An oddity. Customers system had reasonable load of malware -
Adware CamNotifier
Adware MovieLand/Mediapipe
Adware MyWebSearchFunweb
Browser Hijacker.Favorites
Malware AntiVermins
Malware DriveCleaner
MAlware SystemDoctor
Trojan Agent/Gen
Trojan Agent/Gen-SDRA
Trojan Media-Codec
Trojan Zlob Variant
All cleaned out as far as I can see. No odd running processes visible using Process Explorer, system files verify. Still a hook in there somewhere. Task manager, msconfig run OK, but start - run - regedit kills explorer. When the desktop icons reappear they are set to auto arrange and the WIndows media player toolbar item is ticked. If regedit is run from a command prompt, it just kills off the prompt, not affecting the desktop. Copy regedit to say task.com and it runs happily. Again, no oddities in the run locations. I will format it if nothing comes of this, not a major issue, I am just really curious as to what this might be. Just now as I am typing it has blue screened with KERNEL_STACK_INPAGE_ERROR.
Thanks
Chris B
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
well a couple of possiblities :
-do a fresh install (the surest; but maybe not what you want)
-run sfc /scannow from the run box, or a repair install, to fix OS files
since your disk drive is not found; test it with the proper diag from the ubcd : http://www.ultimatebootcd.
and while you're at it, run a ram test too ! (memtest86+)
Hi Nobus
I will certainly format it if no resolution. OS came straight back after a power off restart. Fixboot succeeds, but fixmbr comes back with this computer appears to have a non standard or invalid master boot record. This persists after several runs. I will try some disk diagnostics. I have already run a repair install, no change. Replaced RAM, no change.
Chris B
Maybe something is lurking in there still. Running Gmer should detect a boot sector viruses... Combofix also detect them.
Try running these tools. If the tool won't run just redownload and rename before saving the file to your desktop.
And show us the logs.
1. Download Malwarebytes' Anti-Malware to your desktop, check for the tool's Updates before running a scan.
http://www.malwarebyt
2. Please download ComboFix by sUBs:
http://download.bleep
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepin
Sorry for the delay in responding. rpggamergirl was right on the money with Combofix, corrected the regedit issue straight away. Malwarebytes found a couple of references, but they appeared to be items which had already been killed off. In the past I have mostly cleaned manually or given up and formatted, but this has been a very informative exercise. Thanks to Nobus and kyleb84 also, but I had pretty much covered those ideas already. Combofix log attached as requested.
Chris B
Business Accounts
Answer for Membership
by: burrcmPosted on 2009-11-04 at 03:47:05ID: 25738341
When it rebooted after the dump the message was operating system not found on hard drive. Now looking more like boot sector. Power off reboot and XP is back. Now booting to CD to run fixboot/fixmbr.
Chris B