Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Codec D/l = No Xp Taskbar, No Start Button, No Internet


  • This topic is locked This topic is locked
9 replies to this topic

#1 Connectigreg

Connectigreg

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 26 April 2008 - 10:07 AM

Hello, everyone - this is my first new topic post to your forum. Working recently on my Compaq Presario S3200NX PC, my teenage son attempted to download a codec for an online gaming experience, and, instead, presumably downloaded and unleashed a virus or other malicious program that has taken out the Windows XP taskbar, start button, and internet access (IE flashes momentarily but does not open). In that we no longer have internet access via that computer, I am not able to go through a couple of the steps that are recommended prior to posting HijackThis! logs here for that PC. However, using a flash drive, and given that Spybot S&D was already installed on the PC, I have run many different protocols in an attempt to discover what the problem may be, and remedy the situation. To date, none of these programs have given any indication that they are able to detect what the problem actually is. I do have HijackThis! logs taken in both safe and normal modes that are ready to post, and I am open to any other suggestions in the meantime. In appreciation - Connectigreg

BC AdBot (Login to Remove)

 


#2 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:12:31 AM

Posted 26 April 2008 - 01:14 PM

Hi; have you yet used the flash drive to put on it the superantispyware and asquared programs that will produce reports for examination?

scroll down to spyware removal for some program ideas
http://www.bleepingcomputer.com/forums/topic3616.html


be wary of getting an infection transfered on the flash drive too :thumbsup:

#3 Connectigreg

Connectigreg
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 26 April 2008 - 02:18 PM

Thank you, "to whom it may concern" for moving my thread to the correct forum! I cannot run Kaspersky or Asquared programs because both of them (I am fairly certain) require Internet access via the infected computer, and I no longer have Internet access. I have run several of the other recommended programs (those that I can save to a flash drive and install on the infected computer; those that do not require Internet access to install and run) and they have not detected the source of the problem. I will try SuperAntispyware now and see whether that tells me anything.

#4 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:12:31 AM

Posted 26 April 2008 - 03:19 PM

if you can download to SOMETHING the exe's and the updates FOR the programs and transfer them to the infected computer? then run them and get report/logs off them ?

when you ran the previous scans on the infected computer and saw the results ,did you search on google for any idea as to what MIGHT have grabbed the infected one so we can have SOME idea as to what might be going on?

be careful you do not transfer the infection to the clean computer via the 'something ' you use to get the programs ON the infected computer :thumbsup:

#5 Connectigreg

Connectigreg
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 26 April 2008 - 09:33 PM

I have to admit that this all happened at the start of April and I've been busy with other things since. When I tried to install SuperAntispyware on the infected computer today, I am getting "The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode [I was not] or if the Windows Installer is not correctly installed". So, I cannot install SuperAntispware on the PC right now. As I mentioned in my first post, I do have HijackThis! logs in safe and normal modes that I could post right now - would they help? FYI - all of my files are still fine on the "infected" PC, and the "infection" or malicious program doesn't appear to be something that would jump onto a flash drive and onto the laptop I am working on here. I just don't have a taskbar, a start button, or Internet access on the PC.

#6 Queen-Evie

Queen-Evie

    Official Bleepin' G.R.I.T.S. (and proud of it)


  • Members
  • 16,485 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:06:31 PM

Posted 26 April 2008 - 09:55 PM

There are work-arounds to getting on the internet.

1) Hold down ctrl-alt-delete keys at the same time. This should bring up task manager.
If task manager opens, Applications tab. New Task.
Type in iexplore.exe
Click OK. Internet Explorer will open.

2) Are there any other user accounts set up on the computer? If so, try to connect to the internet
from one of them. If not, boot into safe mode. Log on as administrator.
If the start menu is there, Control Panel/User Accounts.
Create a new user account. (You can delete the account later)
Reboot. Log in using the new account if the desktop shows up.

You can try Superantispyware again, and you can at least update what you already have on the computer.

Edited by Queen-Evie, 26 April 2008 - 09:58 PM.


#7 Connectigreg

Connectigreg
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 27 April 2008 - 09:53 AM

Dear Queen-Evie:
1) Internet Explorer still will not open - it "flashes" quickly then closes again. "iexplore.exe" is already running in my Task Manager.
2) My son uses Mozilla Firefox on his user account, and the same thing is happening on that account.
Start Menu does not appear when I boot in safe mode. I will try to create a new user account, but I do not believe this will help me. I may not be able to access Control Panel from Administrator, anyway - I am able to access it through my son's user account, however, and I believe he has Administrator privileges (that may change in the future!).
This morning I saw a balloon at the bottom of my desktop, pointing to where the Tasbar should be, saying "Java Update Available ... ".
I clicked on the balloon and got "Java Update cannot proceed with the current internet connection settings of your system. In your Windows Control Panel, please check Internet Options > Connections to make sure the settings and proxy information are correct."
When I do that I don't see anything at all on these screens - FYI, I access the internet via a high-speed broadband connection offered by my local cable TV provider.
Am I limited to using SuperAntiSpyware as my next step here? I have run Avast! Antivirus, Spyware Blaster, CCleaner, Spybot S&D so far and have come up empty (I am going to look around to see what else I tried earlier in April).
Thanks for your assistance so far!

#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:31 PM

Posted 27 April 2008 - 08:26 PM

Hello you have serious,buried and protected malware. You will need the HJT team to get inside and clean this out.
Please post your log here.
HijackThis Logs and Malware Removal

Let us know in this topic that you have successfully posted ithat forum.thanks.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 Connectigreg

Connectigreg
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:06:31 PM

Posted 04 May 2008 - 09:44 AM

Thank you for your patience. One week has passed, and I have successfully posted the requested logs (minus a Kaspersky report) in the appropriate forum. I await your analysis and response. - Connectigreg

#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:31 PM

Posted 04 May 2008 - 04:00 PM

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

If after 5 days you still have received no response, then post a link to your HJT log in the thread titled "Haven't Had A Reply In Five Days?".

To avoid confusion, I am closing this topic.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users