pc problems

[Filip.dahlberg]

i have let that run over night..but it doesnt seem to have worked, it has been stuck at `initializing please wait` at the same spot all the time...

[evilfantasy]

That's odd.

Download Rooter.exe to your desktop

* Double click Rooter.exe to start the tool.
* A DOS window will appear and show the scan progress.
* Once complete a notepad file containing the report will open.
* Copy & paste the results in your next reply.
* Close notepad and Rooter will close.

A log will also save at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have Windows installed).

[Filip.dahlberg]

that worked:

Microsoft Windows XP Home Edition (5.1.2600) Service Pack 3

A:\ [Removable] (Total:0 Mo/Free:0 Mo)
C:\ [Fixed] - NTFS - (Total:35291 Mo/Free:490 Mo)
D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
F:\ [Fixed] - NTFS - (Total:190771 Mo/Free:840 Mo)
G:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
H:\ [Fixed] - NTFS - (Total:476938 Mo/Free:3375 Mo)

2009-04-09|15:27

----------------------\\  Processes..

--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\Program\Alwil Software\Avast4\aswUpdSv.exe
---------- C:\Program\Alwil Software\Avast4\ashServ.exe
---------- C:\WINDOWS\Explorer.EXE
---------- C:\Program\ASUS\Ai Booster\OverClk.exe
---------- C:\Program\Analog Devices\Core\smax4pnp.exe
---------- C:\Program\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
---------- C:\Program\ASUS\Ai Nap\AiNap.exe
---------- C:\WINDOWS\system32\RUNDLL32.EXE
---------- C:\Program\ALWILS~1\Avast4\ashDisp.exe
---------- C:\Program\Java\jre6\bin\jusched.exe
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program\Windows Live\Messenger\msnmsgr.exe
---------- C:\WINDOWS\system32\spoolsv.exe
---------- C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
---------- C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
---------- C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
---------- C:\Program\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
---------- C:\Program\Java\jre6\bin\jqs.exe
---------- C:\WINDOWS\system32\nvsvc32.exe
---------- C:\WINDOWS\system32\PnkBstrA.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\UAService7.exe
---------- C:\Program\Alwil Software\Avast4\ashMaiSv.exe
---------- C:\Program\Alwil Software\Avast4\ashWebSv.exe
---------- C:\WINDOWS\System32\alg.exe
---------- C:\Program\Windows Live\Contacts\wlcomm.exe
---------- C:\Program\Mozilla Firefox\firefox.exe
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Rooter$\RK.exe

----------------------\\  Search..

----------------------\\  ROOTKIT !!



1 - "C:\Rooter$\Rooter_1.txt" - 2009-04-09|15:27

----------------------\\  Scan completed at 15:27

[evilfantasy]

OK lets try something please.


* Download and run the following file to repair file and registry permissions: fixacl.exe

Download FixPolicies.exe by Bill Castner

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.

* Note: Some malware will block the running of this tool. So if you cannot run Fixpolicies, then, rename the exe file to something like fixtool.exe and then run it.

----------

You may want to print this out for reference or copy it into a Notepad file then save it to your Desktop. Internet Explorer needs to be closed.

1. Close all instances of Internet Explorer.

2. Click Start > Run then type REGSVR32 ATL.DLL in the open box and click OK

Note: There is a space between REGSVR32 and ATL.DLL

3. Do the same with each of the below. (one at a time, note the space after REGSERV32)

• REGSVR32 MSXML3.DLL
• REGSVR32 WUAPI.DLL
• REGSVR32 WUAUENG.DLL
• REGSVR32 WUAUENG1.DLL
• REGSVR32 WUPS2.DLL
• REGSVR32 WUCLTUI.DLL
• REGSVR32 WUPS.DLL
• REGSVR32 WUWEB.DLL
• REGSVR32 QMGR.DLL
• REGSVR32 QMGRPRXY.DLL
• REGSVR32 JSCRIPT.DLL

.
Restart the computer when complete.

Try running Windows Updates again.

Let me know...

[Filip.dahlberg]

that had an interesting effect, it partly worked, when entering the windows update site through control panel i can now perform the search for updates without a problem(this was not possible before)  and so i can see which updates that are missing; which are the following:(7 updates needed)

 
Windows-verktyget Borttagning av skadlig programvara - mars 2009 (KB890830)
Hämtningsstorlek: 11.2 MB , mindre än 1 minut
 
Säkerhetsuppdatering för Windows XP (KB958690)
Typisk hämtningsstorlek: 613 kB , mindre än 1 minut

Uppdatering för Windows XP (KB959772)
Hämtningsstorlek: 5.5 MB , mindre än 1 minut
 
Säkerhetsuppdatering för Windows XP (KB960225)
Typisk hämtningsstorlek: 259 kB , mindre än 1 minut
 
Uppdateringspaket för Microsoft .NET Framework 3.5 Service Pack 1 och .NET Framework 3.5 (KB951847) x86
Hämtningsstorlek: 284.1 MB , 15 minuter
 
Säkerhetsuppdatering för Internet Explorer 6 för Windows XP (960714)
Hämtningsstorlek: 1.8 MB , mindre än 1 minut

Kumulativ säkerhetsuppdatering för Internet Explorer 6 för Windows XP (KB958215)


however when attempting to install/download it fails. i can also access my update history which seems to have been failing for sometime. some 21 failures.

edit: i get the following error code Felkod: 0x80246008 for each one

[evilfantasy]

edit: i get the following error code Felkod: 0x80246008 for each one

Yes that's helpful and what I was looking for, only not in a good way. This is a new problem that to this point has not been sorted out yet.

Please try this.

Go into your user account setting in Control Panel and create a new user account. Log onto the new account and try to run the updates again.

[Filip.dahlberg]

i created a second admin account, logged into it(i am logged into it atm) and went into control panel and pressed windows update. However with no result..it doesnt load the page

[evilfantasy]

This article is a bit more involved than the last one but at this point is what needs to be attempted from the old account, not the new one. http://support.microsoft.com/kb/910337

[Filip.dahlberg]

i try starting the `bits` through services manually but i receive the error message nr 2: `could not find the file` and reading through the document from microsoft i cant seem to find what to do

[evilfantasy]

I expected as much.

Download  & extract this file to it's own folder - Registry Search

Launch Registry Search
In the search box, enter:

fystemroot

Then click OK

Notepad will open with some text in it (the file will also be saved in the program's folder as well).

Post this text in your next reply

[Filip.dahlberg]

here it is, just a comment: *censored* there are a lot of these little small tools to use and get logs xD

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0

; Results at 2009-04-09 20:08:02 for strings:
;  'fystemroot'
; Strings excluded from search:
;  (None)
; Search in:
; Registry Keys  Registry Values  Registry Data 
; HKEY_LOCAL_MACHINE  HKEY_USERS 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]
; Contents of value:
;   %fystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,66,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv]
; Contents of value:
;   %fystemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,66,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BITS]
; Contents of value:
;   %fystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,66,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\BITS]
; Contents of value:
;   %fystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,66,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
; Contents of value:
;   %fystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,66,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

; End Of The Log...

[evilfantasy]

*censored* there are a lot of these little small tools to use and get logs xD

We wouldn't be able to do this without some brilliant malware fighters out there

OK are you familiar with editing the registry?

[Filip.dahlberg]

resonably familiar with regedit, not an expert tho

[evilfantasy]

OK I will outline the problem here.

Under each key there is a line that looks like this.

%fystemRoot%\System32\svchost.exe -k netsvcs

I highlighted in red the f and that is the problem. You need to change each f to an s to repair this. So it should read systemROOT and not fystemROOT.

[evilfantasy]

P.S. I'm off to the dentist and will return later.