XP won't start anymore

I got as far as the bootcfg /rebuild.

when it asked to do the rebuild, I said Yes, but then it asked about other
stuff I had no idea what that was, so I power-cycled the computer to get out
of it.

I'll try a restore session and finish up with the fixmbr, and hope I didn't
mess up anything with the aborted bootcfg.

Thx.


" db.·.. ))) ·` .. ." databaseben at hotmail wrote in message
...
most of the time, rebooting
is not an indication of an
infection.

instead it may be that your
issue can be resolved with
a little file/disk tuning up.

boot up with your win
cd and log into the
repair/recovery console.

then run the following
commands at the disk
prompt:

chkdsk
fixboot
bootcfg /rebuild
fixmbr

then "exit" and
remove the cd.

--

db·´¯`·...¸)))º
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces

"Bill H." wrote in message
...
Yes, it's probably a virus or trojan, but how to find out which one and
get rid of it?

Windows xp pro starts to load, gets to the splash screen, and the the
computer reboots.

I've tried dianostic and selective startup, and neither work. All I can
get is safe mode. System restore has been turned off. Last known good
config doesn't help.

So far, the AV and/or malware tools I've tried (AVG free, Windows
Defender, Ad Aware) won't install and/or run in safe mode.

Suggestions, other than reformat and reinstall the OS?

Thx.


--
Bill

Thanks, Gerry.

So far, here's what I've gotten. Not every time, but sometimes...
IRQL_NOT_LESS_OR_EQUAL
BAD_POOL_CALLER
PAGE_FAULT_IN_NONPAGED_AREA

and a few
IRQL_NOT_LESS_OR_EQUAL

:-)

I also am now getting a window that starts out, "The system has recovered
from a serious error" and wanting me to tell MS about it. I sometimes get
several of these same msgs after a reboot.

I have gone ahead and downloaded 71mb of updates (skipped MSIE7 and SP3 at
this point), and am trying to get it to stay in normal mode for the updates
to be fully installed. Will now try safe mode...

--Bill

"Gerry" wrote in message
...
Bill

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Keep pressing the F8
key during Start-Up and select option - Disable automatic restart on
system failure. Do not re-enable automatic restart on system failure.
Check for variants of the Stop Error message.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Bill H. wrote:
Well, so far I seem to not find any viruses/malware.

However, the computer continues to reboot at whim, and AVG and/or
spybot finds a couple of infected files shortly after I reboot. I
delete them, but sometime later they are back.

Now how to get it to stop rebooting. And still can be slow after a
reboot.
--Bill


"Mick Murphy" wrote in message
...
http://free.avg.com/download?prd=afe

Bill, what version of AVG: 7.5 0r 8.0
If 7.5, get 8.0 from above link

Or try Avast:
http://www.avast.com/eng/download-avast-home.html

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit
Versions), FREE, auto-updating, and a low resources user of your
computer. And, only have 1(one) Anti-Virus installed / running on your
computer at any
one time..
Conflicts may occur if you have more than 1(one).

--
Mad Mike


"Bill H." wrote:

Oh, and when I restart in safe mode with networking, AVG fails to
start "...because the application configuration is incorrect..."


--Bill

"Mick Murphy" wrote in
message ...
Do this in Safe Mode with Networking. All info below.
If you have not managed to install AVG, and have no other AV on
your computer, install AVAST.
And also download, install, update and scan your system with
Malwarebytes
and Spybot Search & destroy.

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit
Versions), FREE, auto-updating, and a low resources user of your
computer. And, only have 1(one) Anti-Virus installed / running on your
computer at
any
one time..
Conflicts may occur if you have more than 1(one).

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware
Program. Download, install, update, and immunize your System with
it. Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can't uninstall / delete,
reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use
UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot
S & D
while in Safe Mode.

If unable to install above Programs in Normal Mode:
Sometimes Trojans, Viruses, Malware, etc stop you installing and/or
updating
Programs to remove them.
If that happens, reboot into Safe Mode with Networking, and
install, update
and scan from there.

--
Mad Mike


"Bill H." wrote:

Yes, it's probably a virus or trojan, but how to find out which
one and
get
rid of it?

Windows xp pro starts to load, gets to the splash screen, and the
the computer reboots.

I've tried dianostic and selective startup, and neither work. All I
can
get
is safe mode. System restore has been turned off. Last known
good config
doesn't help.

So far, the AV and/or malware tools I've tried (AVG free, Windows
Defender,
Ad Aware) won't install and/or run in safe mode.

Suggestions, other than reformat and reinstall the OS?

Thx.


--
Bill

you likely didn't mess
anything up with that
command.

all it was asking was to
provide a menu line item
and a description to appear
on the boot menu.

but the questions are
intimidating.

------------

what i gathered from your
other responses was that
you could access safemode
but normal mode was not
stable.

the repair installation with
your win cd is a good idea.

keep in mind however, if your
o.s. on the disk is sp3 then
your sp2 cd cannot perform
a repair.

so keep us apprised.

because safemode was stable,
then it is likely that normal mode
needs to be cleaned up and
reconfigured.

you can use the environment in
safemode to do the cleaning up.

further, there are options like
clean booting as well.

--

db·´¯`·...¸)))º
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces

"Bill H." wrote in message ...
I got as far as the bootcfg /rebuild.

when it asked to do the rebuild, I said Yes, but then it asked about other stuff I had no idea what that was, so I power-cycled
the computer to get out of it.

I'll try a restore session and finish up with the fixmbr, and hope I didn't mess up anything with the aborted bootcfg.

Thx.


" db.·.. ))) ·` .. ." databaseben at hotmail wrote in message ...
most of the time, rebooting
is not an indication of an
infection.

instead it may be that your
issue can be resolved with
a little file/disk tuning up.

boot up with your win
cd and log into the
repair/recovery console.

then run the following
commands at the disk
prompt:

chkdsk
fixboot
bootcfg /rebuild
fixmbr

then "exit" and
remove the cd.

--

db·´¯`·...¸)))º
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces

"Bill H." wrote in message ...
Yes, it's probably a virus or trojan, but how to find out which one and get rid of it?

Windows xp pro starts to load, gets to the splash screen, and the the computer reboots.

I've tried dianostic and selective startup, and neither work. All I can get is safe mode. System restore has been turned off.
Last known good config doesn't help.

So far, the AV and/or malware tools I've tried (AVG free, Windows Defender, Ad Aware) won't install and/or run in safe mode.

Suggestions, other than reformat and reinstall the OS?

Thx.


--
Bill

Bill

You should not update a malfuncting computer. It can make the situation
worse.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793589.aspx

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Typically due to a bad driver, or faulty or incompatible hardware or
software. Use the General Troubleshooting of STOP Messages checklist
above. Technically, this error condition means that a kernel-mode
process or driver tried to access a memory location to which it did not
have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was
too high. (A kernel-mode process can access only other processes that
have an IRQL lower than, or equal to, its own.)
Source: http://aumha.org/a/stop.htm

You receive a "Stop 0x0000000A" error message in Windows XP
http://support.microsoft.com/kb/314063/

There are a lot of practical suggestions in the Knowledge Base Article
314063

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793437.aspx

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
(Click to consult the online MSDN article.)
Requested data was not in memory. An invalid system memory address was
referenced. Defective memory (including main memory, L2 RAM cache, video
RAM) or incompatible software (including remote control and antivirus
software) might cause this Stop message, as may other hardware problems
(e.g., incorrect SCSI termination or a flawed PCI card).
Source: http://aumha.org/a/stop.htm

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms796120.aspx

0x000000C2: BAD_POOL_CALLER
(A kernel-mode process or driver incorrectly attempted to perform memory
operations. Typically, a faulty driver or buggy software causes this.
Source: http://aumha.org/a/stop.htm

STOP: 0x0000000A (0xc0000005, 0x85EE90BD, 0xECF62B4C, 0x00000000)
For each Stop Error what appears on the line below what is above?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~





Bill H. wrote:
Thanks, Gerry.

So far, here's what I've gotten. Not every time, but sometimes...
IRQL_NOT_LESS_OR_EQUAL
BAD_POOL_CALLER
PAGE_FAULT_IN_NONPAGED_AREA

and a few
IRQL_NOT_LESS_OR_EQUAL

:-)

I also am now getting a window that starts out, "The system has
recovered from a serious error" and wanting me to tell MS about it. I
sometimes get several of these same msgs after a reboot.

I have gone ahead and downloaded 71mb of updates (skipped MSIE7 and
SP3 at this point), and am trying to get it to stay in normal mode
for the updates to be fully installed. Will now try safe mode...

--Bill

"Gerry" wrote in message
...
Bill

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Keep pressing
the F8 key during Start-Up and select option - Disable automatic
restart on system failure. Do not re-enable automatic restart on
system failure. Check for variants of the Stop Error message.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Bill H. wrote:
Well, so far I seem to not find any viruses/malware.

However, the computer continues to reboot at whim, and AVG and/or
spybot finds a couple of infected files shortly after I reboot. I
delete them, but sometime later they are back.

Now how to get it to stop rebooting. And still can be slow after a
reboot.
--Bill


"Mick Murphy" wrote in
message ...
http://free.avg.com/download?prd=afe

Bill, what version of AVG: 7.5 0r 8.0
If 7.5, get 8.0 from above link

Or try Avast:
http://www.avast.com/eng/download-avast-home.html

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit
Versions), FREE, auto-updating, and a low resources user of your
computer. And, only have 1(one) Anti-Virus installed / running on
your computer at any
one time..
Conflicts may occur if you have more than 1(one).

--
Mad Mike


"Bill H." wrote:

Oh, and when I restart in safe mode with networking, AVG fails to
start "...because the application configuration is incorrect..."


--Bill

"Mick Murphy" wrote in
message ...
Do this in Safe Mode with Networking. All info below.
If you have not managed to install AVG, and have no other AV on
your computer, install AVAST.
And also download, install, update and scan your system with
Malwarebytes
and Spybot Search & destroy.

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit
Versions), FREE, auto-updating, and a low resources user of your
computer. And, only have 1(one) Anti-Virus installed / running
on your computer at
any
one time..
Conflicts may occur if you have more than 1(one).

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware
Program. Download, install, update, and immunize your System with
it. Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download
from Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can't uninstall /
delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and
use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and
Spybot S & D
while in Safe Mode.

If unable to install above Programs in Normal Mode:
Sometimes Trojans, Viruses, Malware, etc stop you installing
and/or updating
Programs to remove them.
If that happens, reboot into Safe Mode with Networking, and
install, update
and scan from there.

--
Mad Mike


"Bill H." wrote:

Yes, it's probably a virus or trojan, but how to find out which
one and
get
rid of it?

Windows xp pro starts to load, gets to the splash screen, and
the the computer reboots.

I've tried dianostic and selective startup, and neither work.
All I can
get
is safe mode. System restore has been turned off. Last known
good config
doesn't help.

So far, the AV and/or malware tools I've tried (AVG free,
Windows Defender,
Ad Aware) won't install and/or run in safe mode.

Suggestions, other than reformat and reinstall the OS?

Thx.


--
Bill

Great stuff, Gerry!

I didn't write down all the info, but got some. I won't have the computer
after today, and since it is an older model, I've suggested he get a new
one.

for one of the IRQL:

0x00000101, 0x00000002, 0x00000001, 0x804E60C4


Bad pool caller:

0x00000007, 0x00000CD4, 0x02070004, 0x8320FBC0

another STOP 0x0000008E,0x0064006A, 0xF3E92CF0, 0x00000000


Thanks.

"Gerry" wrote in message
...
Bill

You should not update a malfuncting computer. It can make the situation
worse.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793589.aspx

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Typically due to a bad driver, or faulty or incompatible hardware or
software. Use the General Troubleshooting of STOP Messages checklist
above. Technically, this error condition means that a kernel-mode
process or driver tried to access a memory location to which it did not
have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was
too high. (A kernel-mode process can access only other processes that
have an IRQL lower than, or equal to, its own.)
Source: http://aumha.org/a/stop.htm

You receive a "Stop 0x0000000A" error message in Windows XP
http://support.microsoft.com/kb/314063/

There are a lot of practical suggestions in the Knowledge Base Article
314063

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793437.aspx

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
(Click to consult the online MSDN article.)
Requested data was not in memory. An invalid system memory address was
referenced. Defective memory (including main memory, L2 RAM cache, video
RAM) or incompatible software (including remote control and antivirus
software) might cause this Stop message, as may other hardware problems
(e.g., incorrect SCSI termination or a flawed PCI card).
Source: http://aumha.org/a/stop.htm

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms796120.aspx

0x000000C2: BAD_POOL_CALLER
(A kernel-mode process or driver incorrectly attempted to perform memory
operations. Typically, a faulty driver or buggy software causes this.
Source: http://aumha.org/a/stop.htm

STOP: 0x0000000A (0xc0000005, 0x85EE90BD, 0xECF62B4C, 0x00000000)
For each Stop Error what appears on the line below what is above?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~





Bill H. wrote:
Thanks, Gerry.

So far, here's what I've gotten. Not every time, but sometimes...
IRQL_NOT_LESS_OR_EQUAL
BAD_POOL_CALLER
PAGE_FAULT_IN_NONPAGED_AREA

and a few
IRQL_NOT_LESS_OR_EQUAL

:-)

I also am now getting a window that starts out, "The system has
recovered from a serious error" and wanting me to tell MS about it. I
sometimes get several of these same msgs after a reboot.

I have gone ahead and downloaded 71mb of updates (skipped MSIE7 and
SP3 at this point), and am trying to get it to stay in normal mode
for the updates to be fully installed. Will now try safe mode...

--Bill

"Gerry" wrote in message
...
Bill

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Keep pressing
the F8 key during Start-Up and select option - Disable automatic
restart on system failure. Do not re-enable automatic restart on
system failure. Check for variants of the Stop Error message.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Bill H. wrote:
Well, so far I seem to not find any viruses/malware.

However, the computer continues to reboot at whim, and AVG and/or
spybot finds a couple of infected files shortly after I reboot. I
delete them, but sometime later they are back.

Now how to get it to stop rebooting. And still can be slow after a
reboot.
--Bill


"Mick Murphy" wrote in
message ...
http://free.avg.com/download?prd=afe

Bill, what version of AVG: 7.5 0r 8.0
If 7.5, get 8.0 from above link

Or try Avast:
http://www.avast.com/eng/download-avast-home.html

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit
Versions), FREE, auto-updating, and a low resources user of your
computer. And, only have 1(one) Anti-Virus installed / running on
your computer at any
one time..
Conflicts may occur if you have more than 1(one).

--
Mad Mike


"Bill H." wrote:

Oh, and when I restart in safe mode with networking, AVG fails to
start "...because the application configuration is incorrect..."


--Bill

"Mick Murphy" wrote in
message ...
Do this in Safe Mode with Networking. All info below.
If you have not managed to install AVG, and have no other AV on
your computer, install AVAST.
And also download, install, update and scan your system with
Malwarebytes
and Spybot Search & destroy.

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit
Versions), FREE, auto-updating, and a low resources user of your
computer. And, only have 1(one) Anti-Virus installed / running
on your computer at
any
one time..
Conflicts may occur if you have more than 1(one).

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware
Program. Download, install, update, and immunize your System with
it. Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download
from Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can't uninstall /
delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and
use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and
Spybot S & D
while in Safe Mode.

If unable to install above Programs in Normal Mode:
Sometimes Trojans, Viruses, Malware, etc stop you installing
and/or updating
Programs to remove them.
If that happens, reboot into Safe Mode with Networking, and
install, update
and scan from there.

--
Mad Mike


"Bill H." wrote:

Yes, it's probably a virus or trojan, but how to find out which
one and
get
rid of it?

Windows xp pro starts to load, gets to the splash screen, and
the the computer reboots.

I've tried dianostic and selective startup, and neither work.
All I can
get
is safe mode. System restore has been turned off. Last known
good config
doesn't help.

So far, the AV and/or malware tools I've tried (AVG free,
Windows Defender,
Ad Aware) won't install and/or run in safe mode.

Suggestions, other than reformat and reinstall the OS?

Thx.


--
Bill

"Bill H." wrote in message
...
Great stuff, Gerry!

I didn't write down all the info, but got some. I won't have the
computer after today, and since it is an older model, I've suggested
he get a new one.

for one of the IRQL:

0x00000101, 0x00000002, 0x00000001, 0x804E60C4


Bad pool caller:

0x00000007, 0x00000CD4, 0x02070004, 0x8320FBC0

another STOP 0x0000008E,0x0064006A, 0xF3E92CF0, 0x00000000

Although it's possible that hardware isues are responsible for the
above, malware can also be a cause. In another post you mentioned the
appearance of a "winweb security" window. I still think that you need to
address your malware infection! One more time:

http://www.bleepingcomputer.com/malw...inweb-security

I'm pretty sure I've taken care of the malware. Haven't seen it in a while.

Interesting at this point.

I created a new user account while in safe mode. Now, if I let it boot
normally, it gets to the logon screen showing two users. After about 20
seconds just sitting at that screen, it reboots!

So far, safe mode always seems to work. Just can't do much there. :-)

I guess that means there's a software issue somewhere. If I set msconfig to
dianostic, it still reboots shortly after the desktop comes up.

--Bill

"Bill H." wrote in message
...
I'm pretty sure I've taken care of the malware. Haven't seen it in a
while.

Interesting at this point.

I created a new user account while in safe mode. Now, if I let it
boot normally, it gets to the logon screen showing two users. After
about 20 seconds just sitting at that screen, it reboots!

So far, safe mode always seems to work. Just can't do much there. :-)

I guess that means there's a software issue somewhere.

Agreed. And I'll bet you *still* have malware.

The best thing to do at this point (short of a clean install, which you
might wind up needing to do anyway) is to run HijackThis and post your
log to an appropriate forum. For more information (courtesy of David
Lipman):

1. Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en...HJTInstall.exe


2. Disable Notepad's word wrap:
In Notepad.exe; Format -- uncheck; "Word wrap"


3. Download/run Deckard's System Scanner:
http://www.techsupportforum.com/sect...eckard/dss.exe

[Daave's Note: There is a warning that a "recent rootkit infection has
been interfering with Deckard's System Scanner (DSS) resulting in
possible damage to the Operating System." Has this been addressed?
To OP: You may want to hold off on DSS for the time being!]


4. Save the scan results (Main.txt and Extra.txt)


5. And then post the contents of Main.txt and Extra.txt in your post in
one of the below expert forums...


{ Please - Do NOT post the HJT and Deckard's System Scanner Logs here! }


Forums where you can get expert advice for HiJack This! (HJT) and
Deckard's System Scanner
Logs.


NOTE: Registration is REQUIRED in any of the below before posting a log


Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0


Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.malwarebytes.org/forums/i...hp?showforum=7


Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/...splay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malwa..._Here-f37.html
http://gladiator-antivirus.com/forum...?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/...p?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13

Yes, it does appear that way. :-)

I keep rebooting into safe mode, with network wire disconnected, and using
spybot.

It keeps finding Fraud.AntiMalwares in windows/system32/winctrl32.dll. I
tell it to fix, it says it's fixed (it renames it), but upon reboot into
safe mode, the original file returns. And with command prompt, I still
can't delete it, says "access denied."

I checked my winxp, and that file is NOT there (whew!), but I wanted to see
if it were a legit windows file, maybe I could copy it over, but that's out.

--Bill

"Bill H." wrote in message
...
Yes, it does appear that way. :-)

I keep rebooting into safe mode, with network wire disconnected, and
using spybot.

It keeps finding Fraud.AntiMalwares in windows/system32/winctrl32.dll.
I tell it to fix, it says it's fixed (it renames it), but upon reboot
into safe mode, the original file returns. And with command prompt, I
still can't delete it, says "access denied."

I checked my winxp, and that file is NOT there (whew!), but I wanted
to see if it were a legit windows file, maybe I could copy it over,
but that's out.

The file will unfortunately return.

You need expert help. You need to follow the directions from my last
post. In the meantime, you can look he

http://www.bleepingcomputer.com/star...dll-23047.html

http://www.bleepingcomputer.com/forums/topic131299.html

Thanks.

Ran malwarebytes. It found a couple more that spybot missed, but it, too,
seems unable to eliminate winctrl32.dll.

I guess nobody can get rid of winctrl32.dll. :-(

--Bill

"Daave" wrote in message
...
"Bill H." wrote in message
...
Yes, it does appear that way. :-)

I keep rebooting into safe mode, with network wire disconnected, and
using spybot.

It keeps finding Fraud.AntiMalwares in windows/system32/winctrl32.dll. I
tell it to fix, it says it's fixed (it renames it), but upon reboot into
safe mode, the original file returns. And with command prompt, I still
can't delete it, says "access denied."

I checked my winxp, and that file is NOT there (whew!), but I wanted to
see if it were a legit windows file, maybe I could copy it over, but
that's out.

The file will unfortunately return.

You need expert help. You need to follow the directions from my last post.
In the meantime, you can look he

http://www.bleepingcomputer.com/star...dll-23047.html

http://www.bleepingcomputer.com/forums/topic131299.html

Bill

http://www.bleepingcomputer.com/star...dll-23047.html


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Bill H. wrote:
Thanks.

Ran malwarebytes. It found a couple more that spybot missed, but
it, too, seems unable to eliminate winctrl32.dll.

I guess nobody can get rid of winctrl32.dll. :-(

--Bill

"Daave" wrote in message
...
"Bill H." wrote in message
...
Yes, it does appear that way. :-)

I keep rebooting into safe mode, with network wire disconnected, and
using spybot.

It keeps finding Fraud.AntiMalwares in
windows/system32/winctrl32.dll. I tell it to fix, it says it's
fixed (it renames it), but upon reboot into safe mode, the original
file returns. And with command prompt, I still can't delete it,
says "access denied." I checked my winxp, and that file is NOT there
(whew!), but I
wanted to see if it were a legit windows file, maybe I could copy
it over, but that's out.

The file will unfortunately return.

You need expert help. You need to follow the directions from my last
post. In the meantime, you can look he

http://www.bleepingcomputer.com/star...dll-23047.html

http://www.bleepingcomputer.com/forums/topic131299.html

Heh, maybe he'll notice the link this time. ;-)

(I guess in certain circumstances, top-posting can be beneficial!)

"Gerry" wrote in message
...
Bill

http://www.bleepingcomputer.com/star...dll-23047.html


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Bill H. wrote:
Thanks.

Ran malwarebytes. It found a couple more that spybot missed, but
it, too, seems unable to eliminate winctrl32.dll.

I guess nobody can get rid of winctrl32.dll. :-(

--Bill

"Daave" wrote in message
...
"Bill H." wrote in message
...
Yes, it does appear that way. :-)

I keep rebooting into safe mode, with network wire disconnected,
and
using spybot.

It keeps finding Fraud.AntiMalwares in
windows/system32/winctrl32.dll. I tell it to fix, it says it's
fixed (it renames it), but upon reboot into safe mode, the original
file returns. And with command prompt, I still can't delete it,
says "access denied." I checked my winxp, and that file is NOT
there (whew!), but I
wanted to see if it were a legit windows file, maybe I could copy
it over, but that's out.

The file will unfortunately return.

You need expert help. You need to follow the directions from my last
post. In the meantime, you can look he

http://www.bleepingcomputer.com/star...dll-23047.html

http://www.bleepingcomputer.com/forums/topic131299.html

OK, SDfix seems to have been able to remove the winctrl32.dll and keep it
from coming back. That's the good news.


The bad news, the computer continues to reboot whenever trying to get into
normal mode.

And something I'm stumped on. I created a new account (while in safe mode)
yet when I boot into safe mode, that new account is not listed.

--Bill

"Bill H." wrote in message
...
OK, SDfix seems to have been able to remove the winctrl32.dll and keep
it from coming back. That's the good news.


The bad news, the computer continues to reboot whenever trying to get
into normal mode.

And something I'm stumped on. I created a new account (while in safe
mode) yet when I boot into safe mode, that new account is not listed.

One more time:

The best thing to do at this point (short of a clean install, which you
might wind up needing to do anyway) is to run HijackThis and post your
log to an appropriate forum. For more information (courtesy of David
Lipman):

1. Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en...HJTInstall.exe


2. Disable Notepad's word wrap:
In Notepad.exe; Format -- uncheck; "Word wrap"


3. Download/run Deckard's System Scanner:
http://www.techsupportforum.com/sect...eckard/dss.exe

[Daave's Note: There is a warning that a "recent rootkit infection has
been interfering with Deckard's System Scanner (DSS) resulting in
possible damage to the Operating System." Has this been addressed?
To OP: You may want to hold off on DSS for the time being!]


4. Save the scan results (Main.txt and Extra.txt)


5. And then post the contents of Main.txt and Extra.txt in your post in
one of the below expert forums...


{ Please - Do NOT post the HJT and Deckard's System Scanner Logs here! }


Forums where you can get expert advice for HiJack This! (HJT) and
Deckard's System Scanner
Logs.


NOTE: Registration is REQUIRED in any of the below before posting a log


Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0


Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.malwarebytes.org/forums/i...hp?showforum=7


Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/...splay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malwa..._Here-f37.html
http://gladiator-antivirus.com/forum...?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/...p?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13