Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

XP Workstation Service won't start after removing Guard Online


  • Please log in to reply
8 replies to this topic

#1 The Limey

The Limey

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:06 PM

Posted 11 October 2011 - 12:49 PM

Hi,

THE PROBLEM
I removed the "Guard Online" malware from a clients PC, and now it won't access the network. It won't mount network shares on the server, or even browse the network.

I can access the internet, so it's not an NIC issue.


They have XP Pro SP3, and a network domain.


The Computer Browser service isn't running, but when I try to start it, it fails because of a dependency on the WorkStation service.

When I try to start the "WorkStation" service it fails with error 2250 (Edited: not 2205!).
It also says to check the System log, which says there was a problem with RDR. (again, sorry I don't have the specific message to hand).


STEPS I TOOK TO REMOVE "GUARD ONLINE"
1) Kaspersky TDSSKiller.exe. This only found a couple of possible issues, not the root kit. I told it to delete them. ...hmm, I wonder if this is the cause?
2) MalwareBytes Anti Malware (I updated it first). Removed 8 nasties.

FURTHER STEPS TO RESOLVE CURRENT ISSUE
- I tried sfc /scannow. I had to create a slipstreamed XP Pro SP3 install disk (I used nLite from www.nliteos.com). It ran through fine, but didn't fix it.

That was the only promising idea I could find.


QUESTION
Does anyone have any idea how I can get the WorkStation service to run again?

...or, am I "barking up the wrong tree", and this is a symptom of a bigger issue?




NB: I'll post the specific error messages and ID's when I get to my client's office later.

Edited by hamluis, 11 October 2011 - 04:11 PM.
Moved from XP to Am I Infected.


BC AdBot (Login to Remove)

 


#2 The Limey

The Limey
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:06 PM

Posted 11 October 2011 - 03:28 PM

NB: I'll post the specific error messages and ID's when I get to my client's office later.


Ok, here are the error messages:

When i try to start the Workstation service

Windows could not start the Workstation on Local Computer. For more information, review the System Event Log. ...blah, blah, blah... service-specific error code 2250

The pertinent System Event Log messages

  • Could not load RDR device driver.
  • The Workstation service was successfully sent a start control.
  • The Workstation service entered the stopped state.
  • The Workstation service terminated with service-specific error 2250 (0x8CA).


I hope that helps. =S

Edited by The Limey, 11 October 2011 - 03:29 PM.


#3 The Limey

The Limey
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:06 PM

Posted 11 October 2011 - 04:01 PM

I just thought I'd mention, I can't do a system restore because whoever set this PC up disabled it.

#4 The Limey

The Limey
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:06 PM

Posted 11 October 2011 - 05:03 PM

I got it!

The following file was missing:

C:/windows/system32/drivers/mrxsmb.sys

I copied it from:

C:/windows/drivers cache/i386

...and the Workstation service was happy again. Yay, yay, and thrice yay.

Only took me 8 hours to work out!

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,411 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:06 PM

Posted 11 October 2011 - 08:18 PM

Glad you resolved it...doubt if anyone in the XP forum would have come up with that solution...happy computing :).

Louis

#6 The Limey

The Limey
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:06 PM

Posted 12 October 2011 - 09:34 PM

Thanks.

I thought it was a long shot, but worth a try. :thumbup2:

#7 jaz872

jaz872

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:06 PM

Posted 13 October 2011 - 10:14 PM

Hey Limey,

I am having the same exact problem on one of my clients computers as well, after removing the same malware in the same fashion. I've been killing myself to try and find the solution, so when I saw your post I got so happy. But then I checked the drivers folder and found mrxsmb.sys there already :(

So, my question to you is, how did you find your solution? How did you figure out to even check if the mrxsmb.sys file was missing? Maybe there is some list of files that need to be checked? I'm really just looking for anything that can point me in the right direction, so if you can even just tell me how you got to your solution it could be a huge help.

Thanks!

#8 The Limey

The Limey
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:06 PM

Posted 14 October 2011 - 10:31 AM

Ah, I thought I should maybe mention how I came to that solution.

I noticed that there was another error in the event log, that I had until then not noticed, because it only occurred once when the computer was turned on (I think), not repeatedly. I don't have the specific error message here, but it was basically saying that it couldn't start the MRxSMB service, which after further googling led me to check that the mrxsmb.sys file was ok. That's when I found it was missing.

You could try just dumping all the backup '.sys' files into the drivers folder, then any that are missing would theorecitally get put back, and any that are corrupted should be replaced. I don't see that it could hurt to try, but obviously take a copy first just incase.

I hope that helps you,
Colin

PS, don't forget to post your solution when you do work it out! =)

#9 R00K

R00K

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:06 PM

Posted 14 December 2011 - 01:34 PM

I am having the same exact problem on one of my clients computers as well, after removing the same malware in the same fashion. I've been killing myself to try and find the solution, so when I saw your post I got so happy. But then I checked the drivers folder and found mrxsmb.sys there already :(



I had the same problem and it took me 3 hours of searching to figure it out.

The file is there - but contains NO data, copy the one from the drivers cache to the system32\drivers folder and Bam - it worked

Thanks Limey!!!!!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users