[Canary]

Hello,

I've been redirected here from the malware forums, where I've had extensive help from Azari on this thread: www.geekstogo.com/forum/topic/285698-various-problems/

Having been through various scans, Azari thinks the issue is one that I could receive help with here.

The issues I am having on my computer are all outlined on that thread, but in a nutshell . . . some web pages (eg, Hotmail) are blank; System Restore won't open; the Search Companion is blank; Help and Support doesn't work; and automatic redirections that normally work aren't doing so any more.

I hope someone can help. Thanks in advance.

[Advertisements]

try a windows repair

http://www.geekstogo...air-windows-xp/

[Rorschach112]

try a windows repair

http://www.geekstogo...air-windows-xp/

[Canary]

Hi, and thanks for your help.

I've followed the steps in that link, including going into BIOS and changing the boot order.

But when I restart the computer, I'm not getting an option to "Press any key to boot from CD".

I'm probably being dense here, but I can't see what I'm doing wrong.

[Rorschach112]

lets skip that for the time being


Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Minimal Output at the top
• Click the none button at the top
• Paste this in the custom scan box
  
  NetSvcs /all
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice /s
  /md5start
  srclient.*
  srsvc.*
  srvsvc.*
  sr.*
  /md5stop
  CREATERESTOREPOINT
  
  
  
• click run scan post that log

[Canary]

Hang on - I've just done about the most stupid thing I've ever done. If I tell you what it is, you'll probably never want to help me again. (I might tell you later what it was!)

For now, let's just say that you should ignore my previous post. I'm now going to start the "Boot from CD" process.

Thanks!

[Rorschach112]

ok no problem, do the above step after the windows repair

[Canary]

I started the Windows Repair process, but I came across another screen other than those listed on the link you sent me. I didn't want to proceed just in case I got it wrong.

It was after I pressed F8 to accept the End-User Licence Agreement. I can't remember exactly what it said, but I had to select between a partitioned space and an unpartitioned space. I went for the former, but then it gave me a warning and asked if I was sure - so I bottled it and abandoned the process.

Does that make sense to you? If not, I'll do it all again and this time write down exactly what it said.

Thanks again.

[Rorschach112]

select the partitioned space

[Canary]

Hi.

Again, I'm coming across screens that don't seem to be in that guide, and I'm wary of doing the wrong thing.

The latest says:

"Setup will install Windows XP on partition on 38155 MB
Disk 0 at Id 0 on bus 0 on atapi [MBR].
Use UP and DOWN ARROW keys to select the file system you want, then press ENTER.
If you want to select a different parttion for Windows XP, press ESC.

Format the partition using the NTFS file system (Quick)
Format the partition using the NTFS file system
Leave the current file system intact (No changes)"

Can you give me some guidance - and do you know if I'm going to get any more screens that deviate from that link I'm following?

Thanks once again.

[Rorschach112]

lets skip that for the time being since its getting different than the guide

do the otl step in post #4 please

[Canary]

here's the log. Thanks.




OTL logfile created on: 17/09/2010 21:22:21 - Run 6
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\Adam\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.00 Mb Total Physical Memory | 177.00 Mb Available Physical Memory | 35.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 6.93 Gb Free Space | 18.61% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LAPTOP
Current User Name: Adam
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: AudioSrv - C:\WINDOWS\system32\audiosrv.dll (Microsoft Corporation)
NetSvcs: Browser - C:\WINDOWS\system32\browser.dll (Microsoft Corporation)
NetSvcs: CryptSvc - C:\WINDOWS\system32\cryptsvc.dll (Microsoft Corporation)
NetSvcs: DMServer - C:\WINDOWS\system32\dmserver.dll (Microsoft Corp.)
NetSvcs: DHCP - C:\WINDOWS\system32\dhcpcsvc.dll (Microsoft Corporation)
NetSvcs: ERSvc - C:\WINDOWS\system32\ersvc.dll (Microsoft Corporation)
NetSvcs: EventSystem - C:\WINDOWS\system32\es.dll (Microsoft Corporation)
NetSvcs: FastUserSwitchingCompatibility - C:\WINDOWS\system32\shsvcs.dll (Microsoft Corporation)
NetSvcs: HidServ - C:\WINDOWS\system32\hidserv.dll (Microsoft Corporation)
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: LanmanServer - C:\WINDOWS\system32\srvsvc.dll (Microsoft Corporation)
NetSvcs: LanmanWorkstation - C:\WINDOWS\system32\wkssvc.dll (Microsoft Corporation)
NetSvcs: Messenger - C:\WINDOWS\system32\msgsvc.dll (Microsoft Corporation)
NetSvcs: Netman - C:\WINDOWS\system32\netman.dll (Microsoft Corporation)
NetSvcs: Nla - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
NetSvcs: Ntmssvc - C:\WINDOWS\system32\ntmssvc.dll (Microsoft Corporation)
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Rasauto - C:\WINDOWS\system32\rasauto.dll (Microsoft Corporation)
NetSvcs: Rasman - C:\WINDOWS\system32\rasmans.dll (Microsoft Corporation)
NetSvcs: Remoteaccess - C:\WINDOWS\system32\mprdim.dll (Microsoft Corporation)
NetSvcs: Schedule - C:\WINDOWS\system32\schedsvc.dll (Microsoft Corporation)
NetSvcs: Seclogon - C:\WINDOWS\system32\seclogon.dll (Microsoft Corporation)
NetSvcs: SENS - C:\WINDOWS\system32\sens.dll (Microsoft Corporation)
NetSvcs: Sharedaccess - C:\WINDOWS\system32\ipnathlp.dll (Microsoft Corporation)
NetSvcs: SRService - C:\WINDOWS\system32\srsvc.dll (Microsoft Corporation)
NetSvcs: Tapisrv - C:\WINDOWS\system32\tapisrv.dll (Microsoft Corporation)
NetSvcs: Themes - C:\WINDOWS\system32\shsvcs.dll (Microsoft Corporation)
NetSvcs: TrkWks - C:\WINDOWS\system32\trkwks.dll (Microsoft Corporation)
NetSvcs: W32Time - C:\WINDOWS\system32\w32time.dll (Microsoft Corporation)
NetSvcs: WZCSVC - C:\WINDOWS\system32\wzcsvc.dll (Microsoft Corporation)
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: winmgmt - C:\WINDOWS\system32\wbem\wmisvc.dll (Microsoft Corporation)
NetSvcs: wscsvc - C:\WINDOWS\system32\wscsvc.dll (Microsoft Corporation)
NetSvcs: xmlprov - C:\WINDOWS\system32\xmlprov.dll (Microsoft Corporation)
NetSvcs: BITS - C:\WINDOWS\system32\qmgr.dll (Microsoft Corporation)
NetSvcs: wuauserv - C:\WINDOWS\system32\wuauserv.dll (Microsoft Corporation)
NetSvcs: ShellHWDetection - C:\WINDOWS\system32\shsvcs.dll (Microsoft Corporation)
NetSvcs: WmdmPmSN - C:\WINDOWS\system32\mspmsnsv.dll (Microsoft Corporation)
NetSvcs: helpsvc - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)
NetSvcs: napagent - C:\WINDOWS\system32\qagentrt.dll (Microsoft Corporation)
NetSvcs: hkmsvc - C:\WINDOWS\system32\kmsvc.dll (Microsoft Corporation)

CREATERESTOREPOINT
Error starting restore point: 3
Error closing restore point: The sequence number is invalid.

========== Custom Scans ==========


< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice /s >
"Type" = 32
"Start" = 2
"ErrorControl" = 1
"ImagePath" = %SystemRoot%\system32\svchost.exe -k netsvcs -- [2008/04/14 01:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation)
"DisplayName" = System Restore Service
"DependOnService" = RpcSs [binary data] -- [2009/02/09 13:10:48 | 000,401,408 | ---- | M] (Microsoft Corporation)
"DependOnGroup" = [binary data]
"ObjectName" = LocalSystem
"Description" = Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice\Parameters]
"ServiceDll" = %SystemRoot%\system32\srsvc.dll -- [2008/04/14 01:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice\Security]
"Security" = [Binary data over 100 bytes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice\Enum]
"0" = Root\LEGACY_SRSERVICE\0000
"Count" = 1
"NextInstance" = 1


< MD5 for: SR.IN_ >
[2004/08/12 14:29:56 | 000,001,461 | ---- | M] () MD5=E9C165191E8B0F4211EF4636B7383CBF -- C:\I386\SR.IN_

< MD5 for: SR.INF >
[2004/08/12 15:06:26 | 000,005,038 | ---- | M] () MD5=C51F64A45FE82FE926113698908F7C15 -- C:\WINDOWS\inf\sr.inf

< MD5 for: SR.MO_ >
[2004/08/12 14:29:56 | 000,001,355 | ---- | M] () MD5=63A37C2AA9FEED2AD933B3D85235133D -- C:\I386\SR.MO_

< MD5 for: SR.MOF >
[2004/08/12 15:06:27 | 000,003,799 | ---- | M] () MD5=010ED42FE2EE754B65FA8FC1DE7B67E1 -- C:\WINDOWS\system32\wbem\sr.mof

< MD5 for: SR.PNF >
[2008/05/03 12:48:38 | 000,012,064 | ---- | M] () MD5=5673E65DA8FB5ED308CEF1293FE7B31D -- C:\WINDOWS\inf\sr.PNF

< MD5 for: SR.QM >
[2010/05/06 05:26:31 | 000,005,103 | ---- | M] () MD5=5A3E086FDA45E780760BFE96BAC7ED69 -- C:\Program Files\Google\Google Earth\plugin\lang\sr.qm
[2010/05/05 19:04:48 | 000,206,545 | ---- | M] () MD5=CD93215DE0410AF8081C59D58E44EE5E -- C:\Program Files\Google\Google Earth\client\lang\sr.qm

< MD5 for: SR.SY_ >
[2004/08/12 14:29:57 | 000,036,077 | ---- | M] () MD5=FCB066A61D6B543E235F526B2F374449 -- C:\I386\SR.SY_

< MD5 for: SR.SYS >
[2008/04/13 19:36:52 | 000,073,472 | ---- | M] (Microsoft Corporation) MD5=76BB022C2FB6902FD5BDD4F78FC13A5D -- C:\WINDOWS\ServicePackFiles\i386\sr.sys
[2008/04/13 19:36:52 | 000,073,472 | ---- | M] (Microsoft Corporation) MD5=76BB022C2FB6902FD5BDD4F78FC13A5D -- C:\WINDOWS\system32\dllcache\sr.sys
[2008/04/13 19:36:52 | 000,073,472 | ---- | M] (Microsoft Corporation) MD5=76BB022C2FB6902FD5BDD4F78FC13A5D -- C:\WINDOWS\system32\drivers\sr.sys
[2004/08/12 15:06:27 | 000,073,472 | ---- | M] (Microsoft Corporation) MD5=E41B6D037D6CD08461470AF04500DC24 -- C:\WINDOWS\$NtServicePackUninstall$\sr.sys

< MD5 for: SRCLIENT.DL_ >
[2004/08/12 14:29:58 | 000,028,849 | ---- | M] () MD5=FBF42D13EE532E248878512C3D79F888 -- C:\I386\SRCLIENT.DL_

< MD5 for: SRCLIENT.DLL >
[2004/08/12 15:06:28 | 000,067,584 | ---- | M] (Microsoft Corporation) MD5=60106B27FCCE3E71EC8C8C757CC243E4 -- C:\WINDOWS\$NtServicePackUninstall$\srclient.dll
[2008/04/14 01:12:07 | 000,067,584 | ---- | M] (Microsoft Corporation) MD5=77A54BDFBAD4604E6131AE68E3CF76D6 -- C:\WINDOWS\ServicePackFiles\i386\srclient.dll
[2008/04/14 01:12:07 | 000,067,584 | ---- | M] (Microsoft Corporation) MD5=77A54BDFBAD4604E6131AE68E3CF76D6 -- C:\WINDOWS\system32\dllcache\srclient.dll
[2008/04/14 01:12:07 | 000,067,584 | ---- | M] (Microsoft Corporation) MD5=77A54BDFBAD4604E6131AE68E3CF76D6 -- C:\WINDOWS\system32\srclient.dll

< MD5 for: SRSVC.DL_ >
[2004/08/12 14:29:59 | 000,067,844 | ---- | M] () MD5=B19BFAEADF5AC8F6C8AB9A66F5BF47F0 -- C:\I386\SRSVC.DL_

< MD5 for: SRSVC.DLL >
[2008/04/14 01:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\ERDNT\cache\srsvc.dll
[2008/04/14 01:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\ServicePackFiles\i386\srsvc.dll
[2008/04/14 01:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\system32\dllcache\srsvc.dll
[2008/04/14 01:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\system32\srsvc.dll
[2004/08/12 15:06:29 | 000,170,496 | ---- | M] (Microsoft Corporation) MD5=92BDF74F12D6CBEC43C94D4B7F804838 -- C:\WINDOWS\$NtServicePackUninstall$\srsvc.dll

< MD5 for: SRVSVC.DL_ >
[2004/08/12 14:30:00 | 000,042,027 | ---- | M] () MD5=CD71C3EE3FF517A4F26F6CF176EA2310 -- C:\I386\SRVSVC.DL_

< MD5 for: SRVSVC.DLL >
[2004/12/07 20:32:34 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=0CB3AF149A0BAC0836022CA307C7A0F8 -- C:\WINDOWS\$NtServicePackUninstall$\srvsvc.dll
[2008/04/14 01:12:07 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=F385F4B02C535BFFE1D70CAB80838123 -- C:\WINDOWS\ServicePackFiles\i386\srvsvc.dll
[2008/04/14 01:12:07 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=F385F4B02C535BFFE1D70CAB80838123 -- C:\WINDOWS\system32\dllcache\srvsvc.dll
[2008/04/14 01:12:07 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=F385F4B02C535BFFE1D70CAB80838123 -- C:\WINDOWS\system32\srvsvc.dll
< End of report >

[Rorschach112]

Boot from the Windows XP installation CD.

At the "Welcome to Setup" screen, press R to start Recovery Console. Choose the installation to be repaired by number (usually 1) and press "Enter".

When you are asked for the Administrator password, leave it blank and press "Enter".

At the command prompt, type chkdsk /r and press "Enter". (Note the space before /r) The disk check operation will start.

This will be a very thorough check of the hard drive and the file system...be patient and let it complete. It may appear to hang or even back up a few times...this is normal. 60 to 90 minutes is not unusual for this check...it may take longer in some cases.

Once the check completes and you are back at the command prompt, type exit and press "Enter". Let your computer boot normally to Windows.

[Canary]

Hi.

I ran that, and it has now completed. It said it found and repaired one or more errors.

Upon rebooting, I'm still having the same problems, though!

Thanks.

[rshaffer61]

Rerun chkdsk /r and let us know if it still finds errors.
Once you have done the above then do the below since it looks like you can get into windows.
Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!


Thanks to Broni for the instructions

[Canary]

Hello again.

I've completed those stages.

Once again, the chkdsk scan found and fixed one or more errors.

I then ran scannow, and it completed without asking for the CD. It found no errors.

Should I keep repeating the chkdsk scan until it finds no further errors?

Thanks, as ever.