Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Slow Startup with a Beep


  • This topic is locked This topic is locked
20 replies to this topic

#1 Alfinator

Alfinator

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 08:16 PM

Hello everyone,

This is my first post.

My problem began when a warning popped up saying that I have the Win32.Zafi.B trojan which I believe I already removed.

I was then online and whenever I click on a link, it goes to a totally different site and I noticed in the processed in task manager that svchost.exe is coming up a lot. I went to boot up in safe mode and did a regedit and did a find on svchost and began deleting them. When I rebooted again, there's a beep and it takes so long for Windows to complete loading. A lot of my programs that are trying to access the internet began giving me lots of error messages. I could do a copy on a file or folder, but I am not given a paste option. I cannot connect to the internet with either Internet Explorer or Mozilla Firefox. When I'm on Windows Explorer and click on Search, the search menu doesn't show up on the left, only the dog assistant shows up. I tried doing from task manager, run, sfc /scannow, but that didn't do anything. I've tried booting with the Windows XP CD, but i couldn't figure out what to do.

Please help?

BC AdBot (Login to Remove)

 


#2 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 08:23 PM

Okay, I just did an sfc /scannow using start, run and that's currently working.

#3 I.T. Works

I.T. Works

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 08:25 PM

How did you remove the trojan? What programs did you use?

The svchost.exe that you see in task manager is normal and there should be quite a few of them. You can't use sfc to fix what happened because you damaged the registry and not the windows operating system. The only way to fix it is to do a system restore to before the problem started to restore your registry. Be warned that you will lose any system changes that occurred after the selected restore point but this is what we want. Try to boot into Safe Mode by hitting F8 before the Windows loading screen. When it loads click on Start, then Accessories, then System Tools, and then System Restore. Pick Restore from an earlier time and then choose a date before you started making changes. We'll deal with the virus removal after we repair the registry. Keep us updated.
-Nelson

#4 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 08:34 PM

It just finished and nothing got corrected.

Here's what seems to be a pertinent error:

RegisterClassObjects failed hRes = 0x800706BA

The RPC Server is unavailable.

Maximum retry attempts exceeded.

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,866 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:00 PM

Posted 20 January 2009 - 08:43 PM

Appears to me that you may want to post at BleepingComputer.com - Am I infected What do I do - http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

Take a look at http://www.bleepingcomputer.com/forums/t/125238/svchost-infected-by-wormagentbx/

Louis

#6 I.T. Works

I.T. Works

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 08:53 PM

Which part just finished, the chkdsk or the System Restore? I would expect if you can perform the System Restore we can get a good start on the problem.
-Nelson

#7 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 08:55 PM

I couldn't do the system restore since the taskbar with the "start" button is not even available in safe mode right now. The "lock taskbar" is checked and grayed out as well.

#8 I.T. Works

I.T. Works

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 09:02 PM

When in Safe Mode, can you hit Ctrl+Alt+Del and bring up the Task Manager. If so, you can click on File and then New Task. Type in "cmd" and hit enter to bring up a command prompt, and then type "%systemroot%\System32\restore\rstrui.exe" to run the System Restore tool manually. Follow the on-screen instructions from there. Let me know if this works.
-Nelson

#9 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 09:05 PM

I currently have this posted on the Windows XP Home and Professional forum:

Hello everyone,

This is my first post.

My problem began when a warning popped up saying that I have the Win32.Zafi.B trojan which I believe I already removed.

I was then online and whenever I click on a link, it goes to a totally different site and I noticed in the processed in task manager that svchost.exe is coming up a lot. I went to boot up in safe mode and did a regedit and did a find on svchost and began deleting them. When I rebooted again, there's a beep and it takes so long for Windows to complete loading. A lot of my programs that are trying to access the internet began giving me lots of error messages. I could do a copy on a file or folder, but I am not given a paste option. I cannot connect to the internet with either Internet Explorer or Mozilla Firefox. When I'm on Windows Explorer and click on Search, the search menu doesn't show up on the left, only the dog assistant shows up. I tried doing from task manager, run, sfc /scannow, but that didn't do anything. I've tried booting with the Windows XP CD, but i couldn't figure out what to do.

Please help?

Additional info:

I did sfc /scannow

Here's what seems to be a pertinent error:

RegisterClassObjects failed hRes = 0x800706BA

The RPC Server is unavailable.

Maximum retry attempts exceeded.

#10 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 09:10 PM

System Restore give me an error:

"System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again."

#11 I.T. Works

I.T. Works

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 09:15 PM

Okay try it again from the Safe Mode with Command Prompt option on the screen after you hit F8. Only this time you just need to put in the second part of my previous post.
-Nelson

#12 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 09:20 PM

Same message came up:

"System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again."

#13 I.T. Works

I.T. Works

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 09:56 PM

That would seem to me that System Restore is corrupted either in the registry or it's system files or both. Or, it was never turned on to begin with and now it can't run because of the damage done. I would strongly suggest you run a multiple virus scans using another computer with your hard drive attached or an AV boot cd with the latest definitions. You can find more help with that on the link posted by hamluis earlier. I know for a fact that some viruses do block System Restore. I would suspect a rootkit.

Alternatively, if there are any files you want to keep use another computer to search your hard drive and copy them to a flash drive or something. Then install Windows from scratch. Most repairs like this are beyond help that can be reasonably obtained in a forum and in these instances a clean install is the best way. Good luck.
-Nelson

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:00 PM

Posted 20 January 2009 - 10:07 PM

Hello I am moving your topic to the AM I Infected from XP forum so we can scan for malware and find what is or isn't here
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 Alfinator

Alfinator
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2009 - 10:18 PM

Okay, thanks. I think I have a duplicate post there too.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users