[hayan453]

I get a bluescreen with this message everytime i start my computer.. right after the boot screen.. then it goes to the login screen like normal.. i was at the malware hijackthis thread and had help cleaning my computer but i still get this message... any help would be greatly appreciated... greatly!

[Advertisements]

Hello hayan453...

There are a number of things that can cause this issue, so let's have a quick look around and see if we can find the culprit that's causing the problem.

Do you have Spyware Doctor and/or ZoneAlarm installed?

Click Start, then Run, type system32 and click "Ok". The System32 folder should open...see if the autochk.exe application is present. (If you get a screen that tells you that this is a hidden file, click the link on the left under system tasks to "Show the contents of this folder"...then check for the autochk application.) Is the application present in the System32 folder?

The click Start, then Run, type regedit and click "Ok". Registry Editor will open. In the left pane, expand (click +) HKEY_LOCAL_MACHINE, then System, then CurrentControlSet, then Control, and click on Session Manager. In the right pane, locate the entry for "BootExecute"...what is the value listed under the Data column for this entry?

Collapse (click -) those keys and expand HKEY_LOCAL_MACHINE, then System, then CurrentControlSet001, then Control, and click on Session Manager. In the right pane, locate the entry for "BootExecute"...what is the value listed under the Data column for this entry?

wannabe1

[wannabe1]

Hello hayan453...

There are a number of things that can cause this issue, so let's have a quick look around and see if we can find the culprit that's causing the problem.

Do you have Spyware Doctor and/or ZoneAlarm installed?

Click Start, then Run, type system32 and click "Ok". The System32 folder should open...see if the autochk.exe application is present. (If you get a screen that tells you that this is a hidden file, click the link on the left under system tasks to "Show the contents of this folder"...then check for the autochk application.) Is the application present in the System32 folder?

The click Start, then Run, type regedit and click "Ok". Registry Editor will open. In the left pane, expand (click +) HKEY_LOCAL_MACHINE, then System, then CurrentControlSet, then Control, and click on Session Manager. In the right pane, locate the entry for "BootExecute"...what is the value listed under the Data column for this entry?

Collapse (click -) those keys and expand HKEY_LOCAL_MACHINE, then System, then CurrentControlSet001, then Control, and click on Session Manager. In the right pane, locate the entry for "BootExecute"...what is the value listed under the Data column for this entry?

wannabe1

[hayan453]

Thanks for your quick reply and for taking the time to help me out.. i do have zonealarm installed and running.. i also have ad-aware, superantispyware, and malwarebytes anti-malware.. i check the system folder and i found autochk, not autochk.exe.. is this the same thing? and the data values for the bootexecute were autocheck autoc (after autoc there were some weird characters) The data values were the same for both except the weird characters after the word autoc.. i hope this helps.. i can try to describe the characters if you need.. thanks again

[wannabe1]

Open Control Panel and double click on the "Folder Options" icon. In the Folder Options window, click on the "Views" tab...in the list, locate "Hide extensions for known file types" and remove the tick from the box next to it.......Apply the change. Now look in the System32 folder and see if Autochk.exe is there. I'm betting it's the same one you mentioned.

Let's revisit the registry.

Open Registry Editor and expand (click +) HKEY_LOCAL_MACHINE, then System, then CurrentControlSet, then Control, and click on Session Manager. Right click on Session Manager and choose "Export". Name this file SesMan and save it to your desktop. Then, in the right pane, double click on BootExecute...a properties window will open. Change the value in the Value Data field to autocheck autochk * (note the spaces)...click "Ok".

Now expand HKEY_LOCAL_MACHINE, then System, then CurrentControlSet001, then Control, and click on Session Manager. Right click on Session Manager and choose "Export". Name this file SesMan001 and save it to your desktop. Then, in the right pane, double click on BootExecute and change the value in the Value Data field to autocheck autochk * (note the spaces)...click "Ok".

Collapse (click -) all the expanded keys and close Registry Editor (and all other open windows).

Reboot and see if the error presents itself.

[hayan453]

Thanks the blue screen and message went away can i delete the stuff on my desktop now?

Edited by hayan453, 12 October 2008 - 11:17 PM.

[hayan453]

just curious.. my internet is running slow and the packets are around 1000 sent 500 recieved any ideas what that would be? sorry i know this is pushing it cause you already helped me with the other problem.. dont wanna sound greedy but im desperate haha

Edited by hayan453, 12 October 2008 - 11:29 PM.

[wannabe1]

I'm glad that's taken care of... Yes...you can delete the two files you saved to your desktop.

I think the next step should be another visit to the Malware Forum. Something changed the BootExecute value in the registry...something malware is very capable of doing. Malware can also cause problems with your internet connection and when you're sending twice as much information as you are receiving...well that just makes a guy suspicious. Just have them check it to see if something may have been missed or regenerated.

Let's let the experts have a look under the hood. Please go to the Malware Forum and follow the instructions you'll find there.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- post a hijackthis log in THAT forum. Do Not reply to or "bump" your own topic...if it shows a reply, it may be overlooked as one that is being worked on.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[hayan453]

I came from the other forum and was given a clean bill of health and told to come here.. are you saying i should go back there again because of what we did here? i forgot if i mentioned that i was there first..

[wannabe1]

I'm just concerned about the change made to the registry...particularly the strange characters. It never hurts to be sure. If you're certain you are clean, we can press on with the connection problem.

How do you connect to the internet? Are you connecting through wireless or through a cable? Broadband or dial-up?

[hayan453]

I have roadrunner.. and connect through a cable.. i also scanned my computer with ad-aware, superantispyware, and malwarebytes anti-malware with zero infections.. if you recommend i go back to the malware thread than i will do so.. cause you are the expert

[Artellos]

Hello there hayan453,

The malware experts gave you a clean bill, and I'm sure they did a great job. I talked with wannabe1 over the chat, and we believe it's just some remains of the malware.

Now, I think we have a network problem to fix?

I would like you to answer a few questions.

• What speed does your ISP provider promise you?
• Could you do a speedtest for me? here.
• I'd also like to see a ping report to Geeks to Go!, Instructions below.

Ping:

• Go to Start and select Run.
• In the Box, type cmd
• A black box will appear. Type: ping www.geekstogo.com
• A lot of information will appear, Please right click the black window and select all.
• Hit Enter to copy the text.
• Then paste it into your next reply.

That will be all for now.

Regards,
Olrik

[disturbia]

(Program not found - skipping AUTOCHECK)
The error starts early in the boot process while the Session Manager process (smss.exe) is busy getting the system up and running. Smss.exe is critical to loading the paging file, initializing the registry and loading kernel components. But, before it does any of that it looks to a registry key called BootExecute. At that location it launches any applications listed. Session Manager then looks to the Windows system32 folder for particular executables it has been instructed to launch. By default there is only one program listed here - autochk.exe, the boot-time version of chkdsk, which will run if there are any file system inconsistency flags detected (i.e. volume dirty bit is set).

Read on for the solution...

Software vendors who need exclusive access to a volume (such as a defragmenter) will name proprietary executables at this registry location (and place the programs in the Windows system32 folder). Using this system is how Diskeeper is able to safely defragment files that could not be defragmented when the system is up and running.

However, malware creators have also used this BootExecute location to load their spyware/virus crap.

If you uninstall a legitimate program that has written into this BootExecute registry you may see this message. The uninstall will typically delete the executable from the system32 program, but not edit the registry. In most cases, the registry change is only a temporary one. For example: if you set Diskeeper to run a Bootime defrag "on next reboot" but uninstall it before the reboot, you can create the same issue. Once the Diskeeper Bootime defrag completes, it removes this string from the registry. Other applications are likely to behave similarly. It is also possible that a program, during install, writes data into this key, but then does not remove it on uninstall.

Another possibility is if you have run an anti-malware program that has removed the referenced executable from the system32 folder, but not changed the BootExecute registry to remove the "pointer" to that file. In that case you will also see this message.

When the program named is from a removed third-party vendor, the message is harmless. You should only be concerned if the default autochk program itself does not run.

If you do get this error and want to clean it up, here's what you need to do:

Look in the registry at:

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" and remove the string [the name referenced in the message on system startup] from the BootExecute value.

Under normal circumstances only the following would be present:

autocheck autochk *

[wannabe1]

Hello disturbia...

Thank you for the information, but that issue is resolved. We're working on another problem now.

[hayan453]

Sorry im not sure what speed my ISP Provider promised.

This is the results of the speed test you requested:


And heres the ping report:
Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Chad Kam>ping www.geekstogo.com

Pinging www.geekstogo.com [208.43.44.138] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 208.43.44.138:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

[Artellos]

Darn, they are blocking ping requests at Geeks to Go on the new server
I'm sorry to trouble you, but could you ping www.google.com instead?

And on Speedtest.net, could you pick a test point closer to your location?
Roadrunner offers 8 Megabit per second, that translates to 1 megabyte per second. Of course, the speeds that I mention are optimal, but you should be getting a little more then 0.18 Megabyte per second. Lets see if a point closer to you has any impact.

I'll dig around a bit more and see what I can find about Roadrunner.

Regards,
Olrik