[bbearren]

Your Dell O/S CD will work for a repair/reinstall.

UBCD4Win is one of my favorite general purpose tools for boot problems.

[Flyright]

I'll build a CD with the UBCD4Win programs when I get my computer back, the one with the CD/DVD burner. This computer I'm writing on is an old 98 system which I'm damn glad is still functional.

Trying the advice I got on the other thread I've started on this subject, I tried to fix the boot.ini. It sounded reasonable that Ghost had corrupted it. Something simple. Didn't work.

So I went to the reinstall site Muldar recommends and carefully did that. Didn't work. I went to the Informationweek link which was dead, but I got on their site anyway and found some good advice about doing the repair and finishing with the "fixboot" command. Didn't work.

I used DOS Norton Commander which I have on the unbootable disk to go in and look at the boot.ini file. After all my repair attempts today, it was a mess. So I copied my fresh XP boot.ini file on the other disk to the corrupted disk and overwrote the old file with the new one. Now for sure I have a proper boot.ini file. Didn't work.

I'm thinking how much time it took to get the system set up with everything installed and working right . . . and then I'm thinking how much time it's taking with all of these dead ends, and now I'm thinking maybe it's time to reformat the damn disk and do a fresh install.

Peter Norton wrote the book on the IBM pc and in those days he was god, but boy are those days over. This is the first time in ten or eleven years of using Windows that I've ever had to reinstall it. I hate Ghost. Except for the old Commander from Norton days, I'll never put anything Symantac on any computer of mine again.

Tomorrow I'll follow up on some of the other links on this thread and see what else I can learn before I wipe everything. I haven't given up completely - how many times have I fixed something in fifteen minutes on the morning following a day when I'd struggled all day long without success (like today).

Maybe I'll install virus & spyware protection on the new hard disk and download those UBCD4Win files.

Also, there's a big fat thing I see on the corrupted disk which looks like a "virtual partition" in the root directory. It has a name like "Virpartn*** or something like that. I don't think that should be there.

So, manana.

Thanks, Mike

[hithluin]

Hey, hope I can find some help here, I'm at my wits end

A week ago, my computer started to get really odd and refusing to open programs such as gmail notifier, iTunes, jukebox, the ewido scanner etc. so I did a scan for viruses etc. came out clean. We then tried to reinstall windows XP (home edition, SP2) but the setup said it was missing this file: awviup43.sys. We then installed windows defender which caught 2 viruses. Defender led me to these 2 links for the stuff it caught: http://www.microsoft.com/security/en...threatid=16453 and http://www.microsoft.com/security/en...08427027806866 . I quarantined both.

Unfortunately, problems persisted. I still can't open aforementioned programs, windows keeps flashing up that explorer had an error but I ignore it because if I click on it it forces me to basically restart the computer, and whenever I do tell the computer to restart, it keeps telling me it can't shut down the DDE server and something else I can't remember the name to.

Aside from that, I tried to reinstall XP again today. It seems to have gotten over the old file it says was missing, and it now insists there's a new system file missing: aer9zjql.sys I really have no idea what to do now and don't know whether all the stuff I've been doing is just messing up the computer more or whether there's just another trojan/virus running around that I can't find. Either way, I desperately need help if anybody would be so kind? I seeked help here before about a trojan I had a year ago and I remember HJT logs being useful so I have enclosed one:

Logfile of HijackThis v1.99.1
Scan saved at 10:35:21 PM, on 18/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Gizmo Project for LJ Talk\mDNSResponder.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Streamload\MediaMax XL\MediaMaxXLService.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\CheetahBurner.exe
C:\Program Files\Mozilla Firefox 2 Beta 2\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 66.47.217.98:3128
F1 - win.ini: run= C:\WESTWOOD\REDALERT\INSTICON.EXE
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .exe: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npfd.dll
O12 - Plugin for .htm: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1131779616890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1166447846088
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo Project for LJ Talk\mDNSResponder.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MediaMax XL Service (MediaMaxXLService) - Streamload - C:\Program Files\Streamload\MediaMax XL\MediaMaxXLService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

[wacor]

Hi Hithulin

I would suggest you ask your post be moved to Security where somebody can give you advice on your Hijack This log. It will get more attention there. You can ask a moderator to do that by clicking on the red triangle and asking for it to be moved

[hithluin]

I felt my issue had more to do with the reinstallation of XP which was why I stuck it into this thread but for any passing moderators who feel this might belong more in Security, please movie it for me?

[bbearren]

If you do a repair/reinstall with active infections in your existing installation, you won't solve your problems, and might even make them worse.

The infections have to be dealt with first.

Follow wacor's advice; click on the red triangle and ask for your post to be moved.

Originally Posted by bbearren

A big downside to the Repair/Reinstall is that one doesn't learn anything from it. Also, if Windows is munged because of malware/virus issues, it's possible that those issues can resurrect after the Repair/Reinstall.

[guitar21]

Im to tite $ to buy a copy of windows when it first comes out when xp came out i waited a bit then tryed a copy of it but 30 day activation kept naging me so every 30days id have to reformat i done this 6 times in less then a year well
i got it down good now i have all drivers /fav freeware /anti virus+updates user setings on 1 dvd
3 months ago i payed the money for xp home OEM as i also got a new hd
i think ill wait for vista or upgrade win xp pro to 64bit

reformating is good alot of people are afraid of it but is is the best way to clean your pc


if you dont know what you are doing dont reformat it will delete your hole computer

[guitar21]

best way of getin rid of virus spyware.........cleaner faster

[bobol]

An ounce of prevention is worth a pound of cure.... So many very good free protection softwares out there, it's a shame they are overlooked by many who end up junking up their system and have to resort to reinstalls/reformats. One of my favourite first line defenders is Spyware Blaster.

[osiecki]

Rather than getting:

I get:

What gives?

[bbearren]

Could be that the MFT is hosed.

[bernardus]

I learned that reinstalling, that is to overwrite the old XP, especially with SP2, Would not work. If it's an xp with seperate SP2 you may be able to delete the SP2 update if the uninstall is still present in Windows, than it worked to rewrite Xp. But since there have been so many updates a refresh of XP is not possible, it is a new program with a different status. It never worked to repair XP.
bernardus

[bernardus]

It's not only that, many more programs make a fingerprint of your PC and you can't put them in an entirely different PC. Even changing som hardwre on the original PC can cause
your Programs to stop. Especially XP, AC/DC, or virusprograms.

bernardus

[bbearren]

Originally Posted by bernardus

I learned that reinstalling, that is to overwrite the old XP, especially with SP2, Would not work. If it's an xp with seperate SP2 you may be able to delete the SP2 update if the uninstall is still present in Windows, than it worked to rewrite Xp. But since there have been so many updates a refresh of XP is not possible, it is a new program with a different status. It never worked to repair XP.
bernardus

All you need to do is slipstream the Service Pack and updates into the original installation CD. It works just fine.

[bbearren]

Originally Posted by bernardus

It's not only that, many more programs make a fingerprint of your PC and you can't put them in an entirely different PC. Even changing som hardwre on the original PC can cause
your Programs to stop. Especially XP, AC/DC, or virusprograms.

bernardus

A repair/reinstall with a slipstreamed installation CD leaves everything pretty much intact. That's the main reason that doing a repair/reinstall won't get rid of malware. One must clean out the infestations first, then do the repair/reinstall.