My Log

the pc is getting stuck on the welcome screen

Please note that no backups will be made.
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

Reboot in SAFE MODE. If you don't know how click here

Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: (no name) - {3F8E667E-E566-54C5-8257-64550AFB2F18} - C:\WINDOWS\System32\jhh.dll
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Administrator\Local Settings\Temp\UVJg3ga.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\ISTbar\istbar.dll
O4 - HKLM\..\Run: [Start Upping] xdcc.exe
O4 - HKLM\..\Run: [pcEXPLODE] specialfile.exe
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\RunServices: [Start Upping] xdcc.exe
O4 - HKLM\..\RunServices: [pcEXPLODE] specialfile.exe
O4 - HKCU\..\Run: [pcEXPLODE] specialfile.exe
O4 - HKCU\..\Run: [Start Upping] xdcc.exe


The following have randomly named file names, and as such are normally malware.
UNLESS you know what they are, and they are from a safe source, follow their process tree.
Right click on the file and go to Properties. Then go to the Version tab to see what company name it's from:
If it's from some name you never heard of or if it's blank, please check for removal also.

O4 - HKLM\..\Run: [NS] ns.exe
O4 - HKLM\..\Run: [HVze5] C:\documents and settings\administrator\local settings\temp\HVze5.exe
O4 - HKLM\..\Run: [ES] C:\documents and settings\administrator\local settings\temp\ES.exe
O4 - HKLM\..\Run: [3449c256b4b1] C:\WINDOWS\System32\batt5333.exe
O4 - HKLM\..\RunServices: [NS] ns.exe
O4 - HKCU\..\Run: [Saae] C:\Documents and Settings\Administrator\Application Data\cceh.exe
O4 - HKCU\..\Run: [Tpkyw] C:\WINDOWS\System32\??chost.exe



Delete the following file(s) only

xdcc.exe < specialfile.exe< C:\WINDOWS\conscorr.exe


ns.exe< C:\documents and settings\administrator\local settings\temp\HVze5.exe clean out this folder while your there
C:\documents and settings\administrator\local settings\temp\ES.exe
C:\WINDOWS\System32\batt5333.exe
C:\Documents and Settings\Administrator\Application Data\cceh.exe
C:\WINDOWS\System32\??chost.exe


Some of these files and folders might have the hidden atribute
How to show hidden files and folders in Windows Instructions here

Then Download System Security Suite. Extract it from the zip file into a folder.
http://www.igorshpak.net/software/3ssetup104.zip
Under "items to clear" click all. Then click "clear selected items"

Reboot and Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment.

I booted and safe mode and deleted all the files. When trying to reboot in regular mode, it got stuck on the welcome screen and I recieved a "Runtime" error. When trying to boot safemode with networking, I got :" A problem is preventing Windows from accurately checking the license for this computer. Error code: 0x80040057." When trying to boot in regular mode, I got: "Disk I/O error. Replace the disk, and then press any key." Norton is the only disk in the cd-rom, so I"m not sure if it's talkin about the hard drive or the disk in the cd rom.

Do you have the XP O/S disk?

yes, i have the disk

You may want to print out these instructions. First, make sure you are using the proper method to get to Safe Mode. Boot the system, start tapping F8, when the menu appears, select Safe Mode and press enter. If this gets you to Safe Mode, do the following in safe mode: Go to start/run, and type regsvr32.exe regwizc.dll OK, then, regsvr32.exe licdll.dll If you cannot enter Safe Mode, try a repair install as follows: NOTE, while a repair install should leave your data files intact, if something goes wrong during the repair install, you may be forced to start over and do a clean install of XP. If you don't have your data backed up, you would lose your data should that eventuality occur. Assuming your system is set to boot from the CD-ROM drive and you have an actual XP CD as opposed to a recovery CD, boot with the XP CD in the drive and perform a repair install as outlined below. If the system isn't set to boot from the CD or you are not sure, you need to enter the system's BIOS. When you boot the system, the first screen usually has instructions that if you wish to enter set press a specific key, when you see that, do so. Then you will have to navigate to the boot sequence, if the CD-ROM drive is not first line, set it first in the boot sequence. Save your settings and exit with the XP CD in the drive. The system will reboot. When the system boots, a few screens into the process you may see a message instructing you to hit any key in order to boot from the CD along with a countdown. When you see this be sure to hit a key on the keyboard, if you miss this instruction and the system fails to boot from the CD, it's too late, you'll need to reboot and try again. Once you have pressed a key, setup should begin. You will see a reference asking if you need to load special drivers and another notice that if you wish to begin the ASR (Automatic Recovery Console) depress F2. Just let setup run past all of that. It will continue to load files and drivers. Then it will bring you to a screen. Eventually, you will come to a screen with the option to (1) setup Windows or (2) Repair Windows Installation using the Recovery console. ***The selection you want at this screen is "Setup Windows," NOT "Repair Windows Installation. The first option, to setup Windows is the one you want and requires you to press enter. When asked, press F8 to accept the end user agreement. Setup will then search for previous versions of Windows. Upon finding your version, it will ask if you wish to Repair your current installation or install fresh. Press R, that will run a repair installation. From there on, follow the screens. Note, in some cases, you won't receive the repair option, only an option to reinstall. We have discovered that sometimes this is caused by damaged boot.ini file that can be repaired as follows and also note, in the instructions, "K" refers to the CD drive in which you have placed the XP CD, replace that drive letter with the appropriate letter on your system, "K" is simply an example. Reboot, this time taking the immediate R option (this is the section I told you to skip above. In this case, you will need to get to the Recovery Console to perform the function below), and if the CD letter is say K: give these commands COPY K:\i386\ntldr C: COPY K:\i386\ntdetect.com C: (two other files needed - just in case) ATTRIB -H -R -S C:\boot.ini DEL C:\boot.ini BootCfg /Rebuild Once you've completed this function, reboot and see if you can access XP as sometimes, the problem is the damaged boot.ini. If you still cannot access XP, then reboot and re-run the repair install instructions at the beginning of this message. If you only have a recovery CD, your options are quite limited. You can either purchase a retail version of XP which will allow you to perform the above among other tools and options it has or you can run your system recovery routine with the Recovery CD which will likely wipe your drive, deleting all files but will restore your setup to factory fresh condition. copied from Michael Solomon MS-MVP

I have completely formatted the harddrive and installed a fresh copy of windows. After getting the I/O error again, I did the regsvr32.exe regwizc.dll and regsvr32.exe licdll.dll and it allowed me to get into windows. Then the C:/Windows/System/nt/lsass.exe or something like that caused the computer to do the rebooting thing again.

Sorry but you might want to ask a microsoft expert, this one is beyond me.

are you sure you really reformatted, and not just reinstalled windows? where you asked to delete a partition on your hard drive, warning that you would lose all data?

Yes, I requested to delete all partitions and to completely format the harddrive.

hello again, its beyond me also, i would try to repartion/install again. make sure only windows cd is in drive, also only have mouse, keyboard and monitor plugged into back of computer.