[sam-my]

I've just posted an issue with CPU overheat in another thread (http://www.geekstogo...es-t128529.html) and remarked that may PC cannot strat in Safe Mode.
After clicking on Restart and then on F8, I get the standard screen with the command :
"Please Select an Option
Safe Mode
Safe Mode With Networking......"

Clicking on "Safe Mode", I get the screen:
"Select the Operating System to Start:
Microsoft Windows XP Professional"

clicking on "Enter" I get a full list of Drivers in the following format:
multi(0)disk(0)rdisk(0)PARTITION(1)\WINDOWS\SYSTEM32\DRIVERS. XXXXXX
i.e. a full screen with similar line/comment above but with all different Driver names (XXXX)
and at the lower side of this screen the comment: "Press ESC to cancel loading SPTD sys"
After 2-3 seconds the PC reboot in the normal mode (either pressing on ESC or not).

1. Are these two issues (this one and the above one) related
2. How to correct this one

Thanks for your assistance.

[Advertisements]

I checked this morning my System Restore where I made previously some saves (the last one three weeks ago).
I coudn"t open the System Restore but got only this window:
"System Restore is not able to protect your Computer.Please restart your computer and then run System restore again". i.e. all what I saved were lost.

I ran the chkdsk /r /x test. The test ended with no comment.
I ran the test sfc /scannow. the test started normally with the window and the blue "progress Bar".
But after approx 5 minutes the test seemed to freeze and I got a window :
Files that are required for Windows to run properly must be copied to the DLL cache.
<<RETRY>> <<MORE INFORMATION>> <<CANCEL>>
I clicked on the button RETRY, and the test progressed from the point where it stopped (progress of the blue Bar).
Every 5 minutes I got the same window, and clicking on "RETRY" allow the test to progress.
At the end this test was performed with no comment.

Is my OS corrupted??
Any suggestion how to correct it?

Thanks

[sam-my]

I checked this morning my System Restore where I made previously some saves (the last one three weeks ago).
I coudn"t open the System Restore but got only this window:
"System Restore is not able to protect your Computer.Please restart your computer and then run System restore again". i.e. all what I saved were lost.

I ran the chkdsk /r /x test. The test ended with no comment.
I ran the test sfc /scannow. the test started normally with the window and the blue "progress Bar".
But after approx 5 minutes the test seemed to freeze and I got a window :
Files that are required for Windows to run properly must be copied to the DLL cache.
<<RETRY>> <<MORE INFORMATION>> <<CANCEL>>
I clicked on the button RETRY, and the test progressed from the point where it stopped (progress of the blue Bar).
Every 5 minutes I got the same window, and clicking on "RETRY" allow the test to progress.
At the end this test was performed with no comment.

Is my OS corrupted??
Any suggestion how to correct it?

Thanks

[dsenette]

I ran the chkdsk /r /x test. The test ended with no comment.
I ran the test sfc /scannow. the test started normally with the window and the blue "progress Bar".
But after approx 5 minutes the test seemed to freeze and I got a window :
Files that are required for Windows to run properly must be copied to the DLL cache.
<<RETRY>> <<MORE INFORMATION>> <<CANCEL>>
I clicked on the button RETRY, and the test progressed from the point where it stopped (progress of the blue Bar).
Every 5 minutes I got the same window, and clicking on "RETRY" allow the test to progress.
At the end this test was performed with no comment.

sfc scan to actually be effective..you've got to have your XP disk in the computer....otherwise it doesn't have a clean source to replace the corrupted files from

SPTD sys

is a part of daemon tools...do you have daemon tools installed?

[sam-my]

Thanks a lot dsenette for your prompt answer.
1. When I ran sfc test, the XP disk was in the PC
2. I checked and found Daemon Tools installed in the C:\Program Files
(my kids are using it).
3. In the mean time I have done some survey to check wich programs/changes have been made during the last two weeks. I checked also the Quarantines of the installed security software, and found out in the Ewido Quarantine Files the following:
C:\WINDOWS\system32\mscomserv.exe -------- Trojan.Agent.ye ------- High

I checked in the "C:\WINDOWS\system32" and found out that this file is missing (since moved to the Quarantine).
There is only the BIN File mscomserv.
I suppose that one of my kids ran the Ewiso scanner (what they generally used to do after playing games, ICQ...) and sent the findings to qurantine.
I tried to find this file on the installation disk (to copy it to the OS) but with no success. The files on the disk are "presented" differently then on the C drive.

1. Do you think that may be the source of this issue?
2. Is it possible to copy the missing file from another PC (with same OS) and paste it on mine.

[Retired Tech]

Troj/Zlob-RF is a Trojan for the Windows platform.

When run, the Trojan installs and runs an application named "MSN Content Installer 4 Free".

The Trojan creates a file <System>\mscomserv.exe and this file is detected as Troj/DDoS-M.

The Trojan also creates a file <System>\mscomserv.bin and this file can be removed safely.

The file <System>\mscomserv.exe is registered as a Service under the Service name of "MS Common Service"

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

[sam-my]

Many Thanks Keith for your full explanations.
I discarded the file mscomserv.bin.
I performed full scan using all the available software "as possible" (since I already mentioned that I have a problem of CPU overheat ).
Full scan using Ewido, Spysweeper and Windows Defender. No findings.
Full scan using Nod32 and A2 (free) - No findings
Full scan using SpyBot - One finding "Fake.Wget" ? What I have to do? to remove it?
Cleaning the system using Ccleaner and Ace.
Downloaded HJ this and posted the log as you advise me to do.

hope this will help
Thanks a lot.

[Retired Tech]

Hope it goes well

[Retired Tech]

This will tell you the temperatures, if all are high then maybe the fans are clogged up or not as effiecient as they were

Download and install Everest Home Edition

Run the programme, click + next to computer then sensor

Look on the right for temperatures

Post them if you want an opinion from someone

[sam-my]

Hello Keith
I am always working with Everest (sensor) open showing constantly the temperatures on the
System tray for constant follow up.
As I already mentioned I am working with my PC left side panel open (removed) and a home fan (12 inches) pushing air thru the open side.
The attached picture shows the temp at rest i.e. right now as I am writing this thread.
as soon as I am clicking on some program (Ewido, Nod32, Spysweeper...) and their window is appearing,
then the CPU temperature is immediately jumping to 54-55 C. during the scan process it can reach 66-69 C.
If the scanning process is long enough then the PC freezes.

I am planing to remove the CPU for cleaning and re-applying thermal compound. I just bought it today (Arctic Silver). I have done it 6 months ago.(I hope I am doing it correctly).  Everest_5.bmp   193.93KB   328 downloads

[sam-my]

I was still working on my PC when it shut-down (black screen).
After restart I got the standard windows with the "The system has recovered from a serious error."
I open the link mentioned in this window and found the following:
Manifest-Notepad

Server=watson.microsoft.com
UI LCID=1033
Flags=1696080
Brand=WINDOWS
TitleName=Microsoft Windows
DigPidRegPath=HKLM\Software\Microsoft\Windows NT\CurrentVersion\DigitalProductId
ErrorText=A log of this error has been created.
HeaderText=The system has recovered from a serious error.
Stage2URL=
Stage2URL=/dw/bluetwo.asp?BCCode=1000008e&BCP1=C000001D&BCP2=BF8266D6&BCP3=F3449B7C&BCP4=00000000&OSVer=5_1_2600&SP=2_0&Product=256_1
DataFiles=C:\DOCUME~1\SAMY\LOCALS~1\Temp\WERa73c.dir00\Mini090206-01.dmp|C:\DOCUME~1\SAMY\LOCALS~1\Temp\WERa73c.dir00\sysdata.xml
ErrorSubPath=blue
DirectoryDelete=C:\DOCUME~1\SAMY\LOCALS~1\Temp\WERa73c.dir00

What this means??

[Retired Tech]

With the power off, check the whole thing for dust, if you use compressed air then hold the fan blades as the air can make the fans spin beyond their limits

If it jumps 10 degrees when you run something it needs checking for dust

At 60 C most machines will warn or shutdown, once you get the temperatures down it should stop blue screening

[sam-my]

Hello Keith

1. I've got an answer from the Malware Forum
[http://www.geekstogo...e-t128949.html}
They found two viruses :
Virus:Trj/Agent.CMS --- C:\WINDOWS\system32\server.exe
Virus:W32/Gaobot.NVM.worm ------ C:\WINDOWS\system32\vs2sms32.exe

2. After cleaning both viruses, i tried a second on-line scan using the same program (Panda) as requested by Sari (Moderator). The scanning started well but after a while became terribly sluggish when it was checking the Spysweeper files. It checked these files for more than 20 minutes. The CPU temp became then very high and the PC freezed. I noted these files. there were C:\Program Files\Spysweeper\XXX.tmp and C:\Program Files\Spysweeper\Quarantine.
I run Ace (to delete Junk Files) and was surprised to find more than 110,000 files of both type above. In the Spysweeper Start-Up menu I found also three boxes (ticked) with a program called "Startkey" and C:\WINDOWS\system32\server.exe
I uninstall Spysweeper and ran Ad-Aware and Panda. It seems that the viruses have corrupted Spysweeper files.
I am attaching here the last scan from Panda.I would like to ask
- How to delete the Adware:adware/wupd from Windows Registry (Ad Aware is not finding it)
- What the files C:\RECYCLER\S-1-5-21-1960408961-... and C:\Temp\RECYCLER\S-1-5-21-1960408961-1957994 are for? All the deleted cookies are there.
- How to clean these files.

3. Two days ago, I cleaned the PC (from dust) and apply thermal grease (Arctic) to the PCU. I also added a 12 centimeter fan to the PC box side to push more air inside the box. This have brought some improvement.
Now at rest or when working with the net (like now writing this thres) the CPU temp is 43C and when performing a PC scan the temp is most of the time 55-58C with some temporary picks at 62C
It is not perfect, but that the best I could obtain.
It seems (sensation) that after removing these viruses the PC temp are more stable.

Now I have to check the other issues: Why the PC does not start in Safe Mode?
Thanks for your assitance

Attached Files

•  Activescan4.txt   5.04KB   188 downloads

[Retired Tech]

Click start then run, type cookies then press enter, click edit then select all, right click any file, click delete, confirm

Run this and let me know how it is then

Items in blue which are underlined are clickable to give more information about the process

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete

Click start, all programmes, accessories, system tools to run disc clean up, then from system tools, run disc defragmenter.

Click start then run, type sfc /scannow then press enter, you need the XP CD

Windows File Protection will show a blue onscreen progress bar, when the bar goes, reboot

If you do not have an XP CD you can borrow a same version as was originally installed XP CD, if you downloaded SP2 then you need an SP1 XP CD

If you do not have an XP CD and are unable to borrow one, run the scan, click skip if it asks for the CD, if it keeps asking, click cancel.

If it kept asking for the XP CD then system files are missing

Click start then run, type chkdsk /f /r then press enter, type Y to confirm for next boot, press enter then reboot.

Windows will appear to load normally then either the monitor will show progress or the screen will go blank, do not disturb this.

This will take an hour or so before it gets to the desktop.

Download and install Tune Up 2006 Trial

Run Tune Up Disc Clean Up

Run Tune Up Registry Clean Up

Click Optimize and Improve to run Reg Defrag, which will take a few minutes and need a reboot. You should disable the antivirus programme to run this and check it is running after the reboot

After the reboot, click optimize then system optimizer to optimize the computer, select computer with an internet connection from the drop down menu, this also requires a reboot

After the reboot, click optimize then system optimizer to accelerate downloads, select the speed just above your actual connection speed, this requires a reboot

After the reboot, click optimize then system optimizer to run system advisor

[sam-my]

Thanks for your support

1. I downloaded ATF Cleaner and ran it

2. I ran also TuneUp as advised

3. Ran also chkdsk /f /r

4. But.. when I started running sfc /scannow I got the following issue:
- At the begining the process went smooth, then after 4 minutes a window poped out requesting to insert the Cd (eventhough the CD was installed)
- I clicked on the 'Retry" box and the scaning moved on for some 4-5 minutes when I got again this window
- This window poped out 10 times until the end of the process.
- The process ended with no comment/remark
I opened the Event Viewer (System) and couln't see anything there .

My System Restore is disabled and I can't boot in Safe Mode.
As I mentioned in the thread #1 above, when I boot in S.M. I get a screen full of
multi(0)disk(0)rdisk(0)PARTITION(1)\WINDOWS\SYSTEM32\DRIVERS. XXXXXX
with all different Drivers.
Is this means that all the OS driver files are corrupted?

Thanks for your time and assitance

[Retired Tech]

You can use this guide to repair XP

Possibly, you will need to press the start button and keep tapping the delete key, (possibly F2) until the PC enters set up. Change the boot order to CD ROM Drive then hard drive, press F10 then press enter, load the XP CD then type Y then press enter, as it reboots, look for press any key to load from CD, press enter

You will need your XP product key to complete this

The XP Product Key is a 25 character alpha numerical code, which does not include the sequence OEM

If you have audio / video files which are subject to DRM you should check with the provider for known issues with performing an XP repair install

Click this to view the XP Repair Install Guide

Windows XP repair feature won't delete your data, installed programs, personal information, or settings. It just repairs the operating system

The XP repair install will look and run as a normal install, however, you must not see a request to format the drive

After running XP Repair you will need to install all Windows Updates

Microsoft Update