Can't boot in Safe Mode

I downloaded and bootsafe, now I get a blue screen of death just after the Windows XP starup screen and it goes into a restart.

corpserv I am sorry your having so many problems with this computer. Have you been able to run SDFix and Spysweeper? I would be very interested in seeing the reports. There are infections that can change a lot of the settings on your system , for example, no longer having Administrator Rights, not sure if an infection is the cause of it or not. This safemode thing and not being able to shut down your computer could also be a hardware issue. You might try opening your case and make sure all the cables are good and tight, also take out your memory and reseat them, make sure there installed correctly and nice and tight. If after the above, if you still cant boot to safemode or run SDFix or Spysweeper, I am going to have to have someone else that deals with windows issues like this to offer advice. If they can get you up and running, then we can proceed cleaning your system.

A list of suggestions from one of the mods on the Other Computer Problems forum.

You've already suggested the steps that I might have:
F8
MSCONFIG - SAFE BOOT - Apply - OK - reboot
Third party SAFEBOOT utility.

Ironically, some of the procedures that this Member is accomplishing in the course of following your instructions, "should not" have been possible without having Administrative Privileges…… For instance, he has installed new software.

A "Long Shot"………

He "may" get a more complete set of Administrative Privileges if he actually "discovers" his Administrative Account Password.

Have you used SIW? http://www.gtopala.com/
Select - Software - Secrets (last one in the Software list)

SIW can be downloaded and run directly from the Users Hard Drive
Or SIW can be included on UltimateBootDisk or Knoppix, or just Saved to a CD and Run at Boot.

Secrets will display a complete list of any Passwords that the User might have created………. no guarantees, your mileage may vary.

____________________________

I'm wondering if his participation in his work network for access to his home machine may have "shared" any "group policies" created by his at work IT manager? Yeah, I know, sounds kinda lame, but I still wonder.

He has plenty of "very demanding" software installed.
A likely "suspect" is Nero Ahead INCD.
I've seen it cited as causing various and sundry conflicts, and I sure don't know anyone who actually "uses" it. (only required for "re-writeable" CDs)

I wonder about some of the other softwares…….. but have no specific knowledge about known conflicts.

You could have him Run a PCPitstop Full Test, and Post the TechExpress Link back into your Malware Removal thread. Could help get a better picture of what's running on the machine, and an overview of the Hardware too. I think you're already familiar with the PCPitstop Full Test Results pages, but I'll definitely take a look too, if you would like me to do so. http://www.pcpitstop.com

I tried to do a Windows Repair installation so that I could get the system restarted, but after the initial CD boot, on the restart it just stayed at the Windows XP screen. I am now installing system software onto a spare drive. Can I connect the buggered drive as a slave and run through the suite of utilities you have had me go through? If this is possible, I would rather still try to repair rather than start over.

You should be able to do that, make sure you change the jumper on the drive to Slave if your on the same cable as the Master.

If you do a system repair, it may fix the boot up problem but may well keep all of the nasty stuff.

XP Repair option
http://www.michaelstevenstech.com/XPrepairinstall.htm

I have now booted to a new drive with a fresh windows install, but the tools do not appear to be picking anything up on the old system drive. Are there different tools that are more effective in checking a drive that does not have the active system?

I have never done it like this before but you may have to redownload the tool and when it asks you for a location, download it to the older drive ( most likely D. ) Then boot to Safemode , go to My Computer to the D drive and try running it from there.

I have been getting some feedback on this situation and you will be able to run Spysweeper from your new drive, just make sure when you set it up you have it scan your D drive also. But SDFix won't work, it will check your drive where the operating system is and clean that one only. But we may not need it, lets see what SpySweeper comes up with.

Made some progress, but still using the stand-in hard drive with the new OS install. Here are some of the logs- let me know what to do next because I still want to revive my original drive. SpySweeper- 5:23 PM: Traces Found: 3 5:23 PM: Full Sweep has completed. Elapsed time 01:47:43 5:23 PM: File Sweep Complete, Elapsed Time: 01:46:10 5:22 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\my documents\my personal\computer class\project 2000\0541lgeedd.zip] 5:19 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\local settings\temp\crf001\creaf_ms.cab] 5:19 PM: Warning: Stream read error 5:19 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\local settings\temp\crf001\creaf_ms.cab] 5:18 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusoverride.zip] 5:15 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify6.zip] 5:15 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify.zip] 5:13 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify1.zip] 5:13 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify2.zip] 5:13 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify3.zip] 5:12 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify4.zip] 5:12 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify5.zip] 5:10 PM: Warning: AntiVirus engine returned [File Corrupted] on [c:\recycler\s-1-5-21-2025429265-152049171-854245398-1003\dh71\my stuff\jamiii files\computer class\project 2000\0541lgeedd.zip] 5:04 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\lavasoft\ad-aware se personal\skins\ad-aware se default.ask] 4:58 PM: K:\WINDOWS\Fonts\cqlipsvr.fon (ID = 0) 4:51 PM: K:\WINDOWS\system32\clipsvr.exe (ID = 0) 4:51 PM: Found Troj/ServU-DW: Troj/ServU-DW 4:51 PM: k:\windows\system32\drivers\etc\fonts.{bd84b380-8ca2-1069-ab1d-08000948f534}\com1\aux\dir\extsrv.exe (ID = 0) 4:51 PM: Found Troj/ServU-DX: Troj/ServU-DX 4:48 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf] 4:48 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf] 4:48 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf] 4:46 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\vcr\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuadbe0060.pdf] 4:46 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\vcr\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuyhoo0010.pdf] 4:23 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\local settings\temp\sqlite_qhxvre0cgrpwcne] 4:20 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\vcr\my documents\2006_cruise_answer_book.pdf] 4:12 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\program files\logitech\video\videoeffects\metadata\party_glasses_{493e8329-8303-49bb-a5a6-8598861ee26f}\party_glasses.lvf] 4:10 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf] 4:06 PM: Warning: Failed to access drive J: 4:05 PM: Warning: AntiVirus engine returned [Access Denied] on [i:\hiberfil.sys] 4:05 PM: Warning: AntiVirus engine returned [Access Denied] on [i:\pagefile.sys] 4:01 PM: Warning: Failed to access drive H: 4:01 PM: Warning: Failed to access drive G: 4:01 PM: Warning: Failed to access drive F: 4:01 PM: Warning: Failed to access drive E: 4:01 PM: Warning: Failed to access drive D: 3:37 PM: Starting File Sweep 3:37 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 3:37 PM: Starting Cookie Sweep 3:37 PM: Registry Sweep Complete, Elapsed Time:00:00:04 3:37 PM: Starting Registry Sweep 3:37 PM: Memory Sweep Complete, Elapsed Time: 00:01:20 3:36 PM: Starting Memory Sweep 3:36 PM: Start Full Sweep 3:36 PM: Sweep initiated using definitions version 823 3:36 PM: Spy Sweeper 5.2.3.2138 started 3:36 PM: | Start of Session, Saturday, December 16, 2006 | ******** 3:36 PM: | End of Session, Saturday, December 16, 2006 | 3:35 PM: Your definitions are up to date. Keylogger: Off BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On 3:34 PM: Messenger service has been disabled. Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: Off 3:34 PM: Shield States 3:34 PM: Spyware Definitions: 816 3:34 PM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/16/2006 1:52:12 PM (GMT) 3:34 PM: Spy Sweeper 5.2.3.2138 started 3:34 PM: Spy Sweeper 5.2.3.2138 started 3:34 PM: | Start of Session, Saturday, December 16, 2006 | ******** ================================================== F-Secure- Scanning Report 16 December 2006 00:51:54 - 02:01:00 Computer name: DADS-OFFICE Scanning type: Perform full computer check Target: C:\ I:\ K:\ L:\ + system + rootkits Result: 39 malware found Trojan.BAT.Starter.j (virus) * K:\TEMP\bt8532.bat Action: quarantined * K:\TEMP\bt8364.bat Action: quarantined * K:\TEMP\bt8102.bat Action: quarantined * K:\TEMP\bt7861.bat Action: quarantined * K:\TEMP\bt7860.bat Action: quarantined * K:\TEMP\bt7838.bat Action: quarantined * K:\TEMP\bt7718.bat Action: quarantined * K:\TEMP\bt7534.bat Action: quarantined * K:\TEMP\bt7532.bat Action: quarantined * K:\TEMP\bt7002.bat Action: quarantined * K:\TEMP\bt6468.bat Action: quarantined * K:\TEMP\bt6011.bat Action: quarantined * K:\TEMP\bt5816.bat Action: quarantined * K:\TEMP\bt5521.bat Action: quarantined * K:\TEMP\bt5502.bat Action: quarantined * K:\TEMP\bt5316.bat Action: quarantined * K:\TEMP\bt5301.bat Action: quarantined * K:\TEMP\bt4853.bat Action: quarantined * K:\TEMP\bt4800.bat Action: quarantined * K:\TEMP\bt4631.bat Action: quarantined * K:\TEMP\bt4422.bat Action: quarantined * K:\TEMP\bt4171.bat Action: quarantined * K:\TEMP\bt3845.bat Action: quarantined * K:\TEMP\bt3832.bat Action: quarantined * K:\TEMP\bt3700.bat Action: quarantined * K:\TEMP\bt3365.bat Action: quarantined * K:\TEMP\bt2665.bat Action: quarantined * K:\TEMP\bt2371.bat Action: quarantined * K:\TEMP\bt2328.bat Action: quarantined * K:\TEMP\bt2022.bat Action: quarantined * K:\TEMP\bt1773.bat Action: quarantined * K:\TEMP\bt1664.bat Action: quarantined * K:\TEMP\bt1426.bat Action: quarantined * K:\TEMP\bt1358.bat Action: quarantined * K:\TEMP\bt1152.bat Action: quarantined * K:\TEMP\bt0358.bat Action: quarantined * K:\TEMP\bt0000.bat Action: quarantined Backdoor.Win32.Iroffer.13b9 (virus) * K:\WINDOWS\r0ck.exe Action: quarantined Alexa (Data miner) * REGVALUE:HKU\.DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} REGVALUE:HKU\S-1-5-21-789336058-861567501-839522115-1003\software\microsoft\internet explorer\extensions\cmdmapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} REGVALUE:HKU\S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} Action: quarantined Riskware found RemoteAdmin.Win32.WinVNC.4 (riskware) * K:\Program Files\RealVNC\VNC4\vncconfig.exe * K:\Program Files\RealVNC\VNC4\wm_hooks.dll RemoteAdmin.Win32.WinVNC.4110 (riskware) * K:\Program Files\RealVNC\VNC4\winvnc41.exe RemoteAdmin.Win32.RAdmin.22 (riskware) * K:\Documents and Settings\VCR\Desktop\radmin22.zip\RADMIN22.EXE Statistics Scanned: * Files: 151079 * Not scanned: 83 Result: * Viruses: 38 * Spyware: 1 * Suspicious items: 0 * Riskware: 4 Actions: * Disinfected: 0 * Renamed: 0 * Deleted: 0 * Quarantined: 39 * Failed: 0 Boot Sectors: * Scanned: 1 * Infected: 0 * Suspicious items: 0 * Disinfected: 0 Files not scanned: * Cannot open file I:\HIBERFIL.SYS * Cannot open file I:\PAGEFILE.SYS * Cannot open file I:\WINDOWS\SYSTEM32\CONFIG\DEFAULT * Cannot open a file in archive K:\HIBERFIL.SYS * Cannot open a file in archive K:\PAGEFILE.SYS * Cannot open file K:\WINDOWS\SYSTEM32\CISCV.EXE * Cannot open file K:\WINDOWS\SYSTEM32\CLIPSVR.EXE * Cannot open file K:\WINDOWS\SYSTEM32\DMSYSTEM.EXE * Cannot open file K:\WINDOWS\SYSTEM32\FILTER.INI * Cannot open file K:\WINDOWS\SYSTEM32\LIBEAY32.DLL * Cannot open file K:\WINDOWS\SYSTEM32\NETSDDE.EXE * Cannot open file K:\WINDOWS\SYSTEM32\SCVHOST.EXE * Cannot open file K:\WINDOWS\SYSTEM32\SERVICESRV.EXE * Cannot open file K:\WINDOWS\SYSTEM32\SSLEAY32.DLL * Cannot open file K:\WINDOWS\SYSTEM32\T-EXEC.DLL * Cannot open file K:\WINDOWS\SYSTEM32\UNPS.EXE * Cannot open file K:\WINDOWS\SYSTEM32\WS3_32.DLL * Cannot open a file in archive K:\WINDOWS\JAVA\PACKAGES\GCE57B1V.ZIP * Cannot open a file in archive K:\WINDOWS\JAVA\PACKAGES\QA4FJ77Z.ZIP * Cannot open a file in archive K:\WINDOWS\JAVA\PACKAGES\UTV7BPVB.ZIP * Cannot open a file in archive K:\WINDOWS\JAVA\PACKAGES\VRLN13HB.ZIP * Cannot open a file in archive K:\WINDOWS\JAVA\PACKAGES\XRBZHFZH.ZIP * Cannot open file K:\WINDOWS\$NTUNINSTALLQ828026$\MSDXM.OCX * Cannot open file K:\WINDOWS\$NTUNINSTALLQ828026$\WMPCORE.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLQ329834$\REG00002 * Cannot open file K:\WINDOWS\$NTUNINSTALLQ329390$\REG00002 * Cannot open file K:\WINDOWS\$NTUNINSTALLQ329115$\REG00002 * Cannot open file K:\WINDOWS\$NTUNINSTALLQ329048$\REG00002 * Cannot open file K:\WINDOWS\$NTUNINSTALLKB839645$\FLDRCLNR.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB839645$\SHELL32.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB837001$\DAO360.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB837001$\VBAJET32.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB835732$\CALLCONT.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB835732$\RTCDLL.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB828741$\CATSRV.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB828741$\RPCRT4.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB828035$\MSGSVC.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB828035$\WKSSVC.DLL * Cannot open file K:\WINDOWS\$NTUNINSTALLKB824141$\USER32.DLL * Cannot open a file in archive K:\PROGRAM FILES\PINNACLE STUDIO\AUXILIARY FILES\MOROSO- GIRLS\DVD\DVDTMP\VOLUME * Cannot open a file in archive K:\PROGRAM FILES\AHEAD\INCD\DMA.BIN * Cannot open a file in archive K:\PROGRAM FILES\AHEAD\INCD\GAA.BIN * Cannot open a file in archive K:\PROGRAM FILES\AHEAD\INCD\LGC.BIN * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\PHOTOSHOP TEMP62110795 * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_4A9HSNBSWDWY0G3 * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_BC3WM2880VWWTCB * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_CV0KY2NKOEQKBOT * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_DG8JMTKTM4LOWGR * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_DY9M3DPV43B2HGB * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_ELB3MPYRIGEFXUH * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_EQUGSBLGDSG69ZV * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_FJXWT5WXHOVHWU8 * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_IMCFPBNLKOADDCS * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_JNUVFSXGJN8RNN2 * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_ORPGR1Q4F5YMU7M * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_QHXVRE0CGRPWCNE * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_QYHJFNG3GTUBC40 * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_XON2UBDICXGPAS6 * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_ZCFNLDWTKMNHE5T * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\SQLITE_ZMI4OQDDE4TOXDD * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DATA2.CAB * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\CTZAPXX.EXE * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\INSTWDM.DLL * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\THK3216.DLL * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\UPDDRV9X.DLL * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\WDM\COMMON\A3D.DLL * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\WDM\COMMON\AC3API.DLL * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\WDM\COMMON\COMMONFX.DLL * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF002\DRIVERS\WDM\COMMON\CTAGENT.DLL * Cannot read from file K:\Documents and Settings\VCR\Local Settings\Temp\CRF001\creaf_ms.cab\AudioHQ\Cht.cab [F-Secure Libra] * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\TEMP\CRF001\AUDIOHQ\BRZ.CAB * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBDAM * Cannot open a file in archive K:\DOCUMENTS AND SETTINGS\VCR\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP SEARCH\DBEAM * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify1.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify2.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify3.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify4.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify5.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusDisableNotify6.zip\sbRecovery.reg is encrypted * File K:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindowsSecurityCenterAntiVirusOverride.zip\sbRecovery.reg is encrypted * Cannot open file K:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2EE2004AB565CEE27D0A43FB8D4F48F1_2963EB01-1533-4571-B199-C14AD92C24BF * Cannot open file K:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\BRODERBUND SOFTWARE\PRINT\CD LABEL CREATOR\PMWPRINT.INI Options Definitions version: * Viruses: 2006-12-15_05 * Spyware: 2006-12-15_05 Scanning Engines: * F-Secure AVP: 6.00.171, 2006-12-15 * F-Secure Libra: 2.04.01, 2006-12-15 * F-Secure Orion: 1.02.37, 2006-12-15 * F-Secure Draco: 1.00.35, 2006-12-12 * F-Secure BlackLight: 1.00.47 Scanning options: * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX * Scan inside archives Actions: * Viruses: Ask after scan * Spyware: Ask after scan Copyright © 1998-2006 Product support | Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name. This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability. ============================================= AVG: ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 11:45:40 PM 12/15/2006 + Scan result: HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned. :mozilla.39:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.40:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.41:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.42:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.45:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. I:\Documents and Settings\Juan\Cookies\juan@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@saksfifthavenue.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. :mozilla.10:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.63:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. I:\Documents and Settings\Juan\Cookies\juan@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. K:\Documents and Settings\VCR\Cookies\[removed][1].txt -> TrackingCookie.Coremetrics : Cleaned. :mozilla.46:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. I:\Documents and Settings\Juan\Cookies\juan@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@linksynergy[2].txt -> TrackingCookie.Linksynergy : Cleaned. K:\Documents and Settings\VCR\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned. K:\Documents and Settings\VCR\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned. K:\Documents and Settings\VCR\Cookies\vcr@overture[2].txt -> TrackingCookie.Overture : Cleaned. K:\Documents and Settings\VCR\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned. I:\Documents and Settings\Juan\Cookies\juan@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.15:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Trafic : Cleaned. :mozilla.18:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.19:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.20:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.21:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.22:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.23:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.53:K:\Documents and Settings\VCR\Application Data\Mozilla\Firefox\Profiles\ipq6ruui.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. K:\Documents and Settings\VCR\Cookies\[removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.11:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.12:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.13:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.14:I:\Documents and Settings\Juan\Application Data\Mozilla\Firefox\Profiles\gnr0rajj.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. K:\Documents and Settings\VCR\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end

There were a lot of bad stuff removed or quarantined by the scans, but you still have some bad files left that are associated with the SBot worm. We need to run SDFix but it needs to run on your boot drive in safemode. Your going to have to try making the bad drive the boot drive again and see if you can boot to Safemode and run SDFix. Since your system is a little cleaner now, try running BootSafe and get into safemode and run that tool.

I am unable to get the original boot disk up and running again. When it is used in a startup, it goes through the paces until the Windows XP splash screen appears (the one with the bar across the bottom) then it just stays there. When I try to do a WIndows repair install, everything loads fine until the first reboot which boots from the HD, then it gets stuck in the same place again. The "Fresh Install" option gives me a warning about multiple OS's so I took a pass on that one. Any ideas on how to move forward?

First we have to determine what file structure you have, it must be NTFS and not FAT32

It is important to confirm that the "faulty disk" upon which we may perform "fixboot" or chkdsk /r, is formatted in NTFS and is NOT formatted in FAT32.

Damage can occur to Hard Disk file structure when running chkdsk due to the "long file names" common in XP

You can determine which format FAT32 or NTFS the Drive is running by right-clicking on the drive, for instance C:\ (where C:\ is the "faulty drive") and Select Properties. The General(tab) will display the Drive and report the File System (format type)



Then if its NTFS we can proceed to repair the boot sector.




Your inability to boot into SAFE Mode "sounds like" a failure of the Boot Sector due to a damaged boot sector or a missing or corrupt ntldr or ntdetect.com files.

To repair Boot sector, you need to Copy the (2) two files onto the faulty Hard Drive.
ntldr
ntdetect.com


You can do this from the Recovery Console:

To Enter Recovery Console:
Go into BIOS and change the Boot Order, such that CD ROM is first in the list, followed by C\ and then A:\ (where C:\ is the Hard Drive we are working on (the faulty one))

Place the XP CD into the CD ROM Tray
Exit from BIOS - Saving Changes
The machine will begin booting and will first "see" the CD ROM
You first get the "blue" WELCOME screen.
Select "R"

The Screen will change to "black" with white lettering
Here you will be given a choice of which Windows System you would like to Log into:
Select the Faulty one by entering the number representing it. 1 or 2

Next you will be prompted to enter the Administrative Password.
I realize you have been stuck here before. (but it is worth a try.)
The Administrative Password is usually "blank" (meaning don't enter anything, just hit Enter)

If you get this far, the next steps will help repair the Boot Sector:

To replace damaged ntldr and ntdetect.com you can copy fresh files from the XP CD using the COPY command. Boot with the XP CD and enter the Recovery Console.
At the Command Prompt type the following (where "X" is your CD-Rom drive letter) allowing the files to overwrite the old files
COPY X:\i386\NTLDR C:- Enter
COPY X:\i386\NTDETECT.COM C: Enter

To repair a damaged Boot Sector
at the command prompt type FIXBOOT and press Enter.
Then answer "Y"

Type "exit" at the prompt to continue the boot process.
It will boot Normally.
You will then need to >>Remove the CD from the TRAY<<
Then Reboot – tapping F8 to get to the Boot Order Menu
The Select SAFE Mode

Or you can try using MSCONFIG to force boot to SAFE Mode

Went through the above, and the reboot still gets stuck on the Windows XP splash screen. I am just going to start loading software on my new boot drive and give up on the onld one. I think it will take less time to start from scratch than it will to repair the old one. How do I move my Outlook emails and address book since I can no longer create a backup .pst file?

Sorry you have to go through all that, but sometimes its needed as a last resort. I know malware and such can cause a multitude of problems, I have never seen a system so messed up like this one. Like I said before, don't know if malware caused it or if it was hanging by a thread and the malware finished it off. If you can't use the export feature in Outlook, then the only resort is to copy and paste them and most likely will have to do them manually. After you get your new drive set up, be sure to format the old drive to get rid of all that bad stuff. Your registry is with the new drive so you don't have to worry about any malware in the registry from the old drive. Wish I could have done more but you were pretty heavily infected and your system was in bad shape. Ken

Before I move files over to my noew boot drive, I want to make sure I am free of trojan/virus files. Since I am now able to boot in safe mode with the fresh OS, I ran SpySweeper again and there are a few Trojans and Viruses detected (see log). How can I rid myself of these files? I get a nasty crash when I try to move the files the old fashioned way. 5:23 PM: Traces Found: 3 5:23 PM: Full Sweep has completed. Elapsed time 01:47:43 5:23 PM: File Sweep Complete, Elapsed Time: 01:46:10 5:22 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\my documents\my personal\computer class\project 2000\0541lgeedd.zip] 5:19 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\local settings\temp\crf001\creaf_ms.cab] 5:19 PM: Warning: Stream read error 5:19 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\local settings\temp\crf001\creaf_ms.cab] 5:18 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusoverride.zip] 5:15 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify6.zip] 5:15 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify.zip] 5:13 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify1.zip] 5:13 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify2.zip] 5:13 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify3.zip] 5:12 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify4.zip] 5:12 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusdisablenotify5.zip] 5:10 PM: Warning: AntiVirus engine returned [File Corrupted] on [c:\recycler\s-1-5-21-2025429265-152049171-854245398-1003\dh71\my stuff\jamiii files\computer class\project 2000\0541lgeedd.zip] 5:04 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\lavasoft\ad-aware se personal\skins\ad-aware se default.ask] 4:58 PM: K:\WINDOWS\Fonts\cqlipsvr.fon (ID = 0) 4:51 PM: K:\WINDOWS\system32\clipsvr.exe (ID = 0) 4:51 PM: Found Troj/ServU-DW: Troj/ServU-DW 4:51 PM: k:\windows\system32\drivers\etc\fonts.{bd84b380-8ca2-1069-ab1d-08000948f534}\com1\aux\dir\extsrv.exe (ID = 0) 4:51 PM: Found Troj/ServU-DX: Troj/ServU-DX 4:48 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf] 4:48 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf] 4:48 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf] 4:46 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\vcr\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuadbe0060.pdf] 4:46 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\vcr\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuyhoo0010.pdf] 4:23 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\documents and settings\vcr\local settings\temp\sqlite_qhxvre0cgrpwcne] 4:20 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\documents and settings\vcr\my documents\2006_cruise_answer_book.pdf] 4:12 PM: Warning: AntiVirus engine returned [File Corrupted] on [k:\program files\logitech\video\videoeffects\metadata\party_glasses_{493e8329-8303-49bb-a5a6-8598861ee26f}\party_glasses.lvf] 4:10 PM: Warning: AntiVirus engine returned [File Encrypted] on [k:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf] 4:06 PM: Warning: Failed to access drive J: 4:05 PM: Warning: AntiVirus engine returned [Access Denied] on [i:\hiberfil.sys] 4:05 PM: Warning: AntiVirus engine returned [Access Denied] on [i:\pagefile.sys] 4:01 PM: Warning: Failed to access drive H: 4:01 PM: Warning: Failed to access drive G: 4:01 PM: Warning: Failed to access drive F: 4:01 PM: Warning: Failed to access drive E: 4:01 PM: Warning: Failed to access drive D: 3:37 PM: Starting File Sweep 3:37 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 3:37 PM: Starting Cookie Sweep 3:37 PM: Registry Sweep Complete, Elapsed Time:00:00:04 3:37 PM: Starting Registry Sweep 3:37 PM: Memory Sweep Complete, Elapsed Time: 00:01:20 3:36 PM: Starting Memory Sweep 3:36 PM: Start Full Sweep 3:36 PM: Sweep initiated using definitions version 823 3:36 PM: Spy Sweeper 5.2.3.2138 started 3:36 PM: | Start of Session, Saturday, December 16, 2006 | ******** 3:36 PM: | End of Session, Saturday, December 16, 2006 | 3:35 PM: Your definitions are up to date. Keylogger: Off BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On 3:34 PM: Messenger service has been disabled. Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: Off 3:34 PM: Shield States 3:34 PM: Spyware Definitions: 816 3:34 PM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/16/2006 1:52:12 PM (GMT) 3:34 PM: Spy Sweeper 5.2.3.2138 started 3:34 PM: Spy Sweeper 5.2.3.2138 started 3:34 PM: | Start of Session, Saturday, December 16, 2006 | ********