Can only boot in safe mode

loopy_lou · Dec 8, 2006

My son got malware on his computer from running an attachment in msn. Now the computer continually reboots when it gets to the Windows XP welcome screen. Disabling automatic restart on system failure gives a BSOD

DRIVER_IRQL_NOT_LESS_OR EQUAL

*** STOP: 0x000000D1 (0x000005EA, 0x00000002, 0x00000000,0xF404B877)

*** AEWLVNET.SYS - Address F404B877 base at F4048000, Datestamp 3d9d83ea

I have tried to follow your instructions in 'Read and Run me first' but I could only work in Safe Mode / Safe Mode with networking. CounterSpy would not run. Spybot S+D found Smitfraud-C Toolbar 888 and SpyHunter. Bitdefender wouldn't update its virus definitions but I ran it anyway. It found and deleted mcc.exe and tel.exe.

I haven't done a 'hijack this' log as it says you must be in normal mode but I can from safe mode if you want me to. please help!

loopy_lou · Dec 8, 2006

More attachments.

loopy_lou · Dec 9, 2006

As nobody had replied I decided to look at this a bit more myself. I realised the file aewlvnet.sys that was stopping me booting in normal mode was for my wireless network adapter. I moved the file elsewhere and renamed it. I could then boot into nomal mode but windows\system32\services.exe terminated unexpectedly with status code 1073741819 and shut the computer down after 1 minute. However, I saw that the computer was trying to connect to an XFire server. I deleted XFire and the computer then booted normally and stayed on, but without any network connections. I tried deleting and then reinstalling my wireless network adapter from the original installation discs. This put back a file aewlvnet.sys and half way through the installation rebooted the computer. I went back to safe mode, deleted aewlvnet.sys again and then ran 'hijack this' in normal mode (but without any functioning network). Also note that my Sophos virus software detected the virus MSNMk-E in two system restore points.

I am posting this from a different computer. Note that my wireless adapter has been working for several years without any problems.

Can anyone tell me where to go from here?

chaslang · Dec 10, 2006

Welcome to Majorgeeks!

Problems like you are describing are not normally cause by malware but are more frequently cause by a hardware, or a driver, or other software related issues. However you do have a couple things to fix. So let's fix them.

Make sure viewing of hidden files is enabled (per the tutorial).
Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"{9CAB4104-0BA9-2057-1209-05031020002c}"=-
Click to expand...

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\system32\hset.exe
C:\WINDOWS\system32\install.exe

Now run Ccleaner.
Now reboot in normal mode

Now locate the below folder and delete it if found:
C:\Program Files\Common Files\{3CAB4104-0BA9-2057-1209-05031020002c}
C:\Program Files\Common Files\{9CAB4104-0BA9-2057-1209-05031020002c}

Now attach a new log from GetRunKey.

Make sure you tell me how things are working now!

If the above steps do not help (and I don't expect them too), you could do the following

try using System Restore to restore to a point before your problems began. If this does not help, then you may be looking at a hardware failure or a broken drivers that System Restore cannot fix.

try posting in either the Hardware or Software Forum for other suggestions.

loopy_lou · Dec 13, 2006

You were right, the changes didn't make any difference, but thanks for your help anyway.

I agree that I may now have a software problem, but I am absolutely convinced that it was caused by malware. My son got a message in MSN that he clicked on. This put some icons on the desktop (mcc.exe and others?) Then, the next time he wanted to start MSN, it told him to run an exe file, which he did. (Sorry, I don't know the precise details. I am relying on the memory of an 11-year old.) This is when all the problems immediately started. Note that my daughter also got the same message on her computer, and got the same icons on her desktop. However, she didn't run the exe. I was able to get rid of the problem with Sophos and her computer seems clean now.

I can't go back to an restore points before the problem occurred because there aren't any I can access. If I click on any days before the problem in December, nothing happens. If I click on the back arrow to go to November, nothing happens also. However, there are restore points that have been created since the problem. Also note that the windows firewall became
disabled at the time of the problem. It got turned off and couldn't be turned back on due to an 'unknown error'. I think I have fixed this by following a registry edit I found on another website.

To summarise, I am now left with a computer that will work in safe mode with networking, including with the network functioning, when my wireless network adapter aewlvnet.sys is installed. However, in normal mode I get the message about system32\services.exe terminating with status code 1073741819 and the system shuts down after one minute. If I run shutdown -
a, the shutdown dialogue stops but the computer doesn't function (i.e. clicking on icons or the start menu doesn't do anything) and I have to reboot anyway. If I delete or rename aewlvnet.sys, then I can boot in normal mode without any problems (but obviously without any network). I have got new copies of the driver from the original installation discs and also from the Actiontec website, but they are the same. I have tried troubleshooting by disabling drivers in safe mode and the rebooting in normal mode, but the only driver that gives any problem is the network one.

I have seen on other websites that system32\services.exe terminating with status code 1073741819 can be the signature of a worm. However, I have run Sophos from a CD-R with windows in safe mode with command prompt and nothing is found.

I have attached a new log from GetRunKey, run in normal mode without the network driver. Do I look clean now?

I really don't know what to do next. If you have no more suggestions, I will try posting this to the software forum as you suggest.

Thanks for your help.

chaslang · Dec 13, 2006

loopy_lou said:

I have seen on other websites that system32\services.exe terminating with status code 1073741819 can be the signature of a worm. However, I have run Sophos from a CD-R with windows in safe mode with command prompt and nothing is found.
Click to expand...

Yes normally that status code is associated with Sasser worm problems but the filename would then be lsass.exe not services.exe.

Let's try a couple things!

Run the System File Checker (SFC) utility. The main reason for it is when you suspect there may be a problem with a Windows XP system file. SFC allows you to check for any corrupt system files.

To use System File Checker click Start > Run and type: sfc /scannow and click OK.

Make sure that you include a space between the c and /. This command will immediately initiate the Windows File Protection service to scan all protected files, verify their integrity, and replace any problem files. You must be logged on as a member of the Administrators group to run sfc and it may ask you to insert your Windows Installation CD so have it available.

Now click on Start > Run and type: regsvr32 MSXML3.dll and clicked OK.

Any change to your status? If not, continue on to the below.

Download Blacklight Beta

Download blbeta.exe and save it to the Desktop.

Once saved... double click blbeta.exe to install the program.

Click accept agreement and Click scan
This app too may fire off a warning from antivirus. Let the driver load.
Wait for it to finish.

If it displays any items...don't do anything with them yet. Just hit exit (close)

It will drop a log on Desktop that starts with fsbl....big number

Please post contents of the BlackLight log.

Then give this second rootkit detector a run and attach the log: AVG Anti-Rootkit

loopy_lou · Dec 14, 2006

I had problems running sfc because the computer only has a restore CD, not an original XP cd. However, it does have a c:\I386 folder so I followed the advice on another web page and edited the registry to point there. (I hope that is OK - the restore cd has an I386 subfolder but it only contains cabinet files.) I then ran the regsvr32 command. However, as soon as I reinstated the network driver and plugged in my adapter, the problem recurred.

Blacklight beta didn't find anything.

AVG Anti rootkit detector found a hidden driver file C:\WINDOWS\system32:lzx32.sys (see logs attached.) Is this significant?

chaslang · Dec 15, 2006

loopy_lou said:

AVG Anti rootkit detector found a hidden driver file C:\WINDOWS\system32:lzx32.sys (see logs attached.) Is this significant?
Click to expand...

Yes! This is a nasty rootkit. Let's first see if AVG Anti-Rootkit can fix it. Run it again and try to fix it. Let me know what happens.

If it says it fixed it, then reboot and run another scan with AVG Anti-Rootkit and attach a new log.

loopy_lou · Dec 15, 2006

Great! The AVG anti rootkit seems to have deleted it. I rebooted and ran another scan, which was clear. The report log button was greyed out, presumably because it didn't find anything.

I then reinstated the network driver and plugged my wireless adapter in. It worked straight away!

Is there anything else I need to run, now my network is back, or am I clear?

Thanks so much for your time and help.

chaslang · Dec 15, 2006

You're welcome.

First double check to make sure that the below file has been deleted:
C:\WINDOWS\system32\lzx32.sys

Then if you are not having any other malware problems, it is time to do our final steps:

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.

If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.

If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.

If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created

If you are running Windows XP or Windows ME, do the below:

go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Can only boot in safe mode

loopy_lou Private E-2

Attached Files:

Activescan.txt

bdscan.txt

newfiles.txt

loopy_lou Private E-2

Attached Files:

Report-Scan-20061207-081218.txt

runkeys.txt

loopy_lou Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

loopy_lou Private E-2

Attached Files:

runkeys121206.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

loopy_lou Private E-2

Attached Files:

fsbl-20061214213905.log

AVG_Rootkit_log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

loopy_lou Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member