Windows problem - possibly urgent (update: partioned)

cj iwakuracj iwakura The Rhythm RegentBears The Name FreedomRegistered User regular
edited April 2009 in Help / Advice Forum
I posted in another thread about some popups plaguing my Firefox. I tried HijackThis which seemed to help for a little while, then they came back. Then I tried AdAware, which said it detected malware(then removed it), but that didn't seem to stop them.

Now my system seems to be going haywire.

Windows isn't booting up properly. All I see is the 'windows failed to boot up this program' message or 'closed Windows Explorer to protect your system'.

The only reason I was able to access Firefox was through the 'access information on the web' tab in that window.

Before Windows even booted up, the first thing I saw was a black screen with the error message(paraphrased):

"Illegal instruction occured in Logonui.exe(0xc00001d) at location (0xn0108ffb3)".

From there, a few more similar messages popped up regarding 'svchost.exe' and 'BN1.tmp', then it said it closed Windows Explorer.

I can't access the Start tab or anything, it's just a blank wallpaper.


Not really sure what to do from here, but I can still access setup and whatnot from the booting screen.


Oh, and this was on a second booting attempt.

On the first, the computer was running very slow in general, but everything was still accessible, and AdAware said it detected some malware which it then removed. When I tried rebooting to 'make sure it was clear' as suggested, this happened.

z48g7weaopj2.png
cj iwakura on

Posts

  • JaysonFourJaysonFour Classy Monster Kitteh Registered User regular
    edited April 2009
    I hate to say it, but you might just be best reformatting and re-installing everything if you can. I think there's still fragments of the malware floating in your logonui.exe file (ad-aware didn't remove all of it), or it did its work and fucked up your file something fierce.

    EDIT: I was right. BN1.tmp is part of a trojan- which one, I don't know. There's lots of them out there. But if your comp's this bad, you might want to just reformat and reinstall everything. You'll never get it working as it was before, sounds like.

    JaysonFour on
    steam_sig.png
    I can has cheezburger, yes?
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    That really sucks if you're right about reformatting. I assume I'd have to do that from the setup screen?

    Could I try to salvage anything using a USB drive?

    cj iwakura on
    z48g7weaopj2.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Update: spoke with an HP tech, and he says the problem could be linked to Firefox, and I should uninstall it.

    Any confirm/deny on this possibility?

    cj iwakura on
    z48g7weaopj2.png
  • fallaxdracofallaxdraco Registered User regular
    edited April 2009
    Have you tried running explorer again after you close it?

    When windows is up(assuming you are using xp), hit control-alt-delete, file, run, and type "explorer" in. That may open explorer for you long enough to download avast free or avira antivir and run a boot-time virus scan, which is probably the first thing you should have done. If you have an antivirus already, update it(they are useless unless updated) and do the same thing.

    If that doesn't work, you can always hook this hard drive up to another computer and pull off whatever files you need to keep before reformatting(at risk of infecting the other computer, make sure it has an updated antivirus running before you do this.)

    fallaxdraco on
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Yet another update: I got Windows running thanks to the above suggestion.

    Running a scan now.

    Things are running slowly, but running.

    cj iwakura on
    z48g7weaopj2.png
  • eternalbleternalbl Registered User regular
    edited April 2009
    Also try out malwarebytes anti-malware. Its been working wonders for people with possible malware problems lately.

    eternalbl on
    eternalbl.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    I'm running a Norton scan at the moment. If it turns up nothing, I'll pursue the other suggestions.

    The HP tech(an online one, who I'm not entirely sure was a human) mentioned a program called 'Super Anti Spyware', which I've never heard of.

    cj iwakura on
    z48g7weaopj2.png
  • Descendant XDescendant X Skyrim is my god now. Outpost 31Registered User regular
    edited April 2009
    You should probably just disregard anything that the HP "tech" says. The moment he suggested you get rid of Firefox you should have just hung up the phone.

    Descendant X on
    Garry: I know you gentlemen have been through a lot, but when you find the time I'd rather not spend the rest of the winter TIED TO THIS FUCKING COUCH!
  • TL DRTL DR Not at all confident in his reflexive opinions of thingsRegistered User regular
    edited April 2009
    You should probably just disregard anything that the HP "tech" says. The moment he suggested you get rid of Firefox you should have just hung up the phone.

    Agreed. If there is crucial info on your hard drive, install it on a computer (one with a working antivirus. Not Norton or McAfee for christ's sake. Try AVG). Back up anything important, put it back in your PC, and just wipe it and reinstall Windows.

    TL DR on
  • WonderMinkWonderMink Adventure! Candy IslandRegistered User regular
    edited April 2009
    try restoring to last known good config
    try booting into safe mode and then fixing it

    WonderMink on
    and I wonder about my neighbors even though I don't have them
    but they're listening to every word I say
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Tried the first one, didn't work. I haven't tried safe mode yet, mostly because I'm not sure what to do if that does work out.

    Anyway, things are running now, as said, just choppily, so I have the capacity to fix the problem right now, if it can be fixed.

    cj iwakura on
    z48g7weaopj2.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Seems like the situation is dire. Tried to do system recovery, and a system error shut it down mid-process.

    Ad-Aware found a trojan and a bunch of other errors, fixed them, and still no good.

    cj iwakura on
    z48g7weaopj2.png
  • theclamtheclam Registered User regular
    edited April 2009
    I'd reformat if I were you. That being said, it's probably fixable. Whatever you do, back up all your stuff now.

    You should be running your scans in safe mode. Start jamming on F8 immediately after starting your computer to get into safe mode. Choose the one with networking, so you can download and update antispyware programs.

    Norton scans aren't really worth running and Adaware hasn't been good for years.

    Install, update, and run these programs in safe mode:
    ComboFix - http://www.combofix.org/
    MalwareBytes AntiMalware - http://www.malwarebytes.org/
    SuperAntiSpyware - http://www.superantispyware.com/

    theclam on
    rez_guy.png
  • I'd Fuck Chuck Lidell UpI'd Fuck Chuck Lidell Up Registered User regular
    edited April 2009
    theclam wrote: »
    I'd reformat if I were you. That being said, it's probably fixable. Whatever you do, back up all your stuff now.

    You should be running your scans in safe mode. Start jamming on F8 immediately after starting your computer to get into safe mode. Choose the one with networking, so you can download and update antispyware programs.

    Norton scans aren't really worth running and Adaware hasn't been good for years.

    Install, update, and run these programs in safe mode:
    ComboFix - http://www.combofix.org/
    MalwareBytes AntiMalware - http://www.malwarebytes.org/
    SuperAntiSpyware - http://www.superantispyware.com/
    i would go so far as to say this: NEVER LEAVE SAFE MODE while safe mode is running your malware isn't.

    there are ways to clean this out of your system, but if you don't already know them, it's going to be a pain to do. best way to go is to boot into safe mode, copy everything you want to keep onto a usb drive and then nuke it. nuke it hard

    note: only copy .jpg .m3p .mpg .doc

    anything else has a chance of carrying at least part of the virus and shouldn't be carried over

    I'd Fuck Chuck Lidell Up on
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Situation has been upgraded to code red. Can't access the internet from that computer anymore. A full avast virus scan deleted somewhere in the realm of 500 files, but when I load up safe mode, I can't connect to anything.

    The error messages come up on safe mode and regular alike.

    And I can't access system restore. A fatal error occurs, and the computer shuts down.

    cj iwakura on
    z48g7weaopj2.png
  • RNEMESiS42RNEMESiS42 Registered User regular
    edited April 2009
    Like people have said, backup all of your important files, and then format and reinstall windows.

    RNEMESiS42 on
    my apartment looks upside down from there
    water spirals the wrong way out the sink
  • theclamtheclam Registered User regular
    edited April 2009
    cj iwakura wrote: »
    Situation has been upgraded to code red. Can't access the internet from that computer anymore. A full avast virus scan deleted somewhere in the realm of 500 files, but when I load up safe mode, I can't connect to anything.

    The error messages come up on safe mode and regular alike.

    And I can't access system restore. A fatal error occurs, and the computer shuts down.

    If you boot up into regular safe mode, you shouldn't be able to get on the internet. You need to select Safe Mode w/ Networking. Even then, if you're connecting through wireless, it may not work.

    System Restore is probably infected anyway.

    Did you try running the programs that I suggested?

    theclam on
    rez_guy.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    theclam wrote: »
    cj iwakura wrote: »
    Situation has been upgraded to code red. Can't access the internet from that computer anymore. A full avast virus scan deleted somewhere in the realm of 500 files, but when I load up safe mode, I can't connect to anything.

    The error messages come up on safe mode and regular alike.

    And I can't access system restore. A fatal error occurs, and the computer shuts down.

    If you boot up into regular safe mode, you shouldn't be able to get on the internet. You need to select Safe Mode w/ Networking. Even then, if you're connecting through wireless, it may not work.

    System Restore is probably infected anyway.

    Did you try running the programs that I suggested?

    I tried safe mode with networking. Connecting through a modem.

    I didn't try any of those three yet(sided with avast first), but since that didn't help, I think it might be too late.

    Is there any way to get access to system restore, or is the system pretty much shot at this point?


    I tried formatting in Windows Restore(some DOS-esque program), and that didn't seem to do anything.

    cj iwakura on
    z48g7weaopj2.png
  • wunderbarwunderbar What Have I Done? Registered User regular
    edited April 2009
    My vote still goes for nuking it from orbit. Once you've been infected, there's no going back. You can get it back mostly to where it was, but the system just wont' be the same, and will probably have trouble later on.

    wunderbar on
    XBL: thewunderbar PSN: thewunderbar NNID: thewunderbar Steam: wunderbar87 Twitter: wunderbar
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    I'm all for nuking it from orbit right now, but it doesn't want me to access the kill switch.

    cj iwakura on
    z48g7weaopj2.png
  • theclamtheclam Registered User regular
    edited April 2009
    If you're ready to format, just pop your Windows disc in and reboot.

    theclam on
    rez_guy.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Don't have a windows disc.(Didn't even notice one with the packaging.)

    Future is looking bleak.

    I can't even access system restore. I can get safe mode running now, but still no network access.

    I have a friend who might be able to get me an anti-viral program, though I don't expect it'll help.

    I guess the only alternative'll be to replace it outright.


    Does anyone know some tricks on how the Windows Restore DOS program operates? That I can access without any trouble, but I don't really understand how it functions.

    cj iwakura on
    z48g7weaopj2.png
  • wunderbarwunderbar What Have I Done? Registered User regular
    edited April 2009
    if your system didn't come with a disc then there should be a recovery partition on the hard drive. It would be a boot option, or a f-key you have to hit at startup, check your manuals.

    wunderbar on
    XBL: thewunderbar PSN: thewunderbar NNID: thewunderbar Steam: wunderbar87 Twitter: wunderbar
  • warbanwarban Who the Hoof do you think we are? Registered User regular
    edited April 2009
    Stupid question, But I assume this is Windows XP?

    Do you have Windows Defender installed? If not get...

    Windows Defender - Copy it to a usb drive and install it.

    Also, even if you have windows defender use the manual update file to update it.
    To download the Windows Defender definition update file for 32-bit (x86-based) versions of Windows, click the following link:
    http://go.microsoft.com/fwlink/?linkid=70631

    warban on
    ACE ✰ PONY ✰ DETECTIVE!
  • RikushixRikushix VancouverRegistered User regular
    edited April 2009
    wunderbar wrote: »
    if your system didn't come with a disc then there should be a recovery partition on the hard drive. It would be a boot option, or a f-key you have to hit at startup, check your manuals.

    Yeah, man, it's one of the two. I don't know how old this computer of yours is, but no computer nowadays, or even ones with XP a few years ago, come without any back-up of the operating system or the other necessary files to run the thing.

    If you didn't get the CD, you should really have a partition on your hard drive somewhere.

    Unfortunately sometimes the Recovery partition is lumped in with the native System Restore and recovery options in windows and if those are corrupted and made inaccessible by this virus than the partition might be too.

    Rikushix on
    StKbT.jpg
  • mtsmts Dr. Robot King Registered User regular
    edited April 2009
    you can download the ultimate boot disk. it has a ton of options to check/scan from start up.
    it actually sounds a lot like what happened to my wifes laptop. i ended up nuking it and re-installing

    mts on
    camo_sig.png
  • DrFrylockDrFrylock Registered User regular
    edited April 2009
    i would go so far as to say this: NEVER LEAVE SAFE MODE while safe mode is running your malware isn't.

    This isn't true, by the way. Modern malware cocktails are extremely insidious, and the last two I wrangled with ran just fine in Safe Mode, although they were slightly less invasive at thwarting my attempts to remove them there (fewer popups and such).

    Depending on how bad your malware infection is, it may or may not be possible to get rid of it. It's also possible that, in your fumbling around with a lot of ineffective scanners (Norton, Ad-aware) you screwed things up worse and deleted a few vital files here or there.

    System restore is also unlikely to help you, because the malware authors know about it, and either infect your system restore files or hide somewhere such that they will just recreate all the malware after your system restore.

    Unfortunately, many once-popular antivirus and anti-spyware programs (Norton, Ad-aware, even venerable ones like AVG) are only good against more benign threats. If you've got a particularly nasty malware cocktail, your best bets today are Malwarebytes Anti-Malware, Super Antispyware, and tools like ComboFix. ComboFix is great, but it's meant to be used in cooperation with someone who is trained on its use, because part of a proper ComboFix-based cleaning is manually going through the log, picking out the bits of malware ComboFix DIDN'T remove, and manually creating a script that is passed to another run of ComboFix to remove the remaining nasties.

    That said, I had access (and the knowhow to use) all these tools, and I still had to nuke a machine from orbit six months ago. I have no idea where this particular malware was hiding, but I used ComboFix, cleaned off all the remaining nasties manually (with a CFScript.txt), got clean full scans from Malwarebytes, Super Antispyware, HijackThis and four different rootkit revealers, and when I rebooted that sucker came right back.

    DrFrylock on
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Update: a friend managed to open Windows onto a second partition for me.

    Is this a valid solution, or could it only lead to more problems down the line?

    Downside: it's practically a skeleton OS. No sound drivers, and I can't get the internet working either, reportedly because it's missing the network drivers as well.

    It's a Compaq SR1820NX, for whatever that's worth. I'm pretty sure I downloaded the right ones, but they don't seem to be updating right.


    Edit: got the sound working. Now I just need to figure out how to get the network adapter running.

    cj iwakura on
    z48g7weaopj2.png
  • mtsmts Dr. Robot King Registered User regular
    edited April 2009
    just go to the compaq site and download the drivers there, they should have all the drivers for that particular model

    mts on
    camo_sig.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    I can't find the network adapter (1394 Net Adapter) driver anywhere.

    Any leads on this?

    cj iwakura on
    z48g7weaopj2.png
  • eternalbleternalbl Registered User regular
    edited April 2009
    1394 is firewire. Unless you have any firewire devices the driver is completely unnecessary.

    eternalbl on
    eternalbl.png
  • cj iwakuracj iwakura The Rhythm Regent Bears The Name FreedomRegistered User regular
    edited April 2009
    Yeah, she's back up and running. A friend told me that I just had the setup configured improperly somehow.


    Thanks for the help all. :) As long as this partition stays clean(here's hoping), I think this is case closed.

    cj iwakura on
    z48g7weaopj2.png
Sign In or Register to comment.