Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

All services stopped?


  • This topic is locked This topic is locked
52 replies to this topic

#1 Heretolearn

Heretolearn

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 12 March 2010 - 12:41 PM

I have a sony notebook that was working fine before kids played with it sad.gif . I searched every where no results. No icon loads when I click them. Someone told me to check what services are running and all of the services says stopped. ? Can't do system restore. When I try something pops up and says turn a service on when I try no luck. Safe mode produces the same results. If anyone know what's going on, your help would be really appreciated.

BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:04:27 PM

Posted 12 March 2010 - 12:57 PM

Are you able to open Task Manager?
In the Applications window, end all of the tasks
Start a new task and type explorer.exe
If that works, run some virus scans

You might want to submit a DDS log, following the directions here:
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 Heretolearn

Heretolearn
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 12 March 2010 - 01:24 PM

Thank for your reply. I can open task manager. Tried that but still nothing. Umm weird but in msconfig I noticed that almost every service that should have Microsoft as the manufacturer all says unknown if that helps. And every service reads stopped as the status.

Edited by Heretolearn, 12 March 2010 - 01:24 PM.


#4 Heretolearn

Heretolearn
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 13 March 2010 - 06:59 PM

Should I just throw it away? unsure.gif I mean it is a nice laptop.

#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:27 PM

Posted 13 March 2010 - 07:23 PM

Do you have any important data on your computer?
Do you have Windows XP CD?

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#6 Heretolearn

Heretolearn
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 13 March 2010 - 08:32 PM

I do not have any important data. And no I do not have any disk.

#7 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:27 PM

Posted 13 March 2010 - 11:16 PM

Hopefully, your Sony has recovery partition, which you should be able to access by pressing F10 at Sony's logo.
It'll return the laptop to day one status.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#8 Heretolearn

Heretolearn
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 16 March 2010 - 08:20 AM

Sorry for responding late, but when I tried that there was a loading bar that came across the screen then it goes strait to the xp logo every time.

#9 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:27 PM

Posted 16 March 2010 - 04:06 PM

Since your kids were playing with the machine, there is a good chance, it may be infected.
I'll ask malware people to take a look at this thread.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#10 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:27 PM

Posted 16 March 2010 - 06:32 PM

Hi Heretolearn,

Welcome to Virus/Trojan/Spyware/Malware Removal (VTSMR) forum. I am going to assist you with your problem.

Please refrain from making any changes to your system (scanning or running other tools, updating Windows, installing applications, removing files, etc.) from now on as it might interfere with our fixes. Please let me know in your next reply if you agree with this.

Tell me about your current condition of your computer. You can't access Internet with Internet Explorer, can you?

Bring up the task manager, under File > New Task (run...) and type cmd and click OK. See if the command window opens.
Also type notepad and click OK. See if the notepad opens. If yes click on My computer in the left pane and tell me if it opens. If yes insert a flash drive and tell me the drive letter of your flash drive.

Edited by farbar, 16 March 2010 - 06:36 PM.


#11 Heretolearn

Heretolearn
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 16 March 2010 - 07:43 PM

Yes I agree with the terms.

Current condition: No icon loads when I click them. All services in msconfig says stopped . When I try to start them in computer management it gives me different types of error messages. Cannot connect to internet via Ethernet nor wireless. I recently installed firefox by flashdisk to see if it would open which it does.

The command window opens and so does the notepad. I am able to click my computer. The flash drive letter is E

#12 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:27 PM

Posted 16 March 2010 - 08:06 PM

Thanks for the feedback.

On the working computer please run Notepad (start > All Programs > Accessories > Notepad) and copy and paste the text in the code box (without the word CODE) into a new file:


CODE
@ECHO OFF
dir /a /s "%driveroot%\svchost.exe" >log.txt
cacls "%windir%\system32\svchost.exe" >>log.txt 2>&1
net start >>log.txt
START log.txt

  • Go to the File menu at the top of the Notepad and select Save as.
  • Select Save in: flash drive
  • Fill in File name: look.bat
  • Save as type: All file types (*.*)
  • Click save.
  • Close the Notepad.
  • Insert the flash drive to the problem computer.
  • Locate look.bat on the flash drive. It should look like this:
  • Double-click to run it.
  • Wait until notepad opens, a copy of it (log.txt) will be saved on the flash drive. Copy and paste the content (log.txt) to your reply.


#13 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:27 PM

Posted 16 March 2010 - 08:32 PM

It is too late here and I'm going to sleep. I'll see the log tomorrow.

You said you could open Firefox so you should be able to run the batch file. But in case you could not run it by double-clicking you can type e:\look.bat in the New Task (run...) and click OK to run it.

#14 Heretolearn

Heretolearn
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Location:New York
  • Local time:04:27 PM

Posted 16 March 2010 - 09:30 PM

Volume in drive E has no label.
Volume Serial Number is 001E-610B
C:\WINDOWS\system32\svchost.exe Everyone:(NP)(special access:)

DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
STANDARD_RIGHTS_REQUIRED
FILE_READ_DATA
FILE_WRITE_DATA
FILE_APPEND_DATA
FILE_READ_EA
FILE_WRITE_EA
FILE_EXECUTE
FILE_DELETE_CHILD
FILE_READ_ATTRIBUTES
FILE_WRITE_ATTRIBUTES


These Windows services are started:

Ati HotKey Poller
Event Log
Java Quick Starter
Plug and Play

The command completed successfully.



#15 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,719 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:27 PM

Posted 17 March 2010 - 02:36 AM

Could you double-click or you had to run it from the Run box?
  1. On the working computer right-click look.bat on your flash drive and select Edit.
    Copy and paste the following text in the code box to replace the previous one:
    CODE
    @ECHO OFF
    dir /a /s c:\svchost.exe >log.txt
    cacls c:\windows\system32\svchost.exe >>log.txt 2>&1
    net start >>log.txt
    START log.txt


    Under File menu click Save.

  2. Again on the working computer please run Notepad (start > All Programs > Accessories > Notepad) and copy and paste the text in the code box (without the word CODE) into a new file:


    CODE
    @ECHO OFF
    Echo y| cacls c:\windows\system32\svchost.exe /p users:R Administrators:F system:F
    sc config wuauserv start= disabeld
    sc config Eventlog start= disabeld
    cacls c:\windows\system32\svchost.exe >>log.txt 2>&1
    start log.txt
    • Go to the File menu at the top of the Notepad and select Save as.
    • Select Save in: flash drive
    • Fill in File name: look.bat
    • Save as type: All file types (*.*)
    • Click save.
    • Close the Notepad.
    • Insert the flash drive to the problem computer.
    • Locate fix.bat on the flash drive. It should look like this:
    • Double-click or type e:\fix.bat in the New Task (Run...) and click OK to run it.
    • Wait until notepad opens. Close it.

  3. Important:Reboot now.

  4. Run look.bat after reboot and copy and paste the content (log.txt) to your reply. Tell me also if you see any difference in performance.
    Note: In case the performance improves it doesn't mean we are done. We still have to check and clean the computer. Try not to use it, check the internet connection but keep it disconnected after that and not reboot it frequently until we run some scans.

Edited by farbar, 17 March 2010 - 06:59 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users