STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hello,

I work as a computer technician at a small private college on the Eastern shore of Maryland. I am mainly a Macintosh technician but I am trying to boost my skills with Windows more. With all that said, I had a student drop off a computer to our help desk running Windows 7 with the error of "STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program". I initially removed the hard drive and connected to one of our other Windows machines and scanned it externally using MalwareBytes and MSE. There were a number of infected items that both programs removed. I then reinstalled the hard drive and got the stop error again. After some Googling and seeing recommendations about AVG I check the Program Files via Command Prompt in the Recovery Console and AVG is not present.

I have used my box of tricks and need more help. If someone could help that would be great.

Matt

Hello, the malware infected the consrv.dll file and was removed.

Please go here....Preparation Guide ,do steps 6-9.

Create a DDS log and post it in this topic,thanks.
If GMER won't run skip it and move on.

Let me know if that went well.

boopme,

How do I run these from the Recovery Console as the computer will not boot?

Thanks,

Matt

Hello Matt,

Welcome to the forum. I'll assist with the issue.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.[/list]

Farbar here is the log:
Scan result of Farbar Recovery Scan Tool Version: 29-02-2012 01
Ran by SYSTEM at 01-03-2012 07:53:55
Running from F:\Bleeping Computer
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [497504 2009-08-21] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [909624 2009-08-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-07-29] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [1482080 2009-08-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-10-28] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [34648 2009-10-28] (TOSHIBA Corporation)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1294136 2009-08-17] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TWebCamera] "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun [2446648 2009-08-11] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-07-12] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2011-01-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-07-05] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-10-09] (Apple Inc.)
HKU\Owner\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2009-11-12] (Google Inc.)
HKU\Owner\...\Run: [ooVoo.exe] C:\Program Files (x86)\ooVoo\ooVoo.exe /minimized [21975120 2011-08-14] (ooVoo LLC)
HKU\Owner\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4240760 2010-11-09] (Microsoft Corporation)
HKU\Owner\...\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000 [x]
HKU\Owner\...\Run: [conhost] C:\Users\Owner\AppData\Roaming\Microsoft\conhost.exe [x]
HKU\Owner\...\Run: [winupd] C:\Users\Owner\AppData\Local\Temp\winupd.exe [x]
HKU\Owner\...\Run: [EMcGxdUaDTp.exe] C:\ProgramData\EMcGxdUaDTp.exe [x]
HKU\Owner\...\Run: [sIyTmnsPQfX.exe] C:\ProgramData\sIyTmnsPQfX.exe [x]
HKU\Owner\...\Winlogon: [Shell] explorer.exe,C:\Users\Owner\AppData\Roaming\dwm.exe
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
SubSystems: [Windows] ==> ZeroAccess

==================== Services (Whitelisted) ======

2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [462184 2011-08-30] (Apple Inc.)
3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe" [227232 2010-01-15] (McAfee, Inc.)

========================== Drivers (Whitelisted) =============

3 RSUSBSTOR; C:\Windows\System32\Drivers\RtsUStor.sys [x]
3 RtsUIR; C:\Windows\System32\DRIVERS\Rts516xIR.sys [x]
2 TMAgent; [x]
3 USBCCID; C:\Windows\System32\DRIVERS\RtsUCcid.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============



============ 3 Months Modified Files and Folders =============

2012-03-01 07:53 - 2012-02-29 14:11 - 0000000 ____D C:\FRST
2012-02-29 11:21 - 2009-07-13 21:32 - 0000000 ____D C:\Program Files (x86)\Windows Portable Devices
2012-02-29 11:16 - 2009-07-13 21:32 - 0000000 ____D C:\Program Files\Windows Portable Devices
2012-02-29 10:59 - 2010-01-21 20:42 - 3016884224 __ASH C:\hiberfil.sys
2012-02-29 07:30 - 2010-11-18 12:36 - 0006200 ____A C:\Windows\PFRO.log
2012-02-29 07:14 - 2011-05-19 05:29 - 0000000 ____D C:\Users\Owner\Samsung Epic Root (THIS)
2011-12-27 10:24 - 2010-01-21 20:48 - 1139439 ____A C:\Windows\WindowsUpdate.log
2011-12-27 10:23 - 2010-07-06 18:05 - 0000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2011-12-27 10:23 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2011-12-27 10:23 - 2009-07-13 20:51 - 0065549 ____A C:\Windows\setupact.log
2011-12-27 10:14 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2011-12-27 10:14 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2011-12-27 10:08 - 2011-12-27 10:08 - 0000000 ____D C:\Windows\System32\Macromed
2011-12-27 10:08 - 2011-05-17 18:41 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2011-12-27 10:07 - 2011-12-27 10:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{D6AD89CC-1CED-40B8-B2EE-279D390DEA0F}
2011-12-27 10:07 - 2011-12-27 10:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{9700832C-ECE9-4D96-BD4D-4BC58B3CC20F}
2011-12-27 10:07 - 2010-07-15 08:58 - 0000000 ____D C:\Users\Owner\AppData\Roaming\LimeWire
2011-12-27 10:07 - 2010-07-14 08:07 - 0000000 ____D C:\Users\Owner\Tracing
2011-12-26 18:23 - 2010-07-06 18:05 - 0000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2011-12-26 17:12 - 2011-12-26 17:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{D0C107F9-E8EE-41BC-8817-AAA9267157E7}
2011-12-26 17:12 - 2011-12-26 17:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{A76AE73D-FEC8-4622-8BB6-7CC1E60345FB}
2011-12-21 19:03 - 2011-12-21 19:03 - 0000000 ____D C:\Users\Owner\AppData\Local\{6B4917FE-74EE-4BB3-BD66-C2B660132A27}
2011-12-21 19:03 - 2011-12-21 19:03 - 0000000 ____D C:\Users\Owner\AppData\Local\{29D701D4-7DD2-4A21-BB5B-715DE9630EAD}
2011-12-21 19:02 - 2009-07-13 20:45 - 0343552 ____A C:\Windows\System32\FNTCACHE.DAT
2011-12-21 18:44 - 2011-07-15 20:55 - 0000118 ____A C:\Windows\System32\MRT.INI
2011-12-21 18:44 - 2010-01-21 20:53 - 0000000 ____D C:\Users\All Users\Microsoft Help
2011-12-21 18:44 - 2010-01-21 20:53 - 0000000 ____D C:\ProgramData\Microsoft Help
2011-12-21 18:42 - 2010-07-06 17:26 - 54867776 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2011-12-21 18:33 - 2011-12-21 18:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{7F900E4E-9F71-410C-9842-28FD31245D5B}
2011-12-21 18:33 - 2011-12-21 18:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{2C054170-0062-44B9-A848-DB6314A67335}
2011-12-15 19:16 - 2011-12-15 19:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{329E0E2E-4904-43E1-9D4B-7601257BD3E9}
2011-12-15 19:15 - 2011-12-15 19:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{EDD3977A-D7F7-4244-B001-4EFA8339A800}
2011-12-12 22:09 - 2011-12-12 22:09 - 0000000 ____D C:\Users\Owner\AppData\Local\{67EBABDA-C458-458E-8238-DD4006B77301}
2011-12-12 22:00 - 2011-12-12 22:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{E7289801-D334-4D33-8898-097F78460062}
2011-12-12 21:59 - 2009-07-13 21:13 - 0726316 ____A C:\Windows\System32\PerfStringBackup.INI
2011-12-12 21:56 - 2011-12-07 07:31 - 0016354 __ASH C:\Users\Owner\AppData\Local\luieiu2i6qxo0dcs4faq8t132n8m
2011-12-12 21:56 - 2011-12-07 07:31 - 0016354 __ASH C:\Users\All Users\luieiu2i6qxo0dcs4faq8t132n8m
2011-12-12 21:56 - 2011-12-07 07:31 - 0016354 __ASH C:\ProgramData\luieiu2i6qxo0dcs4faq8t132n8m
2011-12-10 19:48 - 2011-12-10 19:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{4D12AF3D-66F6-4FA0-82E5-FEC457CAEB2F}
2011-12-10 19:48 - 2011-12-10 19:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{48DCA087-ECFD-4DD0-8589-65E5F892E03C}
2011-12-07 07:32 - 2011-12-07 07:32 - 0000000 ____D C:\Windows\system64
2011-12-07 07:32 - 2009-07-13 21:37 - 0000000 ____D C:\Windows\SysWOW64\sysprep

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 15%
Total physical RAM: 3836.17 MB
Available physical RAM: 3258.57 MB
Total Pagefile: 3834.32 MB
Available Pagefile: 3245.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: (TI105736W0B) (Fixed) (Total:287.61 GB) (Free:213.87 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
4 Drive f: (ADATA UFD) (Removable) (Total:15.04 GB) (Free:14.99 GB) FAT32
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 0 B
Disk 1 Online 15 GB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Recovery 1500 MB 1024 KB
Partition 2 Primary 287 GB 1501 MB
Partition 3 Primary 9 GB 289 GB

======================================================================================================

Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D System NTFS Partition 1500 MB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C TI105736W0B NTFS Partition 287 GB Healthy

======================================================================================================

Disk: 0
Partition 3
Type : 17 (Suspicious Type)
Hidden: Yes
Active: No

There is no volume associated with this partition.

======================================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 15 GB 31 KB

======================================================================================================

Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F ADATA UFD FAT32 Removable 15 GB Healthy

======================================================================================================

==========================================================

Last Boot: 2011-11-05 08:30

======================= End Of Log ==========================

Well done.

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt

start
HKU\Owner\...\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000  [x]
HKU\Owner\...\Run: [conhost] C:\Users\Owner\AppData\Roaming\Microsoft\conhost.exe [x]
HKU\Owner\...\Run: [winupd] C:\Users\Owner\AppData\Local\Temp\winupd.exe [x]
HKU\Owner\...\Run: [EMcGxdUaDTp.exe] C:\ProgramData\EMcGxdUaDTp.exe [x]
HKU\Owner\...\Run: [sIyTmnsPQfX.exe] C:\ProgramData\sIyTmnsPQfX.exe [x]
HKU\Owner\...\Winlogon: [Shell] explorer.exe,C:\Users\Owner\AppData\Roaming\dwm.exe
SubSystems: [Windows] ==> ZeroAccess
C:\Users\Owner\AppData\Roaming\dwm.exe
2011-12-12 21:56 - 2011-12-07 07:31 - 0016354 __ASH C:\Users\Owner\AppData\Local\luieiu2i6qxo0dcs4faq8t132n8m
2011-12-12 21:56 - 2011-12-07 07:31 - 0016354 __ASH C:\Users\All Users\luieiu2i6qxo0dcs4faq8t132n8m
2011-12-12 21:56 - 2011-12-07 07:31 - 0016354 __ASH C:\ProgramData\luieiu2i6qxo0dcs4faq8t132n8m
end

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options and select Command Prompt.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Also please restart, let it boot normally and tell me how it went.

Farbar,

Thanks. The computer boots to the desktop now.

Thanks again,

Matt

Great.

Do you want me to continue or you want to do the rest on your own?

I think I can handle from here.

Thanks again.

You are most welcome Matt.

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send me a Private Message and I will reopen it for you.

If you should have a new issue, please start a new topic.

Every one else should start a new topic.