Help on 0000135 %hs is missing

Discussion in 'Malware Help (A Specialist Will Reply)' started by Orangepeace, Oct 29, 2013.

  1. Orangepeace

    Orangepeace Private E-2

    3 days ago my computer started acting funny, signed in user worked fine, then all of a sudden my McAfee acted crazy. Started to turn real time scanning off, I turned on it instantly kept turning off. I turned off wifi freating someone was trying to hack and tried to run a scan but wouldn't allow so I turned off computer hoping to reboot. Then I got 0000135 unable to start computer due to %hs is missing due to blah blah blah. I did system repair, system restore, everything I could on the computer thru troubleshooting procedures! I need help ASAP!!! I know nothing about computers and I need this baby back up in running I have vital info and pictures I CAN NOT RECOVER. Just got Farbar and diagnostics report on text. NOTE: I HAVE NO IDEA WHAT AND HOW TO DO THINGS SO FORGIVE MY NOOBNESS. Here it is below:

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-10-2013
    Ran by SYSTEM on MININT-RSOJMLA on 29-10-2013 16:34:26
    Running from H:\
    Windows 7 Home Premium (X64) OS Language: English(US)
    Internet Explorer Version 10
    Boot Mode: Recovery

    The current controlset is ControlSet001
    ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

    ==================== Registry (Whitelisted) ==================

    HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
    HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
    HKLM\...\Policies\Explorer: [NoControlPanel] 0
    HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
    HKLM-x32\...\Run: [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1679360 2012-02-20] (Wondershare)
    HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [64000 2007-07-17] (ArcSoft)
    HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
    HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2285232 2013-07-29] ()
    HKLM-x32\...\Run: [Sendori Tray] - C:\Program Files (x86)\Sendori\SendoriTray.exe [83232 2013-07-01] (Sendori, Inc.)
    HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-08-06] (McAfee, Inc.)
    HKLM-x32\...\Run: [mcpltui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-08-06] (McAfee, Inc.)
    HKU\Brandon\...\Run: [SPMTray] - {pf}\\PC Speed Maximizer\\SPMTray.exe

    ==================== Services (Whitelisted) =================

    S2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43112 2012-02-16] (ArcSoft Inc.)
    S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.)
    S2 Application Sendori; C:\Program Files (x86)\Sendori\SendoriSvc.exe [119072 2013-07-01] (Sendori, Inc.)
    S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    S2 IB Updater Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
    S2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1455408 2013-04-07] ()
    S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
    S2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178048 2013-08-06] (McAfee, Inc.)
    S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [225216 2011-01-28] (McAfee, Inc.)
    S2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    S2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [602944 2013-08-02] (McAfee, Inc.)
    S4 McOobeSv; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
    S2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    S2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2012-03-20] (McAfee, Inc.)
    S2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1017016 2013-08-05] (McAfee, Inc.)
    S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.)
    S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.)
    S2 Service Sendori; C:\Program Files (x86)\Sendori\Sendori.Service.exe [22304 2013-07-01] (sendori)
    S2 sndappv2; C:\Program Files (x86)\Sendori\sndappv2.exe [3623200 2013-07-01] (Sendori)
    S2 Updater Service for AMZN; C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe [222368 2012-05-22] ()
    S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [1616048 2013-07-29] (AVG Secure Search)

    ==================== Drivers (Whitelisted) ====================

    S1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-07-29] (AVG Technologies)
    S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.)
    S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197264 2012-05-28] (McAfee, Inc.)
    S0 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.)
    S3 mfeapfk01; No ImagePath
    S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.)
    S3 mfeavfk01; No ImagePath
    S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.)
    S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.)
    S3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [377040 2013-07-09] (McAfee, Inc.)
    S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [95984 2013-07-09] (McAfee, Inc.)
    S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2012-02-22] (McAfee, Inc.)
    S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.)

    ==================== NetSvcs (Whitelisted) ===================


    ==================== One Month Created Files and Folders ========

    2013-10-29 16:34 - 2013-10-29 16:34 - 00000000 ____D C:\FRST
    2013-10-26 23:22 - 2013-10-26 23:22 - 00000000 ___HD C:\_Exception1
    2013-10-26 15:07 - 2013-10-26 15:07 - 00000000 __SHD C:\$$PendingFiles
    2013-10-13 12:40 - 2013-10-26 14:53 - 00000000 ____D C:\Users\Brandon\Downloads\sinister-fonts_ghoulish
    2013-10-13 12:38 - 2013-10-13 12:38 - 00425309 _____ C:\Users\Brandon\Downloads\sinister-fonts_ghoulish.zip
    2013-10-11 14:03 - 2013-10-26 14:53 - 00000000 ____D C:\a0347bdd628f839a6e

    ==================== One Month Modified Files and Folders =======

    2013-10-29 16:34 - 2013-10-29 16:34 - 00000000 ____D C:\FRST
    2013-10-29 16:21 - 2012-11-15 06:44 - 00000000 ____D C:\e17a75301b1d9282d77f
    2013-10-27 14:51 - 2013-04-10 08:39 - 00000000 ____D C:\Windows\SysWOW64\jmdp
    2013-10-27 14:51 - 2013-04-10 08:39 - 00000000 ____D C:\Windows\SysWOW64\ARFC
    2013-10-27 14:51 - 2013-01-17 13:39 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software
    2013-10-27 14:51 - 2012-10-19 13:38 - 00000000 ____D C:\Windows\SysWOW64\WNLT
    2013-10-27 14:51 - 2012-10-17 23:40 - 00000000 ____D C:\Windows\System32\Macromed
    2013-10-27 14:51 - 2012-10-17 17:28 - 00000000 ____D C:\users\Brandon
    2013-10-27 14:51 - 2011-08-08 20:22 - 00000000 ____D C:\Windows\SysWOW64\Macromed
    2013-10-27 14:51 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
    2013-10-27 14:50 - 2013-09-05 18:15 - 00000000 ____D C:\Program Files\McAfee
    2013-10-27 14:50 - 2013-09-05 18:15 - 00000000 ____D C:\Program Files\Common Files\McAfee
    2013-10-27 14:50 - 2013-09-05 18:15 - 00000000 ____D C:\Program Files (x86)\McAfee.com
    2013-10-27 14:50 - 2013-09-05 18:14 - 00000000 ____D C:\Program Files (x86)\McAfee
    2013-10-27 14:50 - 2013-09-05 17:48 - 00000000 ____D C:\ProgramData\McAfee
    2013-10-27 14:50 - 2013-03-14 05:59 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2013-10-27 14:50 - 2013-03-14 05:59 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2013-10-27 14:50 - 2012-10-22 16:21 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
    2013-10-27 14:50 - 2012-10-21 13:46 - 00000000 ____D C:\ProgramData\FLEXnet
    2013-10-27 14:50 - 2012-10-17 18:30 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\ArcSoft
    2013-10-27 14:50 - 2012-10-17 18:22 - 00000000 ____D C:\ProgramData\AVG Secure Search
    2013-10-27 14:50 - 2012-10-17 17:29 - 00000000 ____D C:\Users\Brandon\AppData\Local\Hewlett-Packard
    2013-10-27 14:50 - 2011-08-08 20:32 - 00000000 ____D C:\ProgramData\RoxioNow
    2013-10-27 14:50 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\servicing
    2013-10-27 14:50 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
    2013-10-27 14:49 - 2013-02-05 20:03 - 00000000 ____D C:\Program Files (x86)\Amazon Browser Bar
    2013-10-27 14:49 - 2012-10-17 18:22 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search
    2013-10-27 14:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
    2013-10-27 14:45 - 2013-09-07 10:07 - 00000000 ____D C:\Windows\System32\MRT
    2013-10-27 14:38 - 2013-09-05 18:15 - 00000000 ____D C:\Program Files\McAfee.com
    2013-10-26 23:22 - 2013-10-26 23:22 - 00000000 ___HD C:\_Exception1
    2013-10-26 15:07 - 2013-10-26 15:07 - 00000000 __SHD C:\$$PendingFiles
    2013-10-26 14:53 - 2013-10-13 12:40 - 00000000 ____D C:\Users\Brandon\Downloads\sinister-fonts_ghoulish
    2013-10-26 14:53 - 2013-10-11 14:03 - 00000000 ____D C:\a0347bdd628f839a6e
    2013-10-26 11:12 - 2012-10-20 15:41 - 00000000 ____D C:\Users\Brandon\AppData\Local\CrashDumps
    2013-10-13 12:52 - 2012-10-17 17:31 - 00061448 _____ C:\Users\Brandon\AppData\Local\GDIPFONTCACHEV1.DAT
    2013-10-13 12:38 - 2013-10-13 12:38 - 00425309 _____ C:\Users\Brandon\Downloads\sinister-fonts_ghoulish.zip

    Files to move or delete:
    ====================
    ZeroAccess:
    C:\Program Files (x86)\Google\Desktop\Install
    C:\Users\Brandon\AppData\Roaming\cache.dat


    ==================== Known DLLs (Whitelisted) ================

    C:\Windows\System32\LPK.dll IS MISSING <==== ATTENTION!
    C:\Windows\SysWOW64\LPK.dll IS MISSING <==== ATTENTION!

    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
    C:\Program Files\Windows Defender\en-US => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ==================== Restore Points =========================

    3
    Restore point made on: 2013-09-07 10:07:02
    Restore point made on: 2013-09-11 11:21:01
    Restore point made on: 2013-10-11 13:47:31

    ==================== Memory info ===========================

    Percentage of memory in use: 19%
    Total physical RAM: 3690.91 MB
    Available physical RAM: 2987.28 MB
    Total Pagefile: 3689.05 MB
    Available Pagefile: 2978.57 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.88 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:446.98 GB) (Free:384.02 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive e: (Recovery) (Fixed) (Total:14.62 GB) (Free:1.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive f: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32
    Drive h: (Lexar) (Removable) (Total:14.91 GB) (Free:14.9 GB) FAT32
    Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS
    Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 27DA6E45)
    Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=447 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
    Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)


    LastRegBack: 2013-09-07 13:02

    ==================== End Of Log ============================
     
  2. Orangepeace

    Orangepeace Private E-2

    Btw I forgot to mention had a diagnostic check done, malware is in bios and hard drive is supposedly unaffected besides not being able to run due to this. Please help. :(
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Please see the below link and take notice of item number 5 about inline logs:

    Forum Rules and Guidelines - Do not post HijackThis logs

    Totally incorrect! I cannot say anything about your BIOS since no scans would detect a problem there, but your harddisk does have infections. It remains to be seen if they are the cause of not being able to boot. You also may be missing system files as pointed out by your FSRT log.



    Download this >> View attachment fixlist.txt




    Save fixlist.txt to your flash drive.
    • You should now have both fixlist.txt and FRST64.exe on your flash drive.
    Now reboot back into the System Recovery Options as you did previously.
    Run FRST64 and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now see if you can boot into normal Windows.
     
  4. Orangepeace

    Orangepeace Private E-2

    Ty!!! Will try that and I too thought hard drive but just going based on what the diagnostics person told me. Again novice computer. Will keep ya updated. Again ty for this it's appreciated.
     
  5. Orangepeace

    Orangepeace Private E-2

    K reposted the FRST in attachment just in case spam interfered. And here's Fixlog. Ty so much again with help.

    (Edit: After pressing fix I restarted the computer and ran computer normally, the loading windows screen ran more this time after this; however error message came back up.)

    Again ty for help. Hope to hear back soon. :)
     

    Attached Files:

    Last edited: Oct 30, 2013
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Please run a NEW scan with FRST and attach the new log.


    Also I have a question. When you tried to run System Restore, did it ever finish properly? I see the below in your log seems to imply no.

    HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
     
  7. Orangepeace

    Orangepeace Private E-2

    No it never did a final restore tried multiple times. Kept running into a error message something like "0x00000018245" at end of finalizing (don't quote, just remember first part.) I'll ge exact error code tomorrow if ya like and I'll run FRST again too.
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Which restore point did you try?
     
  9. Orangepeace

    Orangepeace Private E-2

    All 3 that came up, none previous were there and I clicked show more option. Each one read same msg during finalizing. Find it odd only 3 updates in restore showed up. :/
     
  10. Orangepeace

    Orangepeace Private E-2

    Okay so exact error message for system restore is:

    0x80070002

    I tried to open system restore and this is what it says:

    "There was an unexpected error:

    The system cannot find the specified. (0x80070002)

    Please close System Restore and try again."

    (Edit: rebooted computer now I can access system restore.)

    Here's new FRST in attachments. I noticed it said 2 things were missing. :/
     

    Attached Files:

  11. Orangepeace

    Orangepeace Private E-2

    Okay I did a system restore on Update 10/11/2013 I ran into this error message like the last time:

    "System Restore did not complete successfully. Your computer system's files and settings were not changed.

    Details:
    An unspecified error occurred during system restore. (0x8000ffff)

    You can try system restore again and choose a different restore point. If you continue to see this error, you can try an advanced recovery method. For more information, see What is Recovery?"

    So now two error messages from system restore.

    0x80070002 and 0x8000ffff

    The other 2 points of restore say same as well when enabled, they just finalize and give error.
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Have you tried the Startup Repair selection from the System Recovery Options mnu which has the below choices
    • Startup Repair
    • System Restore
    • Windows Complete PC Restore
    • Windows Memory Diagnostic Tool
    • Command Prompt
    • Select Command Prompt
    Also you could try getting to the command prompt like you did when running FRST. Then run the below ( note there is a space after sfc and note the direction of the / ).

    sfc /scannow

    What happens? I'm hoping this can replace the missing files but I'm not sure that is the reason you cannot boot up. This may not be fixable without a reinstall. Do you have your data backed up?

    I think maybe what we can try next is deleting files, folders, and services related to McAfee to see if it has somehow become a problem.


    If you do not have data backed up the info in the below link may be of use on backing up critical files to an external removable drive:

    Windows 7: Copy & Paste - in Windows Recovery Console

    Then you would format and reinstall Windows 7 from scratch.
     
    Last edited: Nov 2, 2013
  13. Orangepeace

    Orangepeace Private E-2

    Hey trying to get a external device. Get back to ya asap!
     
  14. Orangepeace

    Orangepeace Private E-2

    Hey dude! I dont know what I did, but i did system recovery for d drive left it on ther for 3 days trying to find a external drive for great price. Closed it out about to do what ya suggested and my computer save some of my files to recovery and deleted everything and literally did a factory restore! I mean I'm happy computer back but lost files. Anyway I can access files in recovery?
     
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not too sure on exactly what your last message was trying to say, but if you did a factory restore, before doing a back up, then your files are gone. That was why I said do a backup first.
     
    Last edited: Nov 7, 2013

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds