, and after installation of the OS add the required driver file and change a couple of settings, then switch to RAID or AHCI mode. [pieceacake, done it with Intel chipsets]
...the second thing is: why is BIOS reporting your PATA cdrom [ok, IDE cdrom] as Sata cdrom? Can you flash that BIOS with a thumbdrive [or floppy] from in the BIOS?
And yep, that is an upgrade cd.. for upgrading XP to Vista. I don't know why M$ do that. But you load it from inside XP, not as a new installation from the cd. So if you have an installation cd for XP and do not mind losing the contents of the hdd [all your data, pics etc.] just load that XP cd, boot from it, …

Symantec/S32ENIL.dll .. is there any chance you typed that incorrectly, arthas? It should be the name of a dll that exists in that Symantec S32 directory under program Files. Anyway, i notice that you are running Avast from Alwill Software, so that Symantec error is a leftover from an incomplete uninstallation of Symantec. To fix that you should go to Symantec's website for the removal tool for the edition of their AV that you were using. For your immediate problem you can do this....
==Navigate to this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers
-in the right pane rclick VDD and delete it.
-in the Edit menu point to New and then select Multi-string Value.
-type VDD in the Value Name box, press ENTER.
-exit Regedit.

The Symantec tool will clear out all ? remnants though....
[with Avast installed I am surprised you do not have this entry for VDD at that key:
C:\Program Files\Alwil Software\Avast4\aswMonVd.dll ... but anyway..]
That is an incomplete SDFix log. Try running it again.

FIVE tvs!!? It was doing her a favour... :)

Pieceacake... :)
Well, that got rid of the D:\autorun.inf for you, one other file deleted was a remnant of some adware, the other is as yet unclassified. I see nothing els, so I suspect your sys is now clean, and you should be able to also open D:?

I think she may have forgotten to disconnect the net cable... and the mb got a jolt from that? May mean a new mb; ram, cards and cpu may have survived, may not have. Get it checked at a dealer's who has a tech on hand.
The sys will run POST and other checks with only one stick of RAM installed, so you can try with no drives hooked up, remove extraneous cards also.

If the second sys was almost identical to your mates [same chipset, mb] then you conceivably could install in that one, but do expect a blue screen when you put the drive back.

Okay, this is a bit interesting. Single stepping thru v2 does not show any hdd detection. I see the screen "IDE detection..." but the next is blank, then it shows your cdrom as a Liteon. I think BIOS cannot recognise your hdd [and next thing your sys is trying to boot from the hdd, but the drivers loaded list is incomplete?] which is why it shuts down and pushes you off to other modes to start from.
But for BIOS to be looking to boot from the hdd means it has not recognised your installation cd in the cd drive. It sees the cdrom device but cannot read the cd. Now I have never tried running Windows Setup without a hdd :), so I don't know how it would react, but the sys is trying to load from the hdd, hence the driver list.... weird.
That error screen may occur if for example you had AHCI [or RAID] set as the mode for Sata configuration of disks but did not have the drivers installed [the F6 thing], but you don't get into Setup. There is a problem with the hdd setup in BIOS, i think? How have you configured the drive? Try IDE mode for a start. Is the hdd an IDE? I see a screen showing AHCI mode, but that mode is for a Sata drive only.
Mem scan... more than 3GB and XP-32 is not happy. The native windows driver is all that is needed …

Hang amo. Just stepping thru your videos. I cannot see your IDE? drive shown as detected?

If something appears wrong there is always room for another scan. Or two.
==Please use IE or Firefox to do an online scan at panda:- http://www.pandasecurity.com/homeusers/solutions/activescan/?
-for the free online virus scan select the link Scan your PC, then Register [otherwise there will be no disinfection, merely detection] with a valid email and follow through.
Please ATTACH to your post the log it produces.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.

Hi, you don't need a second run with MBAM, just go straight on with combofix and the hijackthis scan.

Spidey, I just saw your Kaspersky log in the other forum... do this before you run the other tools above; they will also make new restore points.
==You must clear all your system restore points because some have been infected.... you do this by toggling System Restore Off then On again. So go control panel > system > system restore tab, check Turn off sys res on all drives, Apply and OK. Do it all again but uncheck that box, Apply and OK.
[[a quick way in is Start > run, paste: control sysdm.cpl,,4 -and OK]]
Now make a fresh, clean restore point: Start > programs > accessories > system tools > system restore and create a restore point now!!
[[the quick way to System Restore is Start > run, paste: %systemroot%\system32\restore\rstrui.exe -and OK]]
We will have to do this again when your sys is clean.

Bert, does entering this address into your browser get Google to load?: http://64.233.167.147/
"Can't find Application" error? Quite a number run in conjunction with any browser, and one of them could be fouling things up.
If other puters are connecting happily through the router then it is unlikely to be a problem with the router; if the faulty sys is not configured correctly for the router then it is out of my area of knowledge.
Firstly, check in IE [tools, Manage Add-ons] and remove any BHOs you do not recognise or want.
I am sure you have done this.... tried another browser?
Run this tool from Doug Knox - it checks the various IE library files for browsing are correct versions and also registers all dlls involved:
http://windowsxp.mvps.org/IEFIX.htm
Yep, i know it's for IE, but as I said other browsers make use of some of those dlls. You will need the installation cd.
If those things do not work then an infection is a possibility.. some of them interfere with internet access. So...
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted …

Hello spidey, well that is a start. What trojan did Spybot find?
Run these two scans in order given - the first is a scan for certain specified malwares, the second is also but will give me a look at some information, then make the hijackthis log.
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file to install the application and ensure that it is set to update and start, else start it via the icon.
Select "Perform Full Scan", then click Scan; the application will guide you through the remaining steps.
Make sure that everything is checked, and click Remove Selected.
Post the Notepad log [it is also saved under Logs tab in MBAM].
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL …

Belo, when you format a partition you delete the File Allocation Tables in the boot sector. What this means is that the locations of your files on the disk are "lost", but the files should still be there, or most of them. They may be fragmented. Most decent file recovery softwares will recover those [fragments of your] files. You will have to put them together. You may not recover all the fragments.

Spidey, go Tools, Folder Options, View, choose to Show hidden files n folders. Check if in the root of both C: and D: you have an autorun.inf file. If so, delete them. When you click on a drive those files run... who knows what they are trying to initiate. If there they most likely were emplaced by malware. Run a scan, eg Spybot SD.

Hi, spidey, make sure when you save it that there is a blank line below the @="none" line in your notepad .reg file, otherwise it will not be accepted.

Hi. Run this script... I think it will solve your problem...
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as fixkey.reg, as type "all files", to your desktop; dclick it to run... agree; if it opens in notepad instead rclick the icon [file], choose Open with, Registry editor....

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Drive\shell]
@="none"

One day I'll bother learning about networks... but if you go into a cmd window and type..
ipconfig /? -you should find what you want. My money is on /flushdns, and maybe /registerdns
You play.

You jus gotta luv hitech...
Guess it is a pin connection problem...
Cheers.

It doesn't get much better than this:
http://www.dslreports.com/faq/15804

A quicker way, saves downloading that site....
Open an Explorer window, rclick that USB drive, go Properties, Hardware tab, select that particular device [some named USB disk drive] in the window, press Properties button, choose Policies tab in the new window and press Optimise for Performance. That will give you a greater choice of available formats when you go to format the drive.
But NTFS is not necessary for smaller thumbdrives... it may be useful for the 5GB jumbos.

"I need a USB to run off FAT instead of FAT32 because my laptop doesnt seem to support FAT32. Anyone got any ideas on how to do it?"
"...my usb is showing up as an unknown device and does not show up in my computer...."
May I assume that it showed up correctly in Device Manager [or in the relevant window in the method above?] As an example, in the Removable Disk Properties windows mine appears as "Toshiba transmemory USB device". Was yours identified correctly there? If it did not get correctly identified in Removable Disk properties window then it may be a lil crook. Test it in another machine.

This will clean some generally attacked sites in your machine and reset to defaults some files and registry data...
==Download SDFix from here: http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
and save it to your desktop. Dclick SDFix.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\

** ==Download this temp file cleaner from http://www.atribune.org/ccount/click.php?id=1 --click in the download window to run it, and when ATF Cleaner opens go Select all, and then Empty Selected.
Next click Firefox [if you have that browser..] at the top, Select All again, and Empty Selected again. Follow that procedure also if you have Opera.
Close ATF. Run ATF in any other accounts.
=You must restart your computer in Safe Mode:
- press F8 several times while POST is running and before IDE detection completes.
- On the Windows Advanced Options Menu, select Safe Mode and press Enter.
- When the Boot Menu appears again, select Microsoft Windows XP and press Enter.
- Log in by using the Administrator account and password. NOTE: The password is blank by default unless you set a password.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the …

Urk. Some malware disable Task Manager, some disable Safe Mode. Your symptom suggests that some drivers are not loading successfully [they continue to load and initialise in the background while the logon screen is up].I see that you have tried a Windows Repair [not Recovery Console] with no success, so it may be time to slave the drive, copy out the wanted files to a DVD or any other drive, delete them on the bad drive and then run chkdsk /p [and chkdsk /r if required] on it. Format the partition and reinstall.
If you have space on the drive you could create a new partition and install into that. Then copy out files and run chkdsk on the old OS's partition.
Just for such a thing I usually leave five or ten GB unallocated on a drive. But I don't do movie stuff with my sys so I have space to burn.

I'm sure your laptop supports FAT32 :)
A USB thumbdrive? It will format in FAT16 [FAT]. Follow these instructions, but choose FAT [the formats available to the particular drive will be listed in the menu]:
http://www.ntfs.com/quest22.htm
Or simply, in My Computer, rclick the drive. select Format... in the window that pops, and so on..

I cannot tell where you are up to in your fix. Please do the following, in the order given:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file to install the application and ensure that it is set to update and start, else start it via the icon.
Select "Perform Full Scan", then click Scan; the application will guide you through the remaining steps.
Make sure that everything is checked, and click Remove Selected.
Post the Notepad log [it is also saved under Logs tab in MBAM].
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the logs here.

You gotta give it credit.. the OS knows what it knows. Windows doesn't know the "make" command. Try a Linux, or Apple box.
In cmd window, enter
help -for a list of commands, and for help on a specific command enter
help "the command" eg help md
Actually, i don't know if Apple knows it, either.
For a more complete listing of commands available to Windows than given in the cmd window as shown above, type or paste this line into the Run box:
%windir%\hh.exe ms-its:%windir%\Help\ntcmds.chm::/ntcmds.htm

Possibly missing Java?

Arthas, I need a good slapping. Ignore my post about those two shell keys - that's something I put in my sys.
But do try post #18

Hi, just for a start so that we may see what is going on would you please do this:
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.

Roadking may well have died of old age.
If you wish to format then obviously you intend reinstalling XP. Windows Setup on the installation cd will offer you the chance to format if you so wish.
No need for floppies.

Go to the Virus n Nasty forum, see how to post a hijackthis log and do so. You likely have malware.

A couple of things for you to do... the first is to "take ownership of XP pro files" and if you google that you will get the full how to - it is straightforward.
The second is this - cos you obviously have an XP installation cd you can repair the boot files in C: if they are destroyed....
1. Copy over to C: root the three files boot.ini, ntldr and ntdetect.com from D: root [in folder options you must uncheck Hide protected Op Sys files first so to see them].
2. edit C:\boot.ini to look like this:

[boot loader]
timeout=4
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

-and save it. If it kicks up a fuss change its attributes to allow you to do that.
If that is not enought to get it started then ...
-run chkdsk C:
-if that reports errors run chkdsk C: /r
-remove the second hdd and do a Repair installation of Windows in C: [do not enter Recovery Console].
Say what happens.

Yay!! You got there, and isn't it extra nice when you get there by your own ideas? It is no matter at all that the system and boot partitions are on different drives, as long as you remember that your sys will not start without both of em, and as disk0 and disk2.
On the secondary IDE controller consensus would have you put the cdrom as master on the outer, the other drive as slave cos it is a data drive, but it matters not much.
In the next lesson I walk you through turning a hard drive platter into an impressive shaving mirror. Good luck out there.

Nah, your're not banging my head, billy. This all comes down to how your BIOS treats a mix of Sata and IDE drives, where it puts them in the hd hierachy. BIOSes vary in many aspects whilst overall doing the same thing. Some BIOS put the Sata as first devices ie Disko etc and the IDE come later. Yours seems to put it between primary and secondary IDEs. My BIOS lets me order them for boot purposes. That is something you could check... it could be an entry in the drives page of your BIOS setup, like drive or boot configuration where it asks you which hard disk drive is to be your boot device [the system drive containing the boot files... sigh]. I don't mean the generic boot order page where you select floppy, cdrom or hdd, nor that F8 boot selection menu.
Without that choice it does look like for the moment that you will have to put up with your BIOS demanding that Disk0, whatever it is, contains the system partition. Windows XP Setup is pretty hide-bound, it will make Disk0 the system drive no matter what, even forcing the creation of a primary partition if one does not exist [logical volumes cannot be made system drives], it will always write its own MBR on that disk, and write its boot sector files to a primary partition on that disk, making that partition the system volume.
So...
"I get a long pharagraph saying cannot …

Are we there, then?

Can you force an extension onto it with Unlocker? eg .tex
If you run a dir cmd in the folder containing it what characters are used in the cmd window for its filename?

Modify boot.ini by going CP, System, Advanced tab, Startup and Recovery Settings button, Edit - boot.ini will open in Notepad. Modify it and Save.
But yeah, we could get into a lil problem with a mixed IDE and Sata disk set if trying to make the Sata drive contain both System and Boot partion. BIOS will see that IDE Active Disk 1 partition and get lost - you will get an error msg.
It may be that you will have to make C: Active as the System partition after all. The original boot.ini in C: would be already correct.
Can I go to bed now, please? It's 1:30 am here... :(

Noted the new pic.
Ok, going with your last post, Disk 0 will be Master by jumper [or outer if using Cable Select] on the Primary Controller, Disk 3 is the Master [or CS outer] on Secondary, and CDROM the slave?
Fine. Initially, COPY the three files over to E: [leave the originals where they are...], make E: the only Active partition in the whole set, then modify boot.ini in E: to look like this:

[boot loader]
timeout=4
default=multi(0)disk(0)rdisk(2)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(2)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Note carefully the numbers in the ().
The script in " " is what you se on the boot screen, can be anything you like...
If it all fails for some reason you willl still be able to boot with the cd.... :)

If you just did a normal, out of the box, straightforward fresh installation of XP then your system and boot partitions are one and the same. Just check the the files ntldr, ntdetect.com and boot.ini exist in C: root, there will be others but those three should be there if you are to use C: as the boot loader [ie system] partition. In folder options you must uncheck Hide protected Op Sys files first.

I see what you are saying about the Ethan Miles [C:] partition though. Are you using PATA drives? The Primary and Secondary IDE controlled drives? And is Disk 0 the Master drive via jumper setting? Then Setup would make C: on Disk 0 [Master on Primary controller] the System partition. It would put the OS where you requested it to go... E:?
To get around that you make [by setting the jumper] Disk 2 Master on its controller, copy over those three files from C: and then set E; as the only active partition on your set. Should work. Your system and boot partitions would then be one and the same. No need to reinstall. You would have to modify boot.ini though.
When BIOS starts looking for an OS it checks on the first master disk for an MBR [there is an identical execution code in the MBR on each physical disk], loads that MBR code into memory and that code assumes control, checks your drives for the Active partition and …

Yes, Billy, your system partition, C: usually, must be marked active otherwise the code in the MBR will not select that partition as the one to read the loaders from [ and hence ntldr, boot.ini...].
While you are in Disk Management console, remove the Active settings from both Disk 1 D: and Disk 3 H: because they do not have OS's on them. BIOS would not really be looking at them for MBR code because they are not the first Sata disk, or not the Master on the Primary controller if PATA, but still, it is neater.
A bit of confusion courtesy M$: the system partition is the one with the ntldr, boot.ini and other boot files, the boot partition is the one with the OS on it. It is the system partition which must be marked Active. For most folks system and boot are the same partition, C:.

Hi billy, check in Disk Management that your C: partition [your boot partition] is marked Active.

Or, to expand a little on sittas's post... the Administratot remains the Administrator - this is the base admin account; I don't think it is possible to change the name from Administrator. Other admin acs are initially clones of this one.

As jb posted above, if the Administrator ac has no password, then you are in..
I do hope you have permission to be using that computer. Do not know the username?!