Windows problem - possibly urgent (update: partioned)
cj iwakura
The Rhythm RegentBears The Name FreedomRegistered User regular
The Rhythm RegentBears The Name FreedomRegistered User regular
I posted in another thread about some popups plaguing my Firefox. I tried HijackThis which seemed to help for a little while, then they came back. Then I tried AdAware, which said it detected malware(then removed it), but that didn't seem to stop them.
Now my system seems to be going haywire.
Windows isn't booting up properly. All I see is the 'windows failed to boot up this program' message or 'closed Windows Explorer to protect your system'.
The only reason I was able to access Firefox was through the 'access information on the web' tab in that window.
Before Windows even booted up, the first thing I saw was a black screen with the error message(paraphrased):
"Illegal instruction occured in Logonui.exe(0xc00001d) at location (0xn0108ffb3)".
From there, a few more similar messages popped up regarding 'svchost.exe' and 'BN1.tmp', then it said it closed Windows Explorer.
I can't access the Start tab or anything, it's just a blank wallpaper.
Not really sure what to do from here, but I can still access setup and whatnot from the booting screen.
Oh, and this was on a second booting attempt.
On the first, the computer was running very slow in general, but everything was still accessible, and AdAware said it detected some malware which it then removed. When I tried rebooting to 'make sure it was clear' as suggested, this happened.
Now my system seems to be going haywire.
Windows isn't booting up properly. All I see is the 'windows failed to boot up this program' message or 'closed Windows Explorer to protect your system'.
The only reason I was able to access Firefox was through the 'access information on the web' tab in that window.
Before Windows even booted up, the first thing I saw was a black screen with the error message(paraphrased):
"Illegal instruction occured in Logonui.exe(0xc00001d) at location (0xn0108ffb3)".
From there, a few more similar messages popped up regarding 'svchost.exe' and 'BN1.tmp', then it said it closed Windows Explorer.
I can't access the Start tab or anything, it's just a blank wallpaper.
Not really sure what to do from here, but I can still access setup and whatnot from the booting screen.
Oh, and this was on a second booting attempt.
On the first, the computer was running very slow in general, but everything was still accessible, and AdAware said it detected some malware which it then removed. When I tried rebooting to 'make sure it was clear' as suggested, this happened.
cj iwakura on
0
Posts
EDIT: I was right. BN1.tmp is part of a trojan- which one, I don't know. There's lots of them out there. But if your comp's this bad, you might want to just reformat and reinstall everything. You'll never get it working as it was before, sounds like.
I can has cheezburger, yes?
Could I try to salvage anything using a USB drive?
Any confirm/deny on this possibility?
When windows is up(assuming you are using xp), hit control-alt-delete, file, run, and type "explorer" in. That may open explorer for you long enough to download avast free or avira antivir and run a boot-time virus scan, which is probably the first thing you should have done. If you have an antivirus already, update it(they are useless unless updated) and do the same thing.
If that doesn't work, you can always hook this hard drive up to another computer and pull off whatever files you need to keep before reformatting(at risk of infecting the other computer, make sure it has an updated antivirus running before you do this.)
Running a scan now.
Things are running slowly, but running.
The HP tech(an online one, who I'm not entirely sure was a human) mentioned a program called 'Super Anti Spyware', which I've never heard of.
Agreed. If there is crucial info on your hard drive, install it on a computer (one with a working antivirus. Not Norton or McAfee for christ's sake. Try AVG). Back up anything important, put it back in your PC, and just wipe it and reinstall Windows.
try booting into safe mode and then fixing it
but they're listening to every word I say
Anyway, things are running now, as said, just choppily, so I have the capacity to fix the problem right now, if it can be fixed.
Ad-Aware found a trojan and a bunch of other errors, fixed them, and still no good.
You should be running your scans in safe mode. Start jamming on F8 immediately after starting your computer to get into safe mode. Choose the one with networking, so you can download and update antispyware programs.
Norton scans aren't really worth running and Adaware hasn't been good for years.
Install, update, and run these programs in safe mode:
ComboFix - http://www.combofix.org/
MalwareBytes AntiMalware - http://www.malwarebytes.org/
SuperAntiSpyware - http://www.superantispyware.com/
there are ways to clean this out of your system, but if you don't already know them, it's going to be a pain to do. best way to go is to boot into safe mode, copy everything you want to keep onto a usb drive and then nuke it. nuke it hard
note: only copy .jpg .m3p .mpg .doc
anything else has a chance of carrying at least part of the virus and shouldn't be carried over
The error messages come up on safe mode and regular alike.
And I can't access system restore. A fatal error occurs, and the computer shuts down.
water spirals the wrong way out the sink
If you boot up into regular safe mode, you shouldn't be able to get on the internet. You need to select Safe Mode w/ Networking. Even then, if you're connecting through wireless, it may not work.
System Restore is probably infected anyway.
Did you try running the programs that I suggested?
I tried safe mode with networking. Connecting through a modem.
I didn't try any of those three yet(sided with avast first), but since that didn't help, I think it might be too late.
Is there any way to get access to system restore, or is the system pretty much shot at this point?
I tried formatting in Windows Restore(some DOS-esque program), and that didn't seem to do anything.
Future is looking bleak.
I can't even access system restore. I can get safe mode running now, but still no network access.
I have a friend who might be able to get me an anti-viral program, though I don't expect it'll help.
I guess the only alternative'll be to replace it outright.
Does anyone know some tricks on how the Windows Restore DOS program operates? That I can access without any trouble, but I don't really understand how it functions.
Do you have Windows Defender installed? If not get...
Windows Defender - Copy it to a usb drive and install it.
Also, even if you have windows defender use the manual update file to update it.
Yeah, man, it's one of the two. I don't know how old this computer of yours is, but no computer nowadays, or even ones with XP a few years ago, come without any back-up of the operating system or the other necessary files to run the thing.
If you didn't get the CD, you should really have a partition on your hard drive somewhere.
Unfortunately sometimes the Recovery partition is lumped in with the native System Restore and recovery options in windows and if those are corrupted and made inaccessible by this virus than the partition might be too.
it actually sounds a lot like what happened to my wifes laptop. i ended up nuking it and re-installing
This isn't true, by the way. Modern malware cocktails are extremely insidious, and the last two I wrangled with ran just fine in Safe Mode, although they were slightly less invasive at thwarting my attempts to remove them there (fewer popups and such).
Depending on how bad your malware infection is, it may or may not be possible to get rid of it. It's also possible that, in your fumbling around with a lot of ineffective scanners (Norton, Ad-aware) you screwed things up worse and deleted a few vital files here or there.
System restore is also unlikely to help you, because the malware authors know about it, and either infect your system restore files or hide somewhere such that they will just recreate all the malware after your system restore.
Unfortunately, many once-popular antivirus and anti-spyware programs (Norton, Ad-aware, even venerable ones like AVG) are only good against more benign threats. If you've got a particularly nasty malware cocktail, your best bets today are Malwarebytes Anti-Malware, Super Antispyware, and tools like ComboFix. ComboFix is great, but it's meant to be used in cooperation with someone who is trained on its use, because part of a proper ComboFix-based cleaning is manually going through the log, picking out the bits of malware ComboFix DIDN'T remove, and manually creating a script that is passed to another run of ComboFix to remove the remaining nasties.
That said, I had access (and the knowhow to use) all these tools, and I still had to nuke a machine from orbit six months ago. I have no idea where this particular malware was hiding, but I used ComboFix, cleaned off all the remaining nasties manually (with a CFScript.txt), got clean full scans from Malwarebytes, Super Antispyware, HijackThis and four different rootkit revealers, and when I rebooted that sucker came right back.
Is this a valid solution, or could it only lead to more problems down the line?
Downside: it's practically a skeleton OS. No sound drivers, and I can't get the internet working either, reportedly because it's missing the network drivers as well.
It's a Compaq SR1820NX, for whatever that's worth. I'm pretty sure I downloaded the right ones, but they don't seem to be updating right.
Edit: got the sound working. Now I just need to figure out how to get the network adapter running.
Any leads on this?
Thanks for the help all.