Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware, Black Door Trojan, Browser Hijack, Adware, Mirar, Virtumonde


  • Please log in to reply
18 replies to this topic

#1 lmfletcher

lmfletcher

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 03:27 AM

I've been trying to follow the on-line instructions for Spyware, Adware and Trojans. I've gotten through the Ad-Aware stage with an initial detection of 111 items and am now clean after 3 passes. Spybot identified other items and deleted a few then it froze up on me. I tried another item called Super AntiSpyware and it didn't do anything. I resorted to the product I bought at Best Buy a couple of days ago - it is Spy Sweeper by Webroot. It detected and cleaned 23 items. I went back in again and identified another item, but I still keep getting pop-ups and there are two icons on my desktop that I can't get rid of. The icons are two shields, one blue the other green. Each icon says Live Safety Center and Online Secuirty Guide. When I look at the properties on these icons, it comes back with hxxtp://htepo.com/cehpmoin/?......... Both of them are set up with this.

Internet Explorer opens continuously and since I am unplugged from the internet it can't find anything. It opens 50 some times - I don't know how to get it to stop. I probably need to upgrade the software for Adaware and Spy Sweeper to the latest version, but I'm afraid to plug my computer back on-line. I don't want to be open to the world and have sensitive information accessable.

The next step calls for me to run House Call Anti-Virus, but I will need to be on-line to do that. Can someone direct me to the next step and what I need to do from here? My computer is very slow and I am trying to kill these pop-ups when they come up. I don't want them to access something if I plug into the internet and they bring in other viruses - then I would end up with a whole new set of issues.

I need help and don't know what to do. Is there someone out there who can give me some direction? Please keep in mind that I have limited access to the internet and my e-mail since I am having to use another person's computer to communicate with the outside world. Any help you can provide is greatly appreciated. Thank you.

Edited by quietman7, 10 November 2007 - 07:51 AM.


BC AdBot (Login to Remove)

 


#2 Hauzer

Hauzer

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:United Kingdom
  • Local time:04:55 PM

Posted 10 November 2007 - 03:49 AM

Re-Format your computer, once reformated your computer will act as new, with notthing on it.

But personally, im not an fan of Reformating, so why not try the new Windows Defender.. it'll block all pop-ups and remove a whole lot of adware spyware.

I can't think of anyother ways to assist, since you've tryed pretty much everything eg. Spybot.. ect.. Sorry.

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:55 AM

Posted 10 November 2007 - 07:52 AM

There is no need to reformat.

If your using Win XP or 2000, please print out and follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob".
(scroll down to where it says Removal Instructions; ignore the part that shows symptoms in a HijackThis log as they will not apply your case.)
If you have downloaded SmitfraudFix previously, please delete that version and download it again as the tool is frequently updated!

Next, download RogueRemover and save to you Desktop. (compatible with Windows 2000, NT, XP, Vista)
  • Double-click on rr-free-setup.exe to install in C:\Program Files\RogueRemover and follow the prompts.
  • During installation an icon will automatically be created on your Desktop.
  • If the program does not open after installation, double-click on the RogueRemover icon to launch.
  • Select "Check for Updates" and click Download if any are found.
  • Wait for the updates to finish downloading, then Close the update window.
  • Select "Scan" and follow the onscreen directions to remove anything found.
  • If nothing is found, exit RogueRemover.
  • If RogueRemover finds something, it will present a list of detected items.
  • Click "Remove selected", then Yes at the prompt.
  • Wait for the removal to complete and then close RogueRemover.
If using Windows Vista be sure to Run As Administrator.

Then download and scan with SUPERAntiSpyware Free in "Safe Mode".

Edited by quietman7, 10 November 2007 - 07:52 AM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 01:37 PM

Thank you QuiteMan7 for replying to my post.

I did a Fast Reply and I don't know what happened to it. So, I will try to retype what I previously wrote.

I downloaded the items you mentioned to an external hard drive. I am using another person's computer that is not infected. I do not want to plug my computer back into the internet until I am completely clean and have the proper Virus software and Firewalls in place. That will be another post for later on. My question is in regards to having the latest of these downloaded versions. Many times it recommends that I connect and get the latest updates and I can't do that since my computer is "unplugged" from the internet. Is there any way I can download the updates to a file and save them on my external hard drive?

Thanks. I will let you know how it goes.

#5 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 05:11 PM

I ran through everything.

SmitFraud detected some of items. I remember SmitFraud as one of the ones that came up when I ran SpyBot S&D but SpyBot only got rid of a few things and left this behind.

I ran RogueRemover and it did not find anything. Please keep in mind that I did not down load any updates because I'm not plugged into the internet.

I ran Super AntiSpyware in Safe Mode and it found 36 items. Primarily a lot of Trojan items and Mirar. I quarentined and deleted these items. I read the Log File and then I think my system rebooted on it's own.

I brought the system up in Safe Mode again and everything is still there. The windows are popping up and I am receiving system altert ballons. I continue getting messages. The blue and green shields continue to stay on my screen - I can't get rid of anything. These icons link to hxxp://htepo.com. This is what I typed into Google and found your site 3 days ago.

It doesn't seem like anything I am doing is working. I am trying to run Super AntiSpyware again and it appears to be detecting the same items. I will let it run and see what happens. In the mean time, can somebody provide me with a response on what to do next.

Thanks.

Edited by quietman7, 10 November 2007 - 05:42 PM.


#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:55 AM

Posted 10 November 2007 - 05:41 PM

Please follow the the instructions for using Vundofix in BC's self-help tutorial: "How To Remove Vundo/Winfixer Infection".

There is no need to update any of these programs except SuperAntispyware which you can manually download them from here and unzip into the program's folder.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 05:48 PM

Should I update Super AntiSpyware first and rerun it before downloading and following the instructions for Vundofix?

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:55 AM

Posted 10 November 2007 - 05:57 PM

You can update SuperAntispyware but run it after using Vundofix.

These are the instructions after you install, update and get ready to scan.
  • Launch SuperAntispyware and on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 06:08 PM

For the instructions on Super AntSpyware that you just gave me. Do you want me to run this in Safe Mode or Normal Mode?

When I run in Safe Mode, my computer pops randomly opens a window letting me know I am in Safe Mode, it askw if I want to continue in Safe Mode and I answer Yes. If I'm not there to answer YES, it will make my Desktop Icons disappear. In order to reboot my computer I need to hold in on the power button. I'm not sure if that is part of the virus that has attacked my machine or not.

Thank you Quiteman7 for helping me. I will update later and provide my Scan Log results to Super AntiSpyware after I am done with the Vundofix. It will probably be a few hours - later tonight.

#10 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 06:08 PM

For the instructions on Super AntSpyware that you just gave me. Do you want me to run this in Safe Mode or Normal Mode?

When I run in Safe Mode, my computer pops randomly opens a window letting me know I am in Safe Mode, it askw if I want to continue in Safe Mode and I answer Yes. If I'm not there to answer YES, it will make my Desktop Icons disappear. In order to reboot my computer I need to hold in on the power button. I'm not sure if that is part of the virus that has attacked my machine or not.

Thank you Quiteman7 for helping me. I will update later and provide my Scan Log results to Super AntiSpyware after I am done with the Vundofix. It will probably be a few hours - later tonight.

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:55 AM

Posted 10 November 2007 - 06:20 PM

If you have a problem scanning in safe mode, then do it in normal mode.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 08:50 PM

I ended up running Vundo and then needed to run Virtumonde since the virus wasn't entirely gone. It looks like from that Log, there were some things that needed to be cleaned up and deleted and this program took care of that. After rebooting my computer, I still detected items missing or wrong. I could not pull up System Restore through Windows, unable to use Search in Windows Explorer and received a few pop-ups for ads (unable to connect since I am unplugged from the internet).

I installed the updates for Super AntiSpyware and tried to run it in Normal Mode. When I start the program, the timer starts and ticks along, and the file names show up as it is scanning, but no files show up on the right side. I stopped the process and ran it in Safe Mode. I started it about 1.5 hours ago and thought it should be finished. I came in to check on it and my desktop had disappeared (which I thought it would in Safe Mode). The Super AntiSpyware screen was the only thing visible with Safe Mode in each 4 corners. There was one file detected - Trojan.WinFixer and it showed about 7 subfiles. I wanted to see if there were other messages under the screen, so I minimized the SAS screen. When I tried to maximize it, I was unable to get it to come back up. I'm not sure where it is at in this process at this point.

Wait a minute . . . A screen actually just popped up and says 1 Memory Item Detected, 1 File Detected, 5 Registry Items Detected - Total Scan Time 1:28. I clicked on Continue and the screen shrinked back down to the minimized level again. I am going to try and cancel the process by "X"ing on the box in the left corner and see what happens. I will try and get the Log file and send it over with this post.

When I tried to "X" it, a box appeared and asks "Are you sure you want to cancel - harmful files exist on your computer?" When I answer no, it goes back to it's minimized state and I can't do anything. I went ahead and canceled and now it is rebooting in safe mode. I was able to go back into SAS and get the Log.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/10/2007 at 07:30 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type : Complete Scan
Total Scan Time : 01:28:08

Memory items scanned : 174
Memory threats detected : 1
Registry items scanned : 7133
Registry threats detected : 5
File items scanned : 47548
File threats detected : 1

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\PMKJJ.DLL
C:\WINDOWS\SYSTEM32\PMKJJ.DLL
HKLM\Software\Classes\CLSID\{7481E5E2-8E93-4656-9EF5-B1BFB1AC676E}
HKCR\CLSID\{7481E5E2-8E93-4656-9EF5-B1BFB1AC676E}
HKCR\CLSID\{7481E5E2-8E93-4656-9EF5-B1BFB1AC676E}\InprocServer32
HKCR\CLSID\{7481E5E2-8E93-4656-9EF5-B1BFB1AC676E}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7481E5E2-8E93-4656-9EF5-B1BFB1AC676E}


I am rerunning the Scan again and will quarantine and delete the items when it is complete in 1.5 hours. I will check back for your reply and see what I need to do from here based on what you see in the Log above.

Thank you.

#13 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 10 November 2007 - 10:41 PM

Got through a 2nd run of the Super AntiSpyware program. It came back with the same information that I had in the last post. This time I was able to Quarantine and Delete it. The log looks pretty similar to the last log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/10/2007 at 09:11 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type : Complete Scan
Total Scan Time : 01:30:10

Memory items scanned : 174
Memory threats detected : 1
Registry items scanned : 7133
Registry threats detected : 5
File items scanned : 47548
File threats detected : 1

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\PMKJJ.DLL
C:\WINDOWS\SYSTEM32\PMKJJ.DLL
HKLM\Software\Classes\CLSID\{AEAADBBE-D52D-4D08-AC6B-9FA8813CD788}
HKCR\CLSID\{AEAADBBE-D52D-4D08-AC6B-9FA8813CD788}
HKCR\CLSID\{AEAADBBE-D52D-4D08-AC6B-9FA8813CD788}\InprocServer32
HKCR\CLSID\{AEAADBBE-D52D-4D08-AC6B-9FA8813CD788}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEAADBBE-D52D-4D08-AC6B-9FA8813CD788}


I rebooted my system and it rebooted it into Safe Mode. I shut the computer down and tapped on F8 so I could select to start it in Normal Mode. I did that and it still started in Safe Mode. I'm not sure why this is happening, but I need to get it back into a Normal operating mode.

It appears that I am no longer getting those annoying pop-ups anymore and the Icons that were on my screen are now gone from the last time I deleted them. However, I am still unable to bring up System Restore or do a Search in Windows Explorer all while in the Safe Mode.

Why am I in a Safe Mode and what do I need to get back into a Normal Mode?
What is my next step?

How do I set up my system so it is safe from here on out? Do I need to start a new Thread for that?
Do you need me to complete some information on what I have in place? I did buy Spy Sweeper and Trend Micro Antivirus 2008 from Best Buy this week. I opened and installed Spy Sweeper, but I haven't opened Trend Micro.
Do I download need items? How many and what types (anti spyware, lavasoft, spybot, etc.)?
Do you have a link you can guide me to and I can follow?

Thank you for all your help!!

#14 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:55 AM

Posted 11 November 2007 - 07:09 AM

Did you follow the instructions in the link I provided for entering safe mode? If you used msconfig to force it while malware is on your system, that can be problematic. Some types of malware can delete or alter the safeboot key in the registry resulting in the inability to reboot into safe mode or back to normal mode.

Download SafeBootKeyRepair.exe by sUBs and save to your desktop.
  • Double-click on it and follow the instructions.
  • When finished, see if you can access safe mode.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#15 lmfletcher

lmfletcher
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:55 AM

Posted 11 November 2007 - 01:23 PM

I tried the Safe Boot Key Repair - here is the Log:

Reg export of SafeBoot key after repair:
========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"


I rebooted the computer and it still comes up in Safe Mode. It goes to the screen where you can select which type of Safe Mode and I tried to select "Normal Mode". It continues to come up in Safe Mode. What can I do now?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users