 Badly Infected, Need Help, DO not know what got me |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help DO NOT post a ComboFix log unless requested to. Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jun 22 2008, 02:59 PM
Post
#16
|
|
|
Member  Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123  |
Thanks for your help, I really appreciate it! |
 |
 
|
|
Jun 22 2008, 06:50 PM
Post
#17
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Lets see if we can find out what's causing that error.
Click Start -> Run -> eventvwr.msc Look in SYSTEM and APPLICATIONS for anything around the time you've experienced the errors. Double click on anything you see with a red X, press the Copy button, and then paste it here in your next reply. --------------------  If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 23 2008, 08:39 AM
Post
#18
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Ok, here are all the system and application errors over the time I was working on it. I put the stuff in bold that occurred around the correct time frames. All the other issues also happened during crash times over the past few days. Thanks again!
Source: VSS Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206. Source: Application Hang Hanging application DesktopWeather.exe, version 5.2.0.1, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Source: Event System The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error. Source: Perflib The timeout waiting for the performance data collection function "PerfOS" in the "C:\WINDOWS\System32\perfos.dll" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted. Source: System Error. Event ID 1003, Category (102) Error code 000000f7, parameter1 00000000, parameter2 00004231, parameter3 ffffbdce, parameter4 00000000. Source: DCOM DCOM got error "The service did not respond to the start or control request in a timely fashion. " attempting to start the service ImapiService with arguments "-Service" in order to run the server: {520CCA63-51A5-11D3-9144-00104BA11C5E} Source Win32k Event ID 240 A request to suspend power was denied by winlogon.exe. Source: Service Control Manager, Event ID 7025 The following boot-start or system-start driver(s) failed to load: avipbb Fips IPSec MRxSmb NetBIOS NetBT P3 RasAcd Rdbss ssmdrv Tcpip Source: Service Control Manager Event ID 7001 The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. Source: DCOM Event ID 10005 DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Source: atapi Event ID 9 The device, \Device\Ide\IdePort0, did not respond within the timeout period. Source: Disk Event ID 7 The device, \Device\Harddisk0\D, has a bad block. This post has been edited by journey_sf: Jun 23 2008, 08:39 AM |
|
|
|
|
Jun 23 2008, 12:48 PM
Post
#19
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
This would be of particular concern to me.
QUOTE Source: Service Control Manager Event ID 7001 The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. It does seem to indicate a possible hardware issue. Click Start -> Run -> devmgmt.msc Are you seeing anything here that indicates a problem? It would probably show a question mark or exclamation point. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 23 2008, 04:38 PM
Post
#20
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Hello,
I checked it, the only thing with a exclamation mark behind it was the Ethernet controller. It said "Drivers not installed. Code 28" So, I guess if I download the drivers with another computer and then install them in the laptop it should work? All the other stuff in the Device Manager was fine. Anyway, I will try that now. Thanks again for your help. It is much appreciated! |
|
|
|
|
Jun 23 2008, 04:48 PM
Post
#21
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
That makes sense because if your Ethernet is not working correctly, you are definitely not going get online.
Let me know how it works out. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 23 2008, 05:11 PM
Post
#22
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Ok, I did that. Installed the driver. Still, I went online, and before the browser could show the website the same blue screen and the usual crash. I really do not understand this!
This post has been edited by journey_sf: Jun 23 2008, 05:35 PM |
|
|
|
|
Jun 23 2008, 05:16 PM
Post
#23
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
What's your device manager show? Are your drivers installed correctly?
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 23 2008, 05:36 PM
Post
#24
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Yes, the drivers are installed correctly.
I collected this data from the crash: Source: Application Error Event ID 1000 Faulting application spoolsv.exe, version 5.1.2600.0, faulting module ntdll.dll, version 5.1.2600.1106, fault address 0x0001aa5f. Source: System Error Event ID 1003 Error code 000000f7, parameter1 ef200400, parameter2 0000639b, parameter3 ffff9c64, parameter4 00000000. Source: W32Time Event ID 29 The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time. Source: W32Time Event ID 17 Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Source: Dhcp Event ID 1007 (This is called Warning, not error) Your computer has automatically configured the IP address for the Network Card with network address D213114FAEBC. The IP address being used is 169.254.61.210. Source: Service Control Manager Event ID 7031 The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. |
|
|
|
|
Jun 23 2008, 05:43 PM
Post
#25
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
That's odd. Those errors are related to your printer and timing. Neither of which should affect your browser or connection.
What browser are you using? Have you tried an alternate browser? Can you get a connection from other programs? Does your email work? -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 23 2008, 06:04 PM
Post
#26
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Well, I was also contemplating trying to download Firefox and see how that works. So far there is only the regular Microsoft Internet Explorer on there. I have not tried if other programs connect to the internet, as for email, it is not my PC and I therefore can only get to my email via a browser. Btw, the laptop still often sounds like it is being eaten. It is a weird crunching noise. Really hard to describe. It is doing that while I am doing nothing, while the laptop is just on.
I will try the Firefox option then and also see if other programs connect to the net. I will tell you what happens. Thanks. |
|
|
|
|
Jun 23 2008, 06:09 PM
Post
#27
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Sounds like a plan. If we can narrow it down to an IE problem, but Firefox and other programs connect fine that will help us.
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 23 2008, 06:21 PM
Post
#28
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Ok, it does not crash with Firefox, but I still have not connection, even though the wireless adapter is connected and receiving an excellent signal. Now, no program connects to the internet either. When I tried to go to a website with Firefox, the following error message appeared: Network Connection. Error 623: The system could not find the phone book entry for this connection.
Moreover, when I went into properties for the wireless network connection the tag that has all the IP and such information only showed "unavailable". There was no IP address, nothing. |
|
|
|
|
Jun 24 2008, 07:39 AM
Post
#29
|
|
|
Malware Expert Group: Malware Response Team Posts: 17,353 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
I've got one last trick that we can try and then I'm going to have to turn you over to the networking folks.
Download and run this tool. http://www.majorgeeks.com/download4372.html Reboot afterwards and check to see if anything has changed. If not, I would give your ISP a call and see if their tech support can help you restore a connection. You can also open a new topic here in the networking forum. http://www.bleepingcomputer.com/forums/ind...amp;s=&f=21 You'll get more useful advice from them there than you will from me. 
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 24 2008, 09:12 AM
Post
#30
|
|
|
Member Group: Members Posts: 20 Joined: 18-June 08 From: Alabama Member No.: 217,123 |
Thank you. The net is still not working though. I doubt that the ISP can help in this situation, since our internet overall is working. I will post in the networking forum, maybe they have some more ideas.
 I was wondering though, could it be that a PC is restricted to access the internet only with a specific IP address and to not do so if that IP address is not there? Anyway, you have been a great help. I really appreciated it. Take care, S.B. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 15th March 2010 - 04:54 PM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.