Start-up and various problems XP

basaint · Feb 26, 2010

Let me thank you first for a very detailed cleaning process. I attempted to follow it to the best of my ability. Let me also say that I was/am generally shocked at the state of disrepair of this laptop. I had handed it off about a year and a half ago to a couple of late teen sons who, up until recently, had not identified any problems. It is obvious that a whole lot of junk was on here. Following your step-by-step process took a lot of time since the computer runs for about 20 minutes at re-boot before the message: "Message Queuing Service has encountered a problem and needs to close. We are sorry for the inconvenience." pops up and we can use it relatively normally.

I tried system restore and various other options. Originally I was receiving the error message: "error loading c windows system32 mwmddsrv.dll" It has been replaced by the Queuing Service message but the excessively long start-up remains.

In following your steps, I ran into some other problems:

Combofix said something to the effect of it ended in an unusual way.

I wasn't able to ever successfully run MGTools after many different attempts I just timed out with the message: "ProcessDll.exe

Application has generated an exception that could not be handled.

Process id=0x 174c (5964), Thread id=0xbdc (3516)

My attempt to upload RRlog showed an invalid file but the text is:

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/02/16 13:08
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP2
==================================================

Hidden/Locked Files
-------------------

I am so sorry I have come to you with such a pack of troubles but thank you in advance for any assistance you can provide.

Kestrel13! · Feb 26, 2010

Important Notice: A new version of SUPERAntiSpyware is available.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Now run a new full scan of your system. And attach this log later.

I wasn't able to ever successfully run MGTools after many different attempts I just timed out with the message: "ProcessDll.exe

Application has generated an exception that could not be handled.

Process id=0x 174c (5964), Thread id=0xbdc (3516)
Click to expand...

See this for possible error messages

Using MGTools

Then try again to run MGTools, ensuring it is on the root drive of C (C:\MGTools.exe) Attach the log it generates. These logs are the most important logs of all so getting those is of importance.

I am so sorry I have come to you with such a pack of troubles but thank you in advance for any assistance you can provide.[/QUOTE] No problem!

basaint · Feb 26, 2010

Thanks so much. With any luck I have given you what you need.

Thanks again.

Kestrel13! · Feb 26, 2010

You scanned with SAS MBAM and CF on 16th feb, it is now 11 days later. Ideally you should have attached those logs straight away rather than wait so long.

You will have to visit the software forum regarding the Message Queuing Service errors.

AVG Free 8.5 <--- You can either upgrade to avg 9 or you can install another AV. If you decide to install another, let me know because the avg removal tool will be required to rid you of all traces of it before you install your new av if that's what you wish to do.

Adobe Reader 7.0.9 <--- also out of date and leaves you more vulnerable to PDF exploits.

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

File::
C:\Documents and Settings\Scott Johnson\Desktop\~WRL0002.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL0525.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL0856.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1058.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1262.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1322.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1665.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1780.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1809.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1912.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL1945.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL2077.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL2292.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL2370.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL2664.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL2761.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL2838.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL3232.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL3396.tmp
C:\Documents and Settings\Scott Johnson\Desktop\~WRL3889.tmp

Folder::
c:\program files\Viewpoint
c:\documents and settings\Scott Johnson\Application Data\Viewpoint
c:\documents and settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\Scott Johnson\Local Settings\is-3IFO2.tmp
C:\Documents and Settings\Scott Johnson\Local Settings\plugtmp

Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Also delete all files in the below bold folders except ones from the current date (Windows will not let you delete the files from the current day).

C:\WINDOWS\TEMP
C:\Documents and Settings\Scott Johnson\Local Settings\Temp
Click to expand...

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Combofix.

Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now!

basaint · Feb 27, 2010

Thanks again so much for your help.

A couple of quick notes. I had the gap of about 10 days in original scans and posting as I was heading out of town. The computer, however, was tucked away not in use.

I had the same messages this time with ComboFix saying it ended in an unusual way and MGTools with an error message at the end. I am wondering if they may be related to the Queuing message and 18-20 minute delay on Start-up. Maybe it is possible that there is a missing or corrupted .dll file that forces it to run in circles until it terminates. This may cause ComboFix to time-out after the reboot and explain why MGTools is having problems with part of the registry?

Thanks again.

basaint · Feb 27, 2010

I forgot to add that the start-up problem is not only still there but also when I attempted to boot from the XP Recovery DVD it stopped me and said that there was a problem and it was shutting down to prevent damage to the system. It also suggested that it might be some type of malware or virus.

I also wanted to give you the information relating to the Message Queuing Service Error:

Error signature

szAppName : mqsvc.exe szAppVer : 5.1.0.1111 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

Files in error report:

C:\DOCUME~1\SCOTTJ~1\LOCALS~1\Temp\WERa233.dir00\mqsvc.exe.mdmp
C:\DOCUME~1\SCOTTJ~1\LOCALS~1\Temp\WERa233.dir00\appcompat.txt

I just wanted to make sure that I wasn't leaving out some potentially useful information.

Thanks again.

Kestrel13! · Mar 1, 2010

I also wanted to give you the information relating to the Message Queuing Service Error:
Click to expand...

It is not malware. You are going to have to sort this out in the software forum as we do not have time to deal with it here in this forum.

Use windows explorer to find and delete the below bold folders:

c:\documents and settings\All Users\Application Data\avg7
c:\program files\Registry Patrol(2)
Click to expand...

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

basaint · Mar 1, 2010

Thanks so much for all of your help on this. You have been absolutely terrific.

I deleted the specified files and am following up on your recommended steps.

Thanks again

Kestrel13! · Mar 1, 2010

You're very welcome Safe surfing!

Log in or Sign up

Start-up and various problems XP

basaint Private E-2

Attached Files:

SASlog.txt

mbam-log-2010-02-16 (10-31-14).txt

ComboFix.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

basaint Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 02-26-2010 - 20-00-10.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

basaint Private E-2

Attached Files:

MGlogs.zip

ComboFix.txt

basaint Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

basaint Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member