stuborn bugs

Discussion in 'Malware Help (A Specialist Will Reply)' started by Cauca, Dec 14, 2006.

  1. Cauca

    Cauca Private E-2

    Ok, before posting this I've read and learned enough to be truly fond of Geeks with snazzy pocket protectors :)


    I'll try to make this as short as I can, I think it will work.
    Lot's of bad stuff was found and erased, but still I have some bugs I need to be advised on. I list and upload in order of performance the logs I got

    -CounterSpy
    -BitDefender (log looks weird to me)
    -Activescan
    -Runkeys
    -Newfiles

    Updated Norton, Ad-Aware, Spyware Blaster, Spybot and CCleaner were also run, but I still don't dare changing the java stuff because the ownership of the machine is shared, but I'll get to it. All other specifications in the Read&Run first have ben fulfiled.

    I just hope to get away without having to learn the HijackThis thing...

    Thanks so much for such a wonderful web. Truly, I admire you guys.
     

    Attached Files:

  2. Cauca

    Cauca Private E-2

    stuborn bugsII

    the other two logs as listed
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: stuborn bugsII

    Welcome to Majorgeeks!

    You never attach your HijackThis log as requested in step 7 of the READ ME. Let's see what we can do right now without it. I'll ask for one later.

    Make sure viewing of hidden files is enabled (per the tutorial).

    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 6
    J2SE Runtime Environment 5.0 Update 8
    J2SE Runtime Environment 5.0 Update 9
    Java 2 Runtime Environment, SE v1.4.2_03

    Now install the current version of Sun Java from: Sun Java Runtime Environment

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Boot into safe mode and use Windows Explorer to delete:
    C:\\Archivos de programa\\DreamGroup <--- the whole folder:

    Now run Ccleaner.

    Now reboot in normal mode

    Now attach the below new logs and tell me how the above steps went.

    1. GetRunKey
    2. ShowNew
    3. HJT (from step 7 of the READ & RUN ME)


    Make sure you tell me how things are working now!

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  4. Cauca

    Cauca Private E-2

    Roger that... Let's see how it goes!!

    Just out of curiosity: could you tell me what you saw in those logs I posted?, If you feel like it... Whatever you feel like commenting on. I would appreciate it.

    Thank you very much for your help!
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: stuborn bugsII

    I'm only commenting on the remaining items that were not fixed by the other scans! You can read what the scans found in the logs.

    Well besides your Sun Java being out of date and having a bunch of old versions still installed, I also saw.

    Spyware Cleaner - a suspected rogue tool which is not in your install list either making it even more suspect
    QuickTime Task - for Quicktime but a waste of resources to load at startup

    "SuperHidden"=dword:00000001 - is a registry key value the should have been 1after following step 2 of the READ ME but was still set to 0.
     
  6. Cauca

    Cauca Private E-2

    Oh! Ok. I guess I can read it, I just can't understand hardly anything! Hehehe... Anyway, I guess I perceive the capabilty to grasp those logs somewhat mistically out of sheer ignorance.

    Thank you so much for your time.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    ????

    Are you going to complete my instructions?
     
  8. Cauca

    Cauca Private E-2

    Yes, yes of course!
    I'm in it right now. Sorry about that.

    By the way, I didn't realize that the Sun Java was only a question of updating, I thought it was also changing brands.
     
  9. Cauca

    Cauca Private E-2

    I'm very sorry I didn't realize you must be keeping an eye on this... I was just having fun and got to it just now.

    I apologize.
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what you mean. Sun Java is still Sun Java!
     
  11. Cauca

    Cauca Private E-2

    Ok, I'll explain later. Believe it or not, I'm at a cyber cafe.

    I can't login to my computer. I'll tell you what I did:

    I uninstalled Java stuff. Asked if wanted to reboot said no. Installed new Java.

    Added fixME.reg to registry just like you said.

    Then I went to run and typed msconfig. I chose to rebot in safe mode (but chose an option that included something like safe mode "with some more features" or similar).

    In safe mode I was asked my key to enter: wouldn't work. Same user name, same code as ever.

    Tried to reboot in normal mode, turn of and boot normally, booting last configuration that worked and also rebooting loadind Windows registry. In all cases windosw remained in safe mode. Although a couple of times the normal color of my desktop showed on the screen, it finally ended on the black safe mode screen, with the enter code dialogue not recognising my key.

    This is a family pc and I'm almost sure there are no other user accounts.

    You have any ideas??

    I'll stick around for a while to see if you answer, otherwise I'll wait 'till tomorrow since it's getting late.

    Please help, I know someone who's killing me.
     
  12. Cauca

    Cauca Private E-2

    I mean late in spain.
     
  13. Cauca

    Cauca Private E-2

    Anyway, what a weird situation... I think I'm just going back home now.
    I feel a little calmer after having posted the new issue.
    Hopefully we'll figure this out.
     
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I don't understand exactly what you are trying to say. What do you mean when you say "key" ? Do you mean Password?

    Do you mean that you don't know your Administrator account password so that you can log in in safe mode? Whose PC are you working on? What user login name did you try to sign in with in safe mode?

    Your PC really did not have much in the way of malware on it, so I don't think that whatever you are experiencing is malware. Sounds more like some kind of confusion on your part or a misconfiguration in Windows.

    Are you trying to say you can only boot in safe mode now? If that is your problem, run msconfig and select Normal Startup.
     
    Last edited: Dec 15, 2006
  15. Cauca

    Cauca Private E-2

    Hello Chaslang,

    Yeah, you're right, key was not the right word to mean password, but at the moment I could not think of a better one. But no, it's not a matter of confussion. It's a fact that I'm locked out of my pc and I really need help to get back in. The password, the only one I've ever had, wont work, the username is correct and it's not a matter of capital letters and such. In fact, I entered the configuration menu pressing F2 and changed the password. Doesn't work either. All I get from my pc no matter what boot mode I try is a black screen on safe mode with the enter password dialogue and the option to turn off or reboot. That's all, and the password will not work.

    I disabled the password request on star up, but there was no change.
    I entered theF12 menu and tried to boot normally, tried with basically all other options there, but there is NO change at all. Windows CAN'T get out of safe mode whatsoever, and will NOT accept the password to grant acces, even when the former was changed after due confirmation...

    I don't think it's the malware either. I believe something unexpected must have happened while performing changes right before I rebooted in safe mode as per instructions. Like I said, it's not a matter of not typing correctly the password (it's a very simple date) or anything like that.

    As additional information, I can tell you I disabled the quiet boot mode, and I have been able to see this info:

    -sistem video shadowed
    -video bios shadowed
    -Rom passed
    -Cache passed

    Also, while loading, before getting to the insert password dialogue, Windows shows a message that sais this:

    Fast Ethernet controller
    PX-E61 - media test failure, check cable


    I can't run msconfig, because like I said I'm locked out of windows. I hope you understand now what I'm saying. This is a problem. Truly, I understand this is no one's fault whatever the source of the problem is, but I ask you to please try to help me. I'm at user level but entering a password is something I've come to master by now. So I'm hoping it's possible to access windows through dos and enter a command that finally works. Or maybe some other solution, I'm told reinstalling windows again could help, altough I would have to reinstall lots of stuff as well. As long as I can access the information saved in the HD...


    In my las post are the exact steps I made just before getting at this point.

    I've managed to bring home another pc, so as long as I'm here I can easily be in touch with you.

    Thanks.
     
    Last edited: Dec 17, 2006
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This password has nothing to do with Windows. It is only the System BIOS password.


    Again the BIOS password has nothing to do with Windows password. When you attempt to boot up in safe mode, do you get a list of user accounts? If so, which ones do you see? Is it only the Administrator account? Perhaps you never put a password on it which means you would just hit the enter key.


    This is a hardware error and has nothing to do with Windows software. Were you playing around with setting in the System BIOS after you used F2 to enter the BIOS? I don't know what the correct setting for your PC are but you may have change something.


    Windows XP does not have a DOS mode. When you boot up and press tap F8, do you get a menu of boot options? If so, have you tried using the Safe Mode with Comand Prompt option?


    Do you have your Windows XP boot CD?
     
  17. Cauca

    Cauca Private E-2

    Hi,

    No, I didn't touch any configuration function except for what I said.

    No, I don't have the disk here.

    I'll see what happens pressing F8
     
  18. Cauca

    Cauca Private E-2

    Seems like F2 and F12 are the only taps that show a menu. Nothing happens when pressing F8.
     
  19. Cauca

    Cauca Private E-2

    Sorry I skipped a question.

    No, we only had one password. There's no list of users.
     
  20. Cauca

    Cauca Private E-2

    Hope not to be driving you too crazy...

    Tried pressing F8 a lot of times. The menu I have in front of me has a lot of options I've already tried with no results. They're in Spanish, and I'm not sure which would be the one you mention.

    I'll try and list them for you in English the best I can, which is in a rather literal way.

    1 Safe mode
    2 Safe mode with network functions
    3 Safe mode with symbol system

    4 enable start up registry
    5 Enable VGA mode
    6 Last good configuration known (last one that worked)
    7 restore SD mode (only control of windows domain)
    8 Purge mode
    9 Disable automatic start up if there's a system error

    10 Boot windos normally
    11 Reboot
    12 Go back to OS options menu

    Now I'll list the ones I've used already:

    2, 3, 4, 6, 7, 10, 11

    **Just was told about the edit funcion, I'll try to use from now on**
     
    Last edited: Dec 17, 2006
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But what user account name are you logging into?
     
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I believe that option number 3 would be equivalent to Safe Mode with Command Prompt. Tell me exactly (step by step) what happens when you try this mode and how far it gets.

    Why didn't you try option 1?

    You can only edit previous message for 5 minutes. After that time has elapsed, you can no longer edit them.
     
  23. Cauca

    Cauca Private E-2

    I didn't try 1 because it's the mode I'm stuck in.

    I loged to the same user as always.

    Tried 3 again.

    I see a lot of items loading thorough the screen very fast. I think the word Partition showed many times.
    Then the list of items loading at the bottom of the screen. Apparently drivers.
    Then at the bottom again sais something like "press esc not lo load SPTD.sys".
    Then a black screen with a flickering white dash on the left upper corner.
    Then the usual blue of my desktop for a moment.
    Black again. Safe mode with enter password dialogue. Option to reboot or turn off.

    Tried 1 with exaclty the same results.

    This loading of things and the alternative black and blue didn't use to happen. Before having this problem, usually it was just a screen showing XP loading, and then the blue screen with the password dialogue.

    Are there any other options? If you find none you can tell me plainly, really.
     
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You are missing the point of my question! I want to know the user account name! If the account name is not an administrator account, it is not accessible in safe mode. And in safe sode there should also be an option to log into the account named Administrator The Administrator account will only appear in safe mode.

    Are you having problems with your Windows partition being recognize?

    I believe sptd.sys is related to Daemon Tools. Did you install this on your system? What did you answer for the sptd.sys question? When it got to the enter password dialogue, what user name did you enter and did you enter the correct password? What happens when you enter this info? Or are you saying it does not allow you to choose the user name and password?

    In your System BIOS what is the Boot Sequence set to?

    I'm pretty sure that none of this has anything to do with malware! You are probably going to have to work this out in the Software (or maybe Hardware) Forum.
     
  25. Cauca

    Cauca Private E-2

    It's jmcoca, the username.

    The option to log in as administrator doesn't show.

    I don't believe there are problems with my windows partition being recognised, at least I'm net getting any messages regarding that.

    Daemon tools was installed more than a month ago, maybe two, and never gave the smallest problem, nor the SPTD item had ever shown before this. The SPTD item appears as does the option to enter the configuration menu when booting windows, which after a while disappers.

    The username jmcoca shows automatically on the dialogue box, but the password 1974, the one assigned to that user, is rejected.

    In the BIOS menu, inside the tab Boot it says Network Boot.

    Ok, if I have to try another forum, what should I do? Can these posts we've written be moved?

    Do you think the change on the registry we made might have something to do with the arousal of this problem? Please feel free to honestly comment on possible unexpected effects of the last steps I made before having to boot on safe mode. I would like to know what you think about that so that I have as more information as possible. And just be aware that whatever happens I'm still amazed you were willing to help me in the first place and I'm grateful for it.

    It's midnight here, so I don't think I will be seeing your answer 'till morning.

    See you tomorrow.
     
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Then what were the messages you referred to when you said "the word Partition showed many times."


    Why are you trying to boot from a Network? Did you always do this? If not, then you changed options in the BIOS which is what I asked you earlier. If you don't normally boot from a network drive then disable this option.


    Yes I could move the whole thread but that may not be a good idea because many people may not want to read all the info below. They would only want to know the current problem (which I think is because you changed BIOS settings).

    Absolutely not! Nothing I had you do has anything to do with this. All you did was uninstall old versions of a program and delete or change some registry keys. We modify these same keys about 100 time per week. Based on what you are telling me it would appear you are trying to boot from a network drive. So as I asked above, is that your normal boot mode.
     
  27. Cauca

    Cauca Private E-2

    I'm not sure howto quote, so I'll cpy paste and use bold.

    what were the messages you referred to when you said "the word Partition showed many times".

    The word partition showed as part of items loading fast, not as a message. I think they showed when trying to boot on the modes we tried yesterday. The list of items loading is not showing now.


    Why are you trying to boot from a Network? Did you always do this? If not, then you changed options in the BIOS which is what I asked you earlier. If you don't normally boot from a network drive then disable this option.

    I had never entered tha configuration menu before this, less did I ever touch options such as booting. Network booting must have always been there. I tried to change it, but all it happens when I press the option to disable it is that an exclamation sign shows right netx to "network booting". Then I keep booting and everything as always.

    They would only want to know the current problem (which I think is because you changed BIOS settings).

    I see you're positive this has to do with something I did. I was positive it hat to do with your instructions. However, I didn't touch the BIOS until this problem came up (and just tried 3 options, two of them I've told you about and the other was languange). Besides you have performed the same thing over and over and this had never ever ocurred. So that got me thinking.

    I installed sofware the night before following your instructions. It was something to boost the computers performance. I cant' recall but I think it might have been PCBooster. I also installed game accelerator. Everything worked just fine, the computer went faster and my game too, so I didn't connect the dots around that. But it's likely I didn't have any problems with booting then because most probably (I don't have a very good memory) the pc spent all day and night downloading stuff with emule. The next morning I had your answer, followed instructions, rebooted for the first time after installing that software and you already know the rest.
    What do you think of this?

    If this is out of your "jurisdiction", I guess I can just star a new big thread at another forum by selecting information from here.
     
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Use the icon at the top of the message window. It looks like a text box and is just to the left of the # sign.

    This does seem like it could be a problem. It does not make sense to have a home PC (that is what I assume this is) booting from a Network Drive. Unless I'm misinterpreting the message that you gave me. However as I said, this is really a question better asked in another forum. It is just not something I'm that familiar with and it is not a malware related topic. This particular question itself may be best served in the Networking forum, but the Software forum may get more hits since it is busier.

    Those instructions I gave you were very simple things. A few old Sun Java version uninstalls and an install of the new one. It would have been better if your rebooted after uninstalling as it requested, but even that should not break anything. Then the next part of the instructions just changed a couple registry settings. Very minor changes. The kind that we do 30 to 50 times per day.


    You also had installed Registry Mechanic on Dec 11th. What had you done with it?
    Well what I think is that using P2P programs can be very dangerous and more than 50% of users coming here for help picked up the infections via the P2P programs themselves or what they downloaded with them. So leaving it open for the world to have access to your PC all night...... well that is not something we think of as being a good idea. In fact many malware forums will not work on fixing problems until ALL P2P software has been installed. In addition, my instructions were based on the state of your PC when your logs were first posted. I have no idea what may have changed by the time you came back. Do I think that anything that may have changed would cause my steps to make something like this happen....the answer is no. However, something else could have happen during the night and in addition you did not reboot after uninstalling the 4 old Sun Java's which was not a good idea to leave the uninstalls in an incomplete state for so long.

    It may be best if you start with a question about the Fast Ethernet controller, PX-E61 - media test failure, check cable message you get.

    Did you check in the BIOS to see what your Boot Sequence is? Is it set to boot from the Hard Disk at some point and what comes before the hard disk?
     
  29. Cauca

    Cauca Private E-2

    Thanks.

    My father used to work at home from this house and I believe he set up a network. We use his router and configuration, only with one computer. It has always worked fin.


    I wanted to have a better control of what run on start up. I could only use a couple of features since it was a trial version, I jus't can't recall exactly what I did.

    The Boot tab shows as follows:

    -Hard Drive
    TOSHIBA MK8025GAS-(PM)

    CD-ROM/DVD Drive

    -Removable devices
    Legacy Floppy Drivers

    Network Boot

    The dash indicates that the item below belongs to the one above.

    Ok, I'll do that. Regarding emule, I take note of that information.
     
    Last edited: Dec 18, 2006
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You don't need a program like Registry Mechanic to do this. It is overkill for such a small task and there are free programs to control startups. Like Startup CPL for just an example.


    I assume this means that the Hard Drive is supposed to boot first and Network Boot is last? Is that correct? Seems strange that you would get an error message about network boot when you are supposed to boot from the Hard Disk first. Or do I have the order wrong. Is it Network Boot first?
     
  31. Cauca

    Cauca Private E-2

    Ok, I copy that too.


    Yeah, I'm pretty sure. To make sure I didn't change anything by mistake I chose to setup defaults, and that is the order according to them.

    I'm not sure when that error has shown. Maybe you mean the exclamation signal?

    I am now starting a new thread at Software and see what happens.
     
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I meant the error about the media test failure. (You may have some of that message wrong too. I think it should be PXE-E61: Media test failure, check cable


    Good luck! I think you may find that some one will say to disable the Network Boot like I suggested. If you are getting to the Network Boot point, it could mean your hard disk is not working properly since you should be booting from it. If you had a bootable CD and put it in the CD drive, you would probably not see this error message because your PC would then try to boot from the CD. This is all an assumption on my part since I have never dealt with this before.
     
  33. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  34. Cauca

    Cauca Private E-2

    I saw it quite a few times so I guess I should have gotten it right, but his error message could be as you say. Truth is I can no longer see it and confirm it, since I doesn't show now. This may probably be because I did change something in the Bios without knowing, and after setting up defaults the issue's gone back to its place again.

    This may be good news, but I'm not sure now that there was a chance of knowing the problem. So anyway, I'm back to my number one problem. About disabling network boot, the thing is most commands do not seem to work. Otherwise we would have solved this by now, I guess.

    Well, thanks for everything Chaslang. You must for sure gather up lots of patience to do this, specially in cases like mine and subjects like me, but then again I'm pretty sure you love this stuff. Thanks.
     
  35. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try first removing it from the boot sequence completely and see what happens.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds