Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Corrupted files Fix, troubleshooting, replace


  • This topic is locked This topic is locked
27 replies to this topic

#1 Robyn53

Robyn53

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 27 October 2010 - 12:22 PM

I have an issue with msconfig.exe. I cannot open it, a command window pops up briefly and that is all I get. I run Vista on my computer and the file is in System 32, but if I double click on it, it does the same thing. When I look in REGEDIT, it is not in the application paths. I tried to make a new key with the path to where it is, but that didn't work. I ran SFC and Windows Resource Protection found 6 corrupt files but was unable to fix them.
3 of them were DLL-- devmgr.dll (I cannot access Device Manager either); dinput8.dll; and mycomput.dll; 2 EXE files--msconfig.exe and msinfo32.exe; and one CPL file--collab.cpl.
I know how to replace the DLL files with non corrupt ones I can download, but I do not know how to fix the other files.
CAN ANYONE HELP ME? I don't want to run a clean restore if I can just fix these 6 files. I also don't want this to turn into a worse scenario. Not sure if it is a rogue, trojan or virus, if it is I cannot find it with all of these programs I am running. I have a McAfee subscription that is kept updated, I run SuperAnti-spyware once a week, MalwareBytes and CCleaner.

Edited by boopme, 27 October 2010 - 03:08 PM.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,614 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:12 AM

Posted 28 October 2010 - 12:24 AM

Vista should have plenty of replacement files.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

64-bit users go HERE
  • Double-click SystemLook.exe to run it.
  • Vista users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following box into the main textfield:
    :filefind
    dinput8.dll
    devmgr.dll
    collab.cpl
    msinfo32.exe
    msconfig.exe
    mycomput.dll
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 28 October 2010 - 01:55 PM

I sure will. I actually ran Malwarebytes yesterday and it found a backdoor.bot attached to the msconfig.exe file. It took care of that and I was then able to load a new msconfig.exe file into the SYS32 folder and make a new key in the registry. So the msconfig issue is fixed.
But the device manager failure and other 4 corrupted files, I am having no luck with. So I will download your program and post it.
Thank you for your help.
Robyn

#4 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 28 October 2010 - 02:06 PM

SystemLook 04.09.10 by jpshortstuff
Log created at 14:58 on 28/10/2010 by Robin Bryson
Administrator - Elevation successful

========== filefind ==========

Searching for "dinput8.dll "
C:\Windows\System32\dinput8.dll --a---- 159232 bytes [12:56 26/11/2008] [07:34 19/01/2008] 7CB022733B3413C9C6B1BE0A4AEA13DC
C:\Windows\winsxs\x86_microsoft-windows-directx-directinput_31bf3856ad364e35_6.0.6000.16386_none_1b6158400ec3acf3\dinput8.dll --a---- 159232 bytes [12:34 02/11/2006] [12:34 02/11/2006] F4211E2AC6268D9365199000ED6A2379
C:\Windows\winsxs\x86_microsoft-windows-directx-directinput_31bf3856ad364e35_6.0.6001.18000_none_1d981a3c0baebdc7\dinput8.dll --a---- 159232 bytes [12:56 26/11/2008] [07:34 19/01/2008] 7CB022733B3413C9C6B1BE0A4AEA13DC

Searching for "devmgr.dll "
C:\Users\Robin Bryson\AppData\Local\temp\Low\devmgr.dll --a---- 51040 bytes [00:38 28/10/2010] [00:41 28/10/2010] 17F9A9642B90C8FCE8B179346AA36658
C:\Windows\System32\devmgr.dll --a---- 378368 bytes [00:28 17/09/2009] [06:28 11/04/2009] 518BD29CF7F23E488D46C7CBCA4D9AD2
C:\Windows\winsxs\x86_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_6.0.6000.16386_none_119fd8762295a7d9\devmgr.dll --a---- 377344 bytes [08:33 02/11/2006] [09:46 02/11/2006] 83FB2295515367F120F1D811221A664B
C:\Windows\winsxs\x86_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_6.0.6001.18000_none_13d69a721f80b8ad\devmgr.dll --a---- 377344 bytes [12:57 26/11/2008] [07:34 19/01/2008] 9E6707CAC0A742A0B13C6D238532AD18
C:\Windows\winsxs\x86_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_6.0.6002.18005_none_15c2137e1ca283f9\devmgr.dll --a---- 378368 bytes [00:28 17/09/2009] [06:28 11/04/2009] 518BD29CF7F23E488D46C7CBCA4D9AD2

Searching for "collab.cpl "
C:\Windows\System32\collab.cpl --a---- 83968 bytes [12:35 02/11/2006] [12:35 02/11/2006] 07B3C6F9E09838F4346F4887ACD1C235
C:\Windows\winsxs\x86_microsoft-windows-peertopeercollab_31bf3856ad364e35_6.0.6000.16386_none_94fe8c8730377a78\collab.cpl --a---- 83968 bytes [12:35 02/11/2006] [12:35 02/11/2006] 07B3C6F9E09838F4346F4887ACD1C235
C:\Windows\winsxs\x86_microsoft-windows-peertopeercollab_31bf3856ad364e35_6.0.6001.18000_none_97354e832d228b4c\collab.cpl --a---- 83968 bytes [12:35 02/11/2006] [12:35 02/11/2006] 07B3C6F9E09838F4346F4887ACD1C235

Searching for "msinfo32.exe "
C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe --a---- 408064 bytes [00:27 17/09/2009] [06:27 11/04/2009] D3D1CE8FF30786D50272DA3085149904
C:\Windows\System32\msinfo32.exe --a---- 408064 bytes [00:27 17/09/2009] [06:27 11/04/2009] DFF339E3192CA93D7E921D48E121AA76
C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.0.6000.16386_none_840e3d1eedf5cd7c\msinfo32.exe --a---- 407552 bytes [08:35 02/11/2006] [09:45 02/11/2006] 3E5E53C5B77A825A2A22DCE94D6004E2
C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.0.6001.18000_none_8644ff1aeae0de50\msinfo32.exe --a---- 408064 bytes [12:58 26/11/2008] [07:33 19/01/2008] 5DCAC5A906CF6230929BF562F2093C25
C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.0.6002.18005_none_88307826e802a99c\msinfo32.exe --a---- 408064 bytes [00:27 17/09/2009] [06:27 11/04/2009] D3D1CE8FF30786D50272DA3085149904
C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.0.6000.16386_none_a9a5a4dafcc33864\msinfo32.exe --a---- 407552 bytes [08:35 02/11/2006] [09:45 02/11/2006] 3E5E53C5B77A825A2A22DCE94D6004E2
C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.0.6001.18000_none_abdc66d6f9ae4938\msinfo32.exe --a---- 408064 bytes [12:58 26/11/2008] [07:33 19/01/2008] 5DCAC5A906CF6230929BF562F2093C25
C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.0.6002.18005_none_adc7dfe2f6d01484\msinfo32.exe --a---- 408064 bytes [00:27 17/09/2009] [06:27 11/04/2009] DFF339E3192CA93D7E921D48E121AA76

Searching for "msconfig.exe "
C:\Users\Robin Bryson\Downloads\msconfig.exe --a---- 145408 bytes [18:47 27/10/2010] [18:47 27/10/2010] C574151933A88E69EE08CE6AD0AC37B4
C:\Windows\System32\msconfig.exe --a---- 222208 bytes [15:45 02/11/2006] [23:02 27/10/2010] 1BB128A09911A936E8EFC30C3F6C597C
C:\Windows\winsxs\x86_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.0.6000.16386_none_d8437c87a0d4ffbd\msconfig.exe --a---- 222208 bytes [08:35 02/11/2006] [09:45 02/11/2006] 1BB128A09911A936E8EFC30C3F6C597C
C:\Windows\winsxs\x86_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.0.6001.18000_none_da7a3e839dc01091\msconfig.exe ------- 227840 bytes [12:58 26/11/2008] [07:33 19/01/2008] D263F7D53645C3EA1DA928C519E0CBFA

Searching for "mycomput.dll"
C:\Windows\System32\mycomput.dll --a---- 229888 bytes [12:57 26/11/2008] [07:35 19/01/2008] C58BF233A73B858E5A4320D638CC8A6A
C:\Windows\winsxs\x86_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_6.0.6000.16386_none_48df5e2f796be961\mycomput.dll --a---- 229888 bytes [08:40 02/11/2006] [09:46 02/11/2006] 5282223E063262EB8F2507F56D5AC4E7
C:\Windows\winsxs\x86_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_6.0.6001.18000_none_4b16202b7656fa35\mycomput.dll --a---- 229888 bytes [12:57 26/11/2008] [07:35 19/01/2008] C58BF233A73B858E5A4320D638CC8A6A
C:\Windows\winsxs\x86_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_6.0.6002.18005_none_4d0199377378c581\mycomput.dll --a---- 229888 bytes [12:57 26/11/2008] [07:35 19/01/2008] C58BF233A73B858E5A4320D638CC8A6A

-= EOF =-

#5 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:01:12 PM

Posted 28 October 2010 - 06:09 PM

I sure will. I actually ran Malwarebytes yesterday and it found a backdoor.bot attached to the msconfig.exe file. It took care of that and I was then able to load a new msconfig.exe file into the SYS32 folder and make a new key in the registry. So the msconfig issue is fixed.
But the device manager failure and other 4 corrupted files, I am having no luck with. So I will download your program and post it.
Thank you for your help.
Robyn


Can you post the MBAM log here? It should be in the Log Tab of MBAM.

Posted Image

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,614 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:12 AM

Posted 28 October 2010 - 07:33 PM

it found a backdoor.bot

In that case, your best and safest way would be....

With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread and post a DDS log HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#7 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 29 October 2010 - 09:03 AM

mbam-log-2010-10-27 (15-16-45)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4401

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

10/27/2010 3:16:45 PM
mbam-log-2010-10-27 (15-16-45).txt

Scan type: Full scan (C:\|)
Objects scanned: 319114
Time elapsed: 2 hour(s), 13 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\msconfig.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,614 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:12 AM

Posted 29 October 2010 - 09:05 PM

Please, re-read my previous reply.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#9 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:01:12 PM

Posted 30 October 2010 - 09:40 AM

Can you run msconfig now without it causing issues, then if you cannot please follow Broni's advice.

#10 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 30 October 2010 - 10:26 AM

Yes MS CONFIG is working, but the Device manager isn't.....and the other files are still corrupt. I had initially tried to replace them but keep getting that ACCESS DENIED "need administrator rights" message even when I am in the administrator user. I had thought of replacing them in SAFE MODE?? But I have not researched that.
I only have Vista Home premium so I would now have to find an external means to backup my OS which means I will have to buy an external hard drive. I backed it up on another computer in the Network sharing folder but it is 18GB large, so copying that onto CD's is not reasonable. I have never copied that much data onto CD's or DVD's.....so I am stuck right now.
I am not ignoring your advice, just working through step by step like you asked me to, trying to understand and make sure I do it correctly and got stuck here in the BACKUP YOUR COMPUTER part. So I am unsure if I could even extract it from the other computer if mine fails. So I am proceeding slowly. Sorry. This is my first experience with computer troubles in 20 years. Since Malwarebytes removed the bot, MSCONFIG is NOW WORKING; then it would seem reasonable for me to assume I no longer need malware removal. I just need to proceed with replacing the other 5 files.
Sorry if I have wasted your time and effort,???? HOPE NOT. I do appreciate the advice, it is all trial and error for me. My first attempts to try and fix my own computer without having to completely restore it.

Edited by Robyn53, 30 October 2010 - 10:36 AM.


#11 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 30 October 2010 - 10:30 AM

Device Manager still gives me the error
"MMC could not create the snapin."

Computer management Console says the same and also says the snap-in might not have been installed correctly but I don't even know what this is. It shows a CLSID # and so did Device manager.

Edited by Robyn53, 30 October 2010 - 10:41 AM.


#12 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 30 October 2010 - 10:54 AM

Thank YOU ALL for your help and advice. I have been to other boards, but found quickly that some of them have no tolerance for anyone who asks questions after they have been given advice. That was not acceptable to me becasue I just wanted to understand what and why I needed to do what they said. Everyone here has been very nice so far and very open in explaining ...........so I appreciate that.
I am not totally unfamiliar with computers and in coming here initially with the msconfig error, I had not run MalwareBytes, I had run Super Antispyware that did not find the bot, nor did McAfee and then I ran MBAM and it found it, so I can safely assume MBAM fixed the issue, which I then proceeded to reload a clean msconfig file and made a new entry key for it in the Registry. I don't mess around in the registry often, it is damm scary to me, but I knew when I could not find the path to msconfig that I had to make one.
I still have other issues and am hoping to work them out with your help, without having to restore this computer.


So, thank you for all for being so informative and so helpful.

Edited by Robyn53, 30 October 2010 - 10:56 AM.


#13 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:01:12 PM

Posted 30 October 2010 - 10:56 AM

Do you have access to a Windows Installation CD?

#14 Robyn53

Robyn53
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:NC
  • Local time:09:12 AM

Posted 30 October 2010 - 11:04 AM

I do have my Vista reinstallation DVD, I have all of the original cd'S that came with the computer. However, extracting or finding anything on them has proved to be a challenge for me. So if you can help I appreciate it.

#15 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:01:12 PM

Posted 30 October 2010 - 11:08 AM

Does your Vista Re-installation DVD contain a folder called i386?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users