pc problems

[Filip.dahlberg]

okey thanx, sounds painful that with the teeth :S, well ok im heading to bed to. so hopefully we can solve this soon thanks

[evilfantasy]

Just to b esure, this is what you are seeing when you try to edit those keys?

Click the images to enlarge.



[attachment deleted by admin]

[Filip.dahlberg]

exactly that yes, however the `s` is a nasty little ´f` :S

[evilfantasy]

Go tto the first key Bits and post the contents of it here.

Go to [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]

Right click on Bits and choose Export and choose to save it to your desktop.

Right click on it and choose Open with > Notepad and copy/paste all of the text back here.

[Filip.dahlberg]

here it is:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,66,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Background Intelligent Transfer Service"
"DependOnService"=hex(7):52,00,70,00,63,00,73,00,73,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Överför filer i bakgrunden genom att använda ledig nätverksbandbredd. Om tjänsten stoppas kommer funktioner såsom Windows Update och MSN Explorer inte att automatiskt hämta program eller annan information. Om den här tjänsten inaktiveras kommer inga tjänster som uttryckligen beror på denna att kunna överföra filer om de inte har någon annan funktionalitet för att överföra filer direkt genom Internet Explorer om BITS har inaktiverats."
"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,68,e3,0c,\
  00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS\Parameters]
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  71,00,6d,00,67,00,72,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

btw, im swedish and im running a swedish windows xp. if u need any of the swedish translated just ask.

[evilfantasy]

Well I had an idea but that won't work.

How about logging in in Safe Mode under the Administrator account and trying to edit the key?

[Filip.dahlberg]

tried that

okey download of the tool worked better in IE , however it didnt help still cant edit the `f` to an `s` gives the same error message as described earlier. Even tried it in safemode

ps. dentist went well ?

[evilfantasy]

OK I'm back to waiting on a reply from someone else. I'm hoping that the people smarter than me figure something out for this because it is happening to a lot of computers.

[evilfantasy]

OK a fix has been released.

Use the following tool: http://users.telenet.be/marcvn/tools/WUS_Fix.exe

Just download and run it.

Let me know...

[Filip.dahlberg]

haha was writing the following:

^^ okey, really seems to be a big problem then...lucky me :S.  well hopefully we find a solution in the end. at the moment the computer seems to be running at least; reasonably. insecure but more stable than before. So i guess you will get back to me if you find something?

seems we make another attempt then.

Edit:
okey ran the fix, opened a cmd window fast, couldnt read it. then it closed. i opened regedit and attempted to change a value, didnt work. restarted the pc. and attempted again. nothing seems to have been changed. maybe try it in safe mode?

question: Is this a single problem caused by a virus/malware/trojan or something? and if so is it possible that it can be infecting other parts of the computer as we speak? if so is it possible to detect this? avast hasnt picked up anything on scans so far.

[evilfantasy]

I'm not sure what is going on. You are the only one that these fixes have not worked for.

Try running the fix on the new account you created.

[Filip.dahlberg]

tried it in the new account and in safemode, neither worked... the error i get is that it fails to write the new value. it then changes the value on screen like in the window, but if i restart regedit then the `f` is back

how do i know that the fix has done anything?

[evilfantasy]

What it does is repair the permissions problem and should automatically fix the f to s so I'm puzzled as to why it isn't working on your computer.

Let's run another scanner. This will take a while to finish but should find anything that might be hiding.

Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start
  
• An information notice will appear, click OK.
  
• This starts a short scan that will scan the files currently running in memory.
• If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
  
• If or when something is found, click the Yes button when it asks you if you want to cure it.

• Once the short scan has finished, Click Settings > Change Settings
  
• Under the Scanning tab UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
  
• Click Yes to all if it asks if you want to cure/move any file(s).
  
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

* After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
* Copy and paste that log in the next reply

[Filip.dahlberg]

okay, done. That was a long wait for a very short log

RegUBP2b-Filip.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.;

[evilfantasy]

That wasn't anything new.

I'm running out of ideas again. You can try this.

Avira AntiVir Rescue System

* Download the Avira AntiVir Rescue System
* Place a blank CD in your burner and double-click on the downloaded file.
* The program will automatically burn the CD for you.
* Place the burned CD into the affected computer and start the computer with the CD in the CD tray.
* On the bottom left side of the screen there are 2 flags.  Using your mouse click on the British flag to use English.
* Click on the Configuration button.

- Select Scan all files
- Select Try to repair infected files and Rename files, if they cannot be removed
- Select Scan for dialers
- Select Scan for joke programs (Jokes)
- Select Scan for games
- Select Scan for spyware (SPR)

* Click on Virus scanner
* Click on Start scanner at the bottom of the screen

Currently the program does not support saving a log. Please write down the list of items for Records, Suspect files, and Warnings then post them back here.