[lonelyboy]

Heya all,

'm having a problem after clicking an exe I knew was suspicious but I never had problems removing stuff before..so I guess this is my way to learn it the hard way

The minute I double clicked this exe I start getting popups from the windows toolbar with so called system warnings and got redirections to webpages with anti-virus software that would solve my problem.. yeah right.
It also got my desktop swapped to black with a message Warning! Spyware detected.. so I immediately used Spybot-Search & Destroy to try handle the problem. Some threats were handled but the symptons were still there so used PC Tools Antivirus and ThreatFire.. still the problems remain.

I also noticed I didn't have full acces when I wanted to use the Task Manager, a message with somthing like " Taskmaster has been disabled by your administrator" appeared.
When I wanted to use System Restore (this was after one of the reboots) I couldn't go back in time; the earliest date was that days date.
When trying to remove the black Desktop with message I could change the color but another message appeared, this time in the centre of the DT "Warning! Spyware Detected On Your Computer! Install Antivirus Or Spyware Remover To Clean Your Computer" This in a blue and yellow recangle.

So I decided to try anoter virus remover and downloaded Doctor Web at Download.com, that found a really long list of infected files, even mp3's and pictures among them, some were cured others deleted or quarantained. Then the program asked to reboot... and here the real problem just got started

At first the start up procedure looks ok but at the point where u get the "Welcome" and u should login a message says
"userinit.exe application error The application failed to initialize properly (0xc0000005). Click OK to terminate the application." This message appears twice and underneath we have the lovely blue yellow Warning I spoke about above.When trying to use the Task manager I get same message.. (disabled by yr admin..) So now it come down to the fact I JUST CAN'T ACCES MY PC Grrrrrrrrrrr

Well, I don't give up that easy and after some googling I found an antivirus app u can use from a bootable disk, this Kaspersky Anti-Virus ISO emergency disk runs on DR-DOS and scans like every other anti-virus app. Indeed it found a few other threats but after normal restart all stays the same.. so 'm stuck at this point and really could use some help! *snif*

Safe Mode doesn't let me acces eighter..

hmm another thing I forgot to say is that a minute or 20 after I try to login and I let it, Windows try to reboot itself and then I get a blue stop error screen (with alot of txt on it, so if someone thinks it's necessary that I write down here what it all say let me know) It starts with "A problem has been detected and windows has been shut down to prevent damage to your computer."


I hope someone can help me out because I have lot of data I don't want to loose by formatting (yeah yeah backup hehe, we all need to learn by experience it seems)

LonelyBoy

[Advertisements]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[Rorschach112]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[lonelyboy]

okies sorry for posting here...
but hmmm if u read my topic I CAN'T Login so how can I run Hijack?

[Rorschach112]

Sorry about that, the bright colours threw me off

Somebody will help you here to get you back into your PC, then you will need to head over to the malware removal forum

[Artellos]

Hello there lonelyboy,

I'll try to help you get back into your PC.
But please tell me once you get in, because I am not allowed to help what-so-ever regarding Malware issues.

First off, can you write down the error code on the blue screen?
If the blue screen disappears too fast, please press the "Pause / Break" Key on your keyboard to pause the screen.

Regards,
Olrik

[lonelyboy]

Text in blue screen goes like this:

A problem has been detected and windows has been shut down to prevent damage to your computer.

MAXIMUM_WAIT_OBJECTS_EXCEEDED (this info differs ervey time)

If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure that new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.
If problems continue, disable or remove any newly installed hardware or software. Disable BIOS Memory Options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.

Technical information:

***STOP: 0xOOOOOO1E (0xOOOOOOO0,0x..and other error codes that also are different every time f.e.
0x00000008

*** hal.dll (this info is different every time)

Restarting..

here a few more messages/codes.. that appear under the first sentence..

IRQL_NOT _LESS_OR_EQUAL
NO_MORE_IRP_STACK_LOCATIONS
KMODE_EXCEPTION_NOT_HANDLED
PANIC_STACK_SWITCH
BAD_POOL_HEADER
BOGUS_DRIVER
PAGE_DEFAULT_IN_NONPAGE_AREA
UNEXPECTED_KERNEL_MODE_TRAP

If it's necessary 'll try to figure out wich differnt code screens ll get .. 've notice 8 different oneces so far

thanks for fast replies dudes!!

Lonelyboy

[Artellos]

Wow.. that is quite a list of errors.
I would like you to follow the repair install instructions here in the stickied thread by admin.
http://www.geekstogo...ws-XP-t138.html

Tell me if you can get in after doing a repair install of windows.
(Malware people, updates WILL need to be re-done!)

Regards,
Olrik

[lonelyboy]

ok.. My problem at the moment then is to get hold of a XP CD, since I didn't get one with the purchase of this Acer Aspire.. Is that legal?

[The Skeptic]

Try to boot in Safe Mode with Networking. If you succeed to get to the login screen try to log as Administrator. If successful post in the malware forum. The guys there may be able to run some tools that can be downloaded and run in safe mode.

[Artellos]

Safe Mode doesn't let me acces eighter..

I don't believe that'll work The Skeptic.

Regards,
Olrik

[The Skeptic]

I agree. But it's so easy to try.

[Artellos]

I can do nothing but agree on that.
Give it a try, it won't hurt.
I do think a repair install will fix it though.

Regards,
Olrik

[lonelyboy]

indeed, no Safe Mode works at this point not with prompt nothing
Used Kaspersky bootable, now tryinbg that Bart bootable from Avast.. have to do something lol till get I get my hand on a XP CD

'll keep u guys posted
thx for the replies

[lonelyboy]

Heya guys!!

MAYOR BREAKTHROUGH
Like I said above I was going to use the BART bootable Rescue Disk from Avast.. well Superb Tool!! It let me get back onto my pc after virus scan and cleaning registery. Then I followed your Geeks Malware guide since there still were signs from infections.. The only thing that remained was a RUNDLL error ar startup wich I could delete with CCleaner..

Yay mission accomplished I thought.. still some wierd after affects are bugging me now..
I don't have sound(bar) anymore, when I try to load the soundicon (in y'r right bottom corner) through control panel - Realtek Sound Effect Manager; it appaers there but when i click it, a message with "There are no active mixer devices available, To install mixer devices, go to control panel...add hardware blabla

When I check Device Manager - Sound, Video and Game Controllers - Realtek High Definition Audio (properties) I found Mixer Devices (properties) it says status: Driver is enabled but has not been started !? and a moment later it says is enabled and is functioning properly!?

Anybody some thoughts?
Oh yes, I guess I don't need to be in this section anymore can u tell me how to relocate this posts?

thx for the efforts
LonelyBoy

[Artellos]

first off, let me warn you.

cleaning registery

This is not a good thing
If you don't know what you should be doing with the registry, then leave it alone

I don't believe you tried a repair install, did you? (just checking)
Try to remove the drivers and re-install them.

Regards,
Olrik