[Ali40]

Rcenetly my virus update ran out and I started installing NAV 2005. Ran into difficulty and then could not uninstall. Meanwhile my XP developed many problems:

XP Home SE1, Athelon , 800 MHz, 640 M RAM, 2x160 G HD with 100 G free space in each. Cable modem Broadband connection.

-System and system32 folders could not be seen, other hidden and system files and folders were visible.

-Search on the explorer did not work (Could not load)

-Restore quit working

-Dos programs also quit working (They signed in and exited)

-could not connect to certain specific sites:

Symantec, Microsoft, Panda Software,... all sites that could potentiall remove malware or assist.

Eventually the system died with :

-System had the dreadedC000021a Fatal system error

-XP Update would not install either

After many hours of research I fixed all the problems by forcing window into installation to repair / replace window files. [B]I still ccannot connect to very specific sites that may be helpful in the problem resolution. I still cannot connect to those specific sites. I am assuming there is somehow a list somewhere that says don't connect. I get time out error with both IE 6 and Firefox. I suspect there is a virus. I ran Panda and found no virus.

Edited by Ali40, 28 September 2005 - 02:42 PM.

[Advertisements]

Please Click here!, and follow the recommendations in the guide.

If you're still having trouble, We'll need you to use a free diagnostic tool, Hijack This. Follow the instructions in step five of this guide, and reply here with your log.

Most of what Hijack This lists lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[Armodeluxe]

Please Click here!, and follow the recommendations in the guide.

If you're still having trouble, We'll need you to use a free diagnostic tool, Hijack This. Follow the instructions in step five of this guide, and reply here with your log.

Most of what Hijack This lists lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[Ali40]

I have two partitions. One with clean install that works fine and one with the original migrated data from W98 SE.

I have some old dos stuff that I have to have and some will not work with XP with all the updates. That is why I have multiboot.

I used all the different antivirus, including Panda, Trend, AV and used Adaware . Found HacDef.CI and was disinfected, but still could not connect to thsoe sites.

Removed Restore, cleaned, reactivated restore, installed Panda AV and still DOS programs and those site did not work.

After many hours of more research I was on the verge of giving up and removing the affected partition.

I bought Vcoms PCFix Pro and installed all except antivirus. It behaved like the DOS programs. Signed in and exited.

Still could not connect to those specific sites.

[b]I finally got mad and reviewd again for the 100th times, processes being run.

I have been trying to figure out wkssvc.exe's funtion and I finally removed it from everywhere, it kept re-inserting itself. Finally I stopped that process first, then used msconfig, removed it from everywhere and then searched and removed from the registry
Immediately the DOS programs started working properly and PCFix from Vcom started workingas well.[/B]My system had been using up much resources up to this point and was very slow. After removing wkssvc (Added by the W32/Sdbot-ABE WORM! ), the system was as good as new.

The only remaining problem is those specific sites: I still cannot connect to them. I get site found, connecting and then the connection was reset (Firefox) or page cannot be found (IE6). There must be a deny access list somehwere that is generated that does this. Can anyone tell me where to look for it? Ichecked the simple stuff in internet option and of course no luck there.

Edited by Ali40, 28 September 2005 - 01:37 PM.

[Ali40]

Thanks Armodeluxe.
I will try hijackThis and try to see what is happenning. I don't understand enough about the exact internet coonection schemes. I checked all the security features and setup and both partitions are identical and yet the affected partition knows exactly to where not connect! Something is obviously intervening and monitoring and not allowing the specific connections. I know most of my problems started with Symantec not installing properly and I downloaded another version from Kazai to see if it would install. Oops! That was a bad call. I, most likely, got stuff (worms, virus, spyware). I did not lose any one of my files or programs and using the other patition I replaced all suspected files.

The only thing left is those specific sites. I will keep all posted in case other people can learn from this.

[Armodeluxe]

Please follow the indicated steps in my previous post to paste a HijackThis log into this topic and let's see what it's showing.

[Ali40]

The problem is resolved. I found the exact problem and was able to fix it. Thanks for all the hints and suggestions. I did not have to run all those tests including HijackThis. My previuos discovery and removal of the wkssvc.exe from all places including HKLM Run, and other places had fixed all and the system stayed functioning (No re-appearance). All remained was to find out how a List of sites was kept that were being blocked or intercepted. Unfortunately nobody helped with that basic question. There were no viruses anymore but the list was generarted and was still being used. Another re-install after removal of Hacdef.CI may have been able to fix the problem, but I am not sure. I was hoping to understand the mechanism of a list is used by browsers(both ie 6 and Firefox were affected). My assumption was that it was somehow a higher order of logic in the windows XP that did that.
Thanks for those who helped.

[Ali40]

The problem is resolved. I found the exact problem and was able to fix it. Thanks for all the hints and suggestions. I did not have to run all those tests including HijackThis. My previuos discovery and removal of the wkssvc.exe from all places including HKLM Run, and other places had fixed all and the system stayed functioning (No re-appearance). All remained was to find out how a List of sites was kept that were being blocked or intercepted. Unfortunately nobody helped with that basic question. There were no viruses anymore but the list was generarted and was still being used. Another re-install after removal of Hacdef.CI may have been able to fix the problem, but I am not sure. I was hoping to understand the mechanism of a list is used by browsers(both ie 6 and Firefox were affected). My assumption was that it was somehow a higher order of logic in the windows XP that did that.
Thanks for those who helped.

Edited by Ali40, 29 September 2005 - 07:43 AM.

[Armodeluxe]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.