Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Xp Pro - Partial Log On - Pilot Error!


  • Please log in to reply
11 replies to this topic

#1 whftherb

whftherb

  • Members
  • 49 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:23 PM

Posted 28 August 2008 - 09:40 AM

I am in need of some sage advice from the forum members here. Background: Win XP Pro, fully updated. Athlon 64 single core with 1 gB RAM, large HDD half full. 2 optical drives, no floppy. FIOS networking to the 'net. System is used general purpose for web surfing, and file storage on my home network. Kind of like a little server thing. External USB HDD for backup (thank God).

What I did (and will never do again...). Downloaded a "game pack" which was supposed to contain some "old favorites" from the retro 16-32 bit era. Decided to look into the pack to see. The loader puts out a selection panel. It loads partially but SpyBot S&D 1.6 barfs and reports a process trying to install a BHO. It's stopped while I choose "Deny". Interestingly, and FWIW I thought the term BHO stood for "Browser Hijack Object" at that moment only find out BHO stands for Browser Helper Object. The deny yields another SpyBot warning with a slightly different registry value cited, I deny that. A third pops up, I deny; and a fourth, I deny and so forth. Well I got really tired of continuous clicking so I asked SpyBot to remember my answer. And now a whole stream/plethora of SpyBot warnings ensue. I let it run but after a half hour of this, I'm convinced I'm stuck in loop. So Ctl-Alt-Del and kill Spybot. System is hung. Ctl-Alt-Del again and request a reboot. Reboot occurs but SpyBot is still warning and we're still in the loop. Reboot a third time. This time I say "Allow" and remember the change so I can move on but SpyBot is stuck on "Deny" for some reason. Ctl-Alt-Del to look for the process that's causing this. Can't find anything out of the ordinary. Reboot. Note: This was a "game pack" offered off of a user group BBS I frequent. I know you're all thinking what a dumbo but 3 other independent users there have confirmed (after I posted to warn about this issue) that the game pack is not viral nor does it contain spyware. So I attrribute this mess strictly to "pilot error".

I was also able to just barely scan the pack with my version of NOD32 ESS. Came up nil. In Safe Mode (see below) I was just able to ge SpyBot to scan the system for baddies. It found three and cleared them, rescanned, found none: System is clean. Able to get chkdsk to run all 5 modules. Nothing found. System has not BSOD'd.

What's happening now is this: Let Windows boot regularly. I get the desktop, wallpaper and task bar. Disk is running looks normal. After a moment or two disk fires up, the desktop icons and task bar both disappear. A moment later they'll re-appear for about 10-15 seconds then disappear. A moment later they'll re-appear for about 10-15 secs then disappear. After seven or eight cycles of this behavior activity stops with just the wallpaper showing. Ctl-Alt-Del works. I found in that applet that I can Run a New Task called "desktop" (to call the DT to the fore) and the icons/task bar reappear. Once again, after a moment or two the desktop icons and task bar both disappear. A moment later they'll re-appear for about 10-15 seconds then disappear. A moment later they'll re-appear for about 10-15 secs then disappear... I won't go on but you get the pattern here. Some unknown process is calling for some file to be loaded. When I call the desktop to the fore, Windows reports that it cannot locate '/idlist,:0:1124,C:\Documents' (looks like a corrupted reference) This box dismisses after a moment, followed by you-guessed-it...

I have almost the same exact behavior in Safe Mode. Except that Windows puts up its Safe Mode warning box. I can either click Yes or wait 10 secs and the box self-clears and we resume the cycle of no_desktop & no_icons and the Safe Mode warning box returns. Wait or click Yes and it loops back again. I have it up now in regular Windows "Diagnostic Mode" with the same behavior. Again, I can pull up the desktop if it escapes I can use Task Mgr to call it back.

The big problem: I only get about 10 seconds to launch an app or hit something in either Reg or Safe Mode before that is interrupted by this no_desktop/no_icon behavior. Once something is launched, it will run for a while but usually I wind up with a hung app. I can see in Task Mgr that the process "explorer.exe" is running when the desktop/taskbar appear normal but when they disappear, explorer.exe vanishes from Task Mgr. When the desktop/icons reappear, explorer.exe returns to Task Mgr. This is a significant clue, I believe. Because explorer dies, I'm unable to work with my folders/files though I can see them until explorer dies. I managed to put up Add/Remove Progs only to find nothing out of the ordinary installed. I can succesfully work in a DOS-box uninterrupted. I am logged on although probably only partially - as the systems' drives are fully reachable via my router-based network. Again, the big problem here is that I can't get a detailed look at my processes that are running. Task Mgr doesn't give me deep enough detail and everything that it shows looks legit in my experience. Because I only have 10 seconds or less to do something, I'm unable to use a prog like Winternals or Mike Lin's StartUp utility to look any deeper at the processes running to evaluate what's going on. Why not? Because unless I can quickly (and I mean quickly) launch something and get it running, the cycle breaks the launch and we're back to no icons/no task bar, yada-yada.

Restore it? Uh-uh because all my restore points are gone! Quite unbeknownst to me something cleared them out (maybe it was CCleaner which I use regularly) and I only have one from 8/27 at 8:15 AM around the time I was mussing with my game pack. (Restoring restore points and trying to figure out what caused them to clear is number one on my list to check out when I get this back...)

Are you thinking repair install at this moment? I'd like to try to fix this without repair install if I can. So can I get some additional suggestions for things I can try?

Update at 3:15 PM. I left this on the desktop for the afternoon and came back from errands after about 3 hours. Look (I said), it's almost working! I don't see explorer disappear from the task mgr. I can launch Windows Explorer (Win-E) and it sticks! Here's another hint - when I hit Win-E, rundll.exe appears in Task Mgr. When I kill it, the Explorer window completes loading showing the directory tree on the left and so forth. This reminds me that "Run rundll.exe as an application" was part of the warning stream put out by SpypBot. If I could just get to that rogue application that is calling to run rundll as an app, I'll bet that would solve this. Agree? What do I use to thoroughly review what's being launched at startup?

Edited by whftherb, 28 August 2008 - 02:22 PM.


BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:23 AM

Posted 28 August 2008 - 04:07 PM

You can use AutoRuns to review your startups.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 whftherb

whftherb
  • Topic Starter

  • Members
  • 49 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:23 PM

Posted 28 August 2008 - 07:19 PM

OK, here's where I am now. There is progress though it's not fixed completely. Left system run in Diagnostic mode all afternoon to just continue it's "cycling" to see what might happen. Came home and it appears stable although somewhat sluggish in Diagnostic mode. At this writing, I have not tried to let it go to normal boot into XP. I have been able to launch StartUpList.exe by Merijn (http://www.merijn.org/index.php) and I have the dump now on the desktop. I've got to get it on the thumb drive but in Diagnostic mode, all external devices appear to be disabled. There are no floppies on the sick system nor the system I use to access this forum.

Would a dump from StartUpList help the folks here help me figure out what is causing this partial loading?

Let me know and I'll try to figure out a way to get it over to the working system.

Thanks.

Edited by whftherb, 28 August 2008 - 07:25 PM.


#4 Galadriel

Galadriel

    Bleepin Elf


  • Malware Response Team
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Missouri, USA
  • Local time:01:23 PM

Posted 28 August 2008 - 08:03 PM

See if you can run this batch. You may need to exit Teatimer first. It can be tricky with little time, but see if you can do it.

Download ResetTeaTimer.bat to the Desktop
http://downloads.subratam.org/ResetTeaTimer.bat
Double click ResetTeaTimer.bat
to remove all entries set by TeaTimer (and preventing TeaTimer to restore them upon reactivation).

I'm thinking something is blocking explorer, and it probably is Teatimer. See if that helps.

Edited by Galadriel, 28 August 2008 - 08:06 PM.

I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'

Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook

#5 whftherb

whftherb
  • Topic Starter

  • Members
  • 49 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:23 PM

Posted 28 August 2008 - 09:46 PM

That's it! I was soooo lucky this time!!! I got a chance to quickly navigate to Add/Remove and I caught a break - was just able to uninstall the whole SpyBot app, and I guess including TT. I might as well run the batch file too - it can't hurt. Right after dismissing Add/Remove, I noticed huge improvements. So, I set up MSCONFIG to start all services and so forth, rebooted. Viola'! I think I have it back!! That startup list dump would've made many enemies here - looong! I need to now go through and make sure that it's all working including my AV. But I am pretty sure it is.

Now I really need to dig into the reasons behind the restore points disappearing when I know I have the service turned on and I know that the drive was being "monitored". Does anyone know of any other reasons why restore points dissolve when I don't want them to? What do I start looking for besides the service and the settings in My Computer > System Props. Should I start a new thread for that one???

Big props to Galadriel.

Edited by whftherb, 28 August 2008 - 09:48 PM.


#6 Galadriel

Galadriel

    Bleepin Elf


  • Malware Response Team
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Missouri, USA
  • Local time:01:23 PM

Posted 28 August 2008 - 09:59 PM

Glad to hear it! :D :thumbsup:

As far as restore points go, there can be a few reasons. Do you use any cleaner type app? Like Ccleaner? Or something similar?

I'd be interested to see the log you have... can you upload it? Don't copy paste it, just upload/attach it if you can.

Edited by Galadriel, 28 August 2008 - 09:59 PM.

I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'

Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook

#7 whftherb

whftherb
  • Topic Starter

  • Members
  • 49 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:23 PM

Posted 28 August 2008 - 10:36 PM

Yes I do use CCleaner and I did think of that but I looked for options to "clear" restore points. Do you know where the option is. I'll bet that's what did it!

I'm so happy now, I could just go ape -- :flowers:


The file is uploaded for your perusal. Yes, I did clean it of personal data, too. :thumbsup:

#8 Galadriel

Galadriel

    Bleepin Elf


  • Malware Response Team
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Missouri, USA
  • Local time:01:23 PM

Posted 28 August 2008 - 11:01 PM

I really can't advise you about CCleaner. But it is likely something like that which caused it. From the looks of the log you uploaded, the service is functional. I suggest not using CCleaner for a while and see if that solves the problem.
I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'

Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook

#9 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:23 AM

Posted 28 August 2008 - 11:07 PM

I've been using CCleaner for a couple of years and have never had it clear my restore points, and there's no option for it to do that either. I never use the registry cleaner function though.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#10 Galadriel

Galadriel

    Bleepin Elf


  • Malware Response Team
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Missouri, USA
  • Local time:01:23 PM

Posted 28 August 2008 - 11:12 PM

I've been using CCleaner for a couple of years and have never had it clear my restore points, and there's no option for it to do that either. I never use the registry cleaner function though.


Quite frankly, I never used it and don't plan to. Heard too many horror stories of unbootable OSes from people who've used it to be comfortable with recommending it.

As far as I can see, after doing some more research on the subject, CCleaner isn't supposed to clear restore points. But disc cleanup will, at least all but the most recent ones. Disappearing restore points are odd though. Unless it's reached its limit in terms of space used.
I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'

Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook

#11 whftherb

whftherb
  • Topic Starter

  • Members
  • 49 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:23 PM

Posted 29 August 2008 - 07:48 AM

So let me ask, if you don't mind. What IS your favorite cleaner?

There doesn't seem to be the option in CCleaner. I'm still working on why those restore points went south.

Edited by whftherb, 29 August 2008 - 07:49 AM.


#12 Galadriel

Galadriel

    Bleepin Elf


  • Malware Response Team
  • 2,753 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Missouri, USA
  • Local time:01:23 PM

Posted 29 August 2008 - 12:33 PM

Actually, for temp files and such I usually use disc cleanup. Once in a blue moon I'll use ATF-Cleaner.

I used to use System Security Suite (3S) but I haven't in a while. It was also pretty good.
I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'

Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users