|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-15-2006, 09:48 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
Malicious Program Sending Spam Emails From My PC !!!
Hi everyone - this seems the site where I may be able to get my problem fixed. My pc is connected to my husband's router but during the past few days, I seem to have attracted a malicious prog, virus, trojan, spyware or malware thingy, which is sending out emails at a rapid rate. I know this because my screen is covered with Norton Antivirus dialogue boxes saying scanning email and each one before it disaapears attracts another box saying it could not be sent because it was blocked by either our ISP or by our router's firewall. I have run all our antispyware tools and of course Norton Systemworks scanner (2005) which all reveal nothing untoward. I am not capable of resolving this any further and wonder if you guys could help a damsel in distress? I do not want to mention this to my husband or he will go up the wall saying such things as where the h**l have you been surfing for god's sake etc etc and so after doing some research, here I am.
I have followed everything in your Sticky and the following is the HijackThis log which I have run just now. ------------------------------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 16:14:44, on 15/06/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\Program Files\Spyware Doctor\sdhelp.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\sstray.exe C:\Program Files\ICQ\NDetect.exe C:\WINDOWS\System32\USBMonit.exe C:\WINDOWS\system32\atiptaxx.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\WINDOWS\system32\??pPatch\??anregw.exe C:\DOCUME~1\Ruth\APPLIC~1\APPATC~1\dvdplay.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=userinit.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\System32\USBMonit.exe O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [Rvcjclci] C:\WINDOWS\system32\??pPatch\??anregw.exe O4 - HKCU\..\Run: [Imou] "C:\DOCUME~1\Ruth\APPLIC~1\APPATC~1\dvdplay.exe" -vt yazr O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1125760699328 O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{DFBBEBAD-6A8A-423F-9596-319C7FB31D78}: NameServer = 62.241.162.200,62.241.163.200 O20 - AppInit_DLLs: C:\WINDOWS\system32\logonui.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe ------------------------------------------------------------------------- At the moment it seems I am unable to use the internet, so I have borrowed my husbands laptop hehe! Every time I plug in the ethernet cable to the router, from my pc, the emails just keep being sent. What is surprising, to me at least, is that they do not show in Outlook Express, my email client, which isn't even open. Something has been set up on my pc which is doing this and our usual antispy/virus progs are not picking it up. I daresay some of these emails are getting through - will I receive a warning from our ISP do you think? Please help Ruth |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-16-2006, 08:35 AM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,170
OS: 2000 Pro; XP Pro; XP Home
|
Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Please submit the following file to Jotti File Scan C:\WINDOWS\system32\logonui.dll At the top of the window you should see "File to Upload & scan" and a blank box. Copy and paste the red text from above into the box. Then click "submit". When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" here. --------------------------------------------------------------------------------------------- Download Ewido Anti-Malware
If you are having problems with the updater, you can use this link to manually update Ewido When you have finished updating, EXIT Ewido. Download and install CleanUp! NOTE: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Do NOT run this program if you have XP Professional 64 bit edition. If you're unsure please do not run it! If you don't already know, you're probably not using XP64, but you can download & run this tool to find out for sure.....http://www.kellys-korner-xp.com/regs...p_whichcpu.exe
--------------------------------------------------------------------------------------------- Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers. --------------------------------------------------------------------------------------------- Run a scan in HijackThis. Check each of the following and hit 'Fix checked' if they still exist (make sure not to miss any): R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O4 - HKCU\..\Run: [Rvcjclci] C:\WINDOWS\system32\??pPatch\??anregw.exe O4 - HKCU\..\Run: [Imou] "C:\DOCUME~1\Ruth\APPLIC~1\APPATC~1\dvdplay.ex e" -vt yazr O20 - AppInit_DLLs: C:\WINDOWS\system32\logonui.dll --------------------------------------------------------------------------------------------- Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Also make sure there is no checkmark beside Hide file extensions for known file types * Click Yes to confirm and then click OK. --------------------------------------------------------------------------------------------- Delete the following Files/Folders if they exist: C:\WINDOWS\system32\??pPatch\<<<May appear as AppPatch, will contain a file which may appear as scanregw.exe C:\Documents and Settings\Ruth\Application Data\APPATC~1\<<<May appear as AppPatch, will contain a file which may appear as dvdplay.exe --------------------------------------------------------------------------------------------- Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: Click "Options..." Move the arrow down to "Custom CleanUp!" Put a check next to the following (Make sure nothing else is checked!):
Press the CleanUp! button to start the program. Do NOT Reboot/logoff when prompted. * CleanUp! will not create any backups!! --------------------------------------------------------------------------------------------- Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
** Ewido scan would require at least an hour. --------------------------------------------------------------------------------------------- Restart in normal mode. --------------------------------------------------------------------------------------------- Perform an online scan with Internet Explorer with Panda ActiveScan Click on the "Free To Use ActiveScan" located on the top right hand corner
--------------------------------------------------------------------------------------------- Run a new HijackThis scan. Save the log file and post it here. --------------------------------------------------------------------------------------------- Please return with logs from: Ewido Panda HJT
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-16-2006, 04:32 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
Thankyou for your speedy help. I have managed to do just about everything you asked me to do, but you must appreciate that it is almost impossible to do anything online from my pc because of the Email Sending screens. I am attaching a small jpeg showing my dilema and hopefully too, just what is going on.
I managed to upload the update to Ewido without triggering the email sendings and everything else, I managed to download on our laptop and transfer to my pc without it being connected to the router/internet - I hope you understand what I am saying because I need you to know that performing online tasks now on my pc is almost impossible. So unfortunately the online scan using Panda was impossible. I am attaching the results from the Jotti File Scan, Ewido and a new HJT log. ______________________________________________________________ Service load: 0% 100% File: logonui.exe Status: OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 7db59fff2af32c27eb2276424fa5eddb Packers detected: - Scanner results AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing UNA Found nothing VirusBuster Found nothing VBA32 Found nothing _________________________________________________________________ --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 23:00:09, 16/06/2006 + Report-Checksum: 4834A56D + Scan result: [780] C:\WINDOWS\system32\logonui.dll -> Adware.PurityScan : Error during cleaning [968] C:\WINDOWS\system32\logonui.dll -> Adware.PurityScan : Error during cleaning C:\System Volume Information\_restore{9C9ECE3F-D8F8-4C8A-BB40-13E01E1F18B5}\RP8\A0007254.exe -> Backdoor.Haxdoor.it : Cleaned with backup C:\System Volume Information\_restore{9C9ECE3F-D8F8-4C8A-BB40-13E01E1F18B5}\RP8\A0007255.dll -> Adware.Yahoo : Cleaned with backup C:\WINDOWS\system32\__delete_on_reboot__logonui.dll -> Adware.PurityScan : Cleaned with backup E:\Ruth's Old PC File and Program Settings\Paul's\Downloads\Install\Ulead Cool 3D v 3.5\Ulead Cool 3D V3.5 Full-Crack.exe -> Backdoor.Theef.111 : Cleaned with backup E:\Ruth's Old PC File and Program Settings\Yahoo!\Messenger\ycomp.dll -> Adware.Yahoo : Cleaned with backup ::Report End ________________________________________________________________ Logfile of HijackThis v1.99.1 Scan saved at 23:08:11, on 16/06/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\Program Files\Spyware Doctor\sdhelp.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\sstray.exe C:\Program Files\ICQ\NDetect.exe C:\WINDOWS\System32\USBMonit.exe C:\WINDOWS\system32\atiptaxx.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\OPScan.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Logitech\Video\AlbumDB2.exe C:\Program Files\HiJackThis\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\System32\USBMonit.exe O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1125760699328 O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{DFBBEBAD-6A8A-423F-9596-319C7FB31D78}: NameServer = 62.241.162.200,62.241.163.200 O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe ________________________________________________________________ So from what little I know it does not seem I am infected with anything not normally found but something wants to send me emails. I understand why you have to start the way you do, but I have explained my symptoms and wonder whether you know what is causing this to happen. Please do not come back to me with more "online-tasks" as it has taken me ages to get this far Ruth |
|
|
|
|
06-16-2006, 07:33 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,170
OS: 2000 Pro; XP Pro; XP Home
|
First of all, you uploaded the wrong file....I asked for logonui.dll, not .exe to be uploaded. No matter at this point.
I can see that Ewido IDd it as PurityScan and slated it for removal on reboot. Please ensure this file has been deleted: C:\WINDOWS\system32\logonui.dll <<<NOT logonui.exe!!!!! You have an apparent email worm that's not showing in the HJT log. It is the power of these online scans that help us root it out. There's only so much I can do from here without seeing what it is on the machine that's causing the issue. You may want to purge your email folders, sent items, deleted items, etc....to help eliminate the possible source. I also see cracked software on the system, according to Ewido. Cracks are one of the greatest causes of infection. Have you updated Norton and run a full system scan with it since this occured? We can use another free standing (offline) scanning tool to help us. You'll need to download it on a clean machine, and carry it to the infected machine. * Download Dr.Web CureIt to the desktop: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Also do this: Right click on http://www.silentrunners.org/Silent%20Runners.vbs and choose Save As...Save it to your Desktop. Make sure you have disabled any programs that may block/disable scripts (ex: Ad-Watch, TeaTimer, Norton, etc.). Double click on 'Silent Runners' to run it. This will take a few minutes. It will create a file called 'Startup Programs' followed by your computer name and current date. Open up that file and post all the contents here in your next post.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-17-2006, 07:42 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
Well after attending to the things you previously advised, upon booting up I got a BSOD after Windows has loaded. I have had enough of this and after trying unsuccessfully to do a Restore to an earlier time, I am now doing a "repair Install". Hopefully this will erradicate my problems altogether. Not sure what the BSOD was all about, but clearly relates to file(s) that were deleted. Oh well. I will post again assumimng everything works once the RI has finished and everything updated.
Ruth |
|
|
|
|
06-17-2006, 08:57 AM
|
#6 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
The repair install seemed to do the trick but after trying to update Windows, it aborted when trying to install "Microsoft's Download Software" and again I got the BSOD "0x0000008E". Now every time the pc boots, after applying the password it boots into windows then the BSOD again. If I wait long enough at the password screen, before applying the password again I get the BSOD. Your instructions have obviously messed my PC up rather badly and am a little cross! It was working fine apart from the email sends.
I am now performing a repair install again in the vane hope I can retrieve my files - at least 10,000 mp3 files - if I loose these then watch out because I will be one cross woman!! Sorry to reply in these terms but my whole week end has been taken up with sorting this out and you have seemed to make it worse. Ruth |
|
|
|
|
06-17-2006, 09:21 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
And now, in the middle of the reapir install, the system wants to complete a chkdsk scan on drive f - it completes then sticks there indefinately! Rebooting only makes the system go through the same process until it sticks. Loading into safe mode freezes the pc and again it freezes after loading last known good settings. So how can I stop the scanning of F, so I can proceed?
Ruth |
|
|
|
|
06-17-2006, 09:59 AM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,333
OS: N/A
|
Ruthy,
It may appear that Dr.Web may have somehow removed some of your files. I need to know what it removed before we can formulate a recovery stratergy. Please try using the recovery console to recover Dr.Web's logs. If you have folowed Bob's instructions, it would have been saved to your Desktop. That's located at this folder: C:\DOCUMENTS AND SETTINGS\Ruth\DESKTOP\DrWeb.csv I would also request that you rein in your frustuations. Being cross doesnt help. I would have issued the same instructions as Bob did. Nobody expects it to turn out this way. Please be reminded that we're all volunteers offering our time/effort to help you. We ask not for any monetary compensation but just some cooperation from you.
__________________
Question - what have you done for the community today? |
|
|
|
|
06-17-2006, 10:01 AM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,333
OS: N/A
|
Ruthy,
I would also require you to post the BSOD message you received. Besides "0x0000008E", there should be a whole bunch of other numbers & messages.
__________________
Question - what have you done for the community today? |
|
|
|
|
06-17-2006, 10:30 AM
|
#11 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
Ok thanks for your concerns. I do however feel that it was something which was deleted first time round - ie; one of the scans mentioned in tetonbob's first post. I could not undertake anything at all tetonbob's second post - as I said I kept getting the BSOD's. I regret I cannot give you the BSOD details either as, as I am saying now I cannot boot into anything - safe mode or windows. I keep getting a chkdsk request to run a check on f: - aborting this only means it wants to run again on the next boot and letting it run to "completion" results in the system freezing. I have even run chkdsk in the recovery console but it freezes at 75% on f:. I would say that my system is installed on a Promise Raid. C, D, E and F are all partions on the 2 disk Array RAID 0. What I need is a utility to stop chkdsk running on bot up - I have serached the ineternet but unless I can invoke regedt32.exe in a command prompt I am stuck. I cannot access the registry in windows 'cos I can't get there. Windows at the moment has undertaken the file copying process in a Repair Install but cannot continue reinstalling until this chkdsk thing goes away.
So sUBs - where do I go from here? It was tetonbob's recommendations which have caused matters to be worse - I followed his requests in his FIRST POST to the letter appart from the Panda Scan, which I explained was an online process and could not be undertaken due to the email sends. My first Repair install went fine and going online did not trigger the email sends - so that seems sorted now. However the minute the Microsofts Download Software wasdownloaded and the very instant that windows started to install, the BSOD appeared. This particular software is the software you have to install on the Update Site, in order to update your windows system - I hope you know what I am saying. After it has been installed you then can recheck for updates and download/install those. But the BSOD's keep returning the minute Windows has fully booted - usually 20/30 secs after the boot process has completed. But now I cannot boot into Windows because I am in the middle of a Repair Install and this cannot continue because of chkdsk. Please help me disable chkdsk running from a command prompt so I can continue with the Repair Install. I will need a purpose built boot disc methinks because Recovery Console does not recognise regedt32.exe or even regedit. Hoipe you can help a frustrated woman Ruth XX |
|
|
|
|
06-17-2006, 10:50 AM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,333
OS: N/A
|
Hang on for a moment Ruth. I getting some guys from the Hardware section to look at this. RAID is not one of my stronger points.
__________________
Question - what have you done for the community today? |
|
|
|
|
06-17-2006, 10:54 AM
|
#13 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,333
OS: N/A
|
Ruth,
This may help with stopping chkdsk. Please give it a try... http://support.microsoft.com/?kbid=160963
__________________
Question - what have you done for the community today? |
|
|
|
|
06-17-2006, 11:20 AM
|
#14 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
Thanks again sUBs - I have seen that article but first and foremost how do I run it? I cannot get into safe mode nor can the Recovery Console invoke it as it is not a valid command. I cannot download it to run from a floppy using the RC so what am I to do? As I said I need something I can run from the RC or a utility that can be invoked from a floppy
Ruth |
|
|
|
|
06-17-2006, 11:25 AM
|
#15 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,333
OS: N/A
|
Forgive me Ruth. I did not fully read the kb article. It requires access to the registry.
For the moment, let's wait for the hardware guys to give their input
__________________
Question - what have you done for the community today? |
|
|
|
|
06-17-2006, 11:28 AM
|
#17 (permalink) |
|
Manager, Design
|
Hmm, without being able to complete the chkdsk sequence you're kinda stuck.
But you knew that. :) I suggest installing a SECOND installation of Windows onto the HDD. This will give you a fresh install that you can use to recover/backup anything you want. If you'd like further details just let us know.
__________________
  ----------------------------- There are no dumb questions, unless a customer is asking them. Help in the fight against cancer and other serious illnesses. 
|
|
|
|
|
06-17-2006, 11:48 AM
|
#18 (permalink) |
|
Manager, Hardware Forums
Join Date: Jul 2004
Location: west australia
Posts: 56,194
OS: win 7 32x 64x rtm
|
being as chkdsk freezes,if raid was not involved would suspect a faulty drive
and would run the diognostic utility from the h/w manufacturer on the h/d's
__________________
|
|
|
|
|
06-17-2006, 12:02 PM
|
#19 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
Hi again thanks - this might help. But as with my second Repair Install, once setup has copied the files it needs to install the Second OS, will it reboot and run chkdsk again for f: ? If so I am back to square 1. What I need is somehow to stop chkdsk running. If you think a 2nd OS is the solution and somehow this will prevent chkdsk invoking please tell me quickly so I can sleep tonight.
Cheers Ruth |
|
|
|
|
06-17-2006, 12:12 PM
|
#20 (permalink) |
|
Registered User
Join Date: Jun 2006
Posts: 72
OS: XP Pro (SP2)
|
You see my RAID 0 has 2 disks, both of 160GB making 320 GB in all. This has been fromatted with 4 partitions: C:, D:, E: and F:. All have plenty of free space. I initially attempted to install a second copy of XP on f:, thinking that this may force the chkdsk problem away, but as you know Windows checks the partition you have selected for installation first and it froze at 37%. Strange this as in Recovery Console it freezes at 75% and letting it run naturally on reboot freezes it after so called completing but will not then launch windows, if you know what I'm saying. So my next attempt will be to load the second OS in E: - but I feel sure that this will reboot after completing the file copying and then chkdsk will be invoked again and will freeze.
Please guys, there must be a way to stop chkdsk running. I tthink I know what to do if I can change the registry but how can I do this if I can't get into it? Come on - a little more please? Ruth XXX |
|
|
|
| Thread Tools | |
|
|
