Hijack this unresponsive at 04 Registry and Start Menu autoruns

S

smellypoo

New Member
I have a windows xp installation disk but I'm unable to reinstall it so I decided to give it another shot and finally was able to install and open Hijackthis. Anyways, everything is fine until it gets to 04 Registy and start Menu auto runs. It becomes unresponsive. Then I get a popup that says, "the action cannot be completed because the other application is busy. choose 'switch to' to activate the busy application and correct the problem". Then hijackthis freezes. If hijackthis scan did not complete, would a log still be saved somewhere?

My computer is incredibly slow. I can't use the internet. I did recently install a new ram stick. I removed it to see if that was the problem but the problem was still there after the ram stick was removed. And as I said before, I was drunk the night I was messing with services.msc. The only thing I remember is trying to remove bonjour and not being able to. Then I proceded to download some program that I can't remember the name of. I assume it is a virus though. I also downloaded winutilities on the same night. The problems began the next morning after I turned on my pc.

Also I'm currently trying to install mbam. I will write my rkill log out somewhere in this forum once I am able to open it. Combo-fix won't open btw.
 
Last edited:
If rkill won't kill the process stopping combofix from running then just redownload combofix but this time save the file as combo-fix instead of combofix. Technically it can be saved as anything to spoof the malware stopping it from running.
 
I tried installing combo-fix and got this

"Error- Win32 only
OS incompatible. combofix only works for workstations with wndows 2000 and xp"

However, I did get an rkill log...finally (I'm going to have to write it out though so hopefully no spelling errors)

Services Stopped:

Processes terminated by Rkill or while it was running

c:\32788R22FWJFW\cmd.cfxxe
c:\32788R22FWJFW\License\iexplore.exe
F:\combo-fix.exe
F:\rkill.scr
c:\WINDOWS\system32\taskmgr.exe
f:\rkill.exe
c:\Documents and Settings\go away virus\Local Settings\Temp\24.tmp\pev.rkexe
c:\32788R22FWJFW\PEV.exe
c:\WINDOWS\system32\net1.exe

(the rest of the log is repeated cus I opened rkill 3 times.)

edit:I just got a popup for combo-fix. I think its about to run.
 
Last edited:
I got a pop up from combo-fix
rootkit- TDL3 is infected

its been running for the past 10 hours though. Should I just close it or keep letting it run?
 
10 hours is way too long for combofix. Please stop and reboot into safe mode and rerun combofix. Usually if it detects a rootkit it will reboot the sytem and start scanning again. If the system reboots make sure it boots back into safe mode.

Can you get malwarebytes to run and produce a log?

Download and run Ccleaner to delete old temporary internet and system files so combofix won't scan as long.

http://download.cnet.com/ccleaner/


You may be better off backing up any data you need and reinstalling windows.
 
I'm at the point where I don't care if I lose everything on this pc. I would just like to get this resolved. Reinstalling windows was an option but I cannot boot from BIOS. I set the settings so that it would boot from cdrom but that is not working. You did mention that one reason it would not boot from BIOS is because the drive was messed up. I do have an extra cd drive but installing that is like last resort at the moment and I don't even know if the cd drive is an issue. I rather not mess up all the cables and forget where each one of them goes then have zero chance of fixing it. I did try installing windows by logging into my admin account. The process was only supposed to take 51 minutes. I chose the option in which I would not have to download the updates from the internet because the internet was not working for this pc. Anyways, I left my pc running for 5 hours trying to install it and well that din't work.

At like the 10th hour at running combo-fix I did get a message saying combofix has detected the presence of rootkit activity and needs to reboot the machine. I did choose the reboot option but it never rooboted. It stayed on the windows desktop part but din't show any icons or the windows bottom sidebar thing. I gave it like an hour to reboot itself and finally just turned the thing off myself.

Not sure if this is any help but when I open the task manager it shows CPU usage at 100%.

Update: combofix got to the part where it was backing up files but then said I would need an internet connection so that I could download some recovery thing. I can't connect to the internet ever since I got this virus though. Would it be possible to download it from another computer and if yea where on my computer would I transfer it to? I have windows xp professional service pack 2.
 
Last edited:
Don't worry about installing the recovery console. Click on no when it asks you if you want to download and install it.
 
I have a question about combo-fix...
How many stages are there? Its been running for about 6 hours now. On stage 4. I guess its making progress because before I never got to any of the stages.
 
Totally of 50 stages but some of have letters at the end of them so technically more than 50 total. The most it should take to scan is probably 30-45 minutes. i know if you don't clean out all the old temporary internet files and such it will take longer, You may want to download and run Ccleaner first and then run combofix.
 
ok completed all 50 stages and got to the pat where it says Deleting Files. I'm stuck there now. I'm scared to close it in case it is actually making progress but I'll just post what I have incase its not.

Deleting Files:

C:\DOCUME~1\tv\LOCALS~1\Temp\dwm.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\93100.exe

C:\Documents and Settings\tv\Local Settings\Temp\dwm.exe
C:\install.exe
C:\WINDOWS\bootkey.dll
C:\WINDOWS\madexml.dll
C:\WINDOWS\system32\0.7258771841655116
C:\WINDOWS\system32\bjinstalle.dll
C:\WINDOWS\system32\bootskey.dll
C:\WINDOWS\system32\drivers\ehzgxybl.sys
C:\WINDOWS\system32\drivers\ghatkqrs.sys
C:\WINDOWS\system32\xegmyryy.ini
C:\xcrashdump.dat
 
When its done it will create a log in notepad on your screen meaning its done. I need you to copy and paste that log back here.
 
I understand that part, I'm just asking if I should keep going or just turn combo fix off. In 2 hours it will be a full 24 hours that combo fix is running. I ran ccleaner before using combo-fix but on a different user account. Would it work if I opened ccleaner while still running combo fix?
 
No you can't run programs while combofix is running. Ccleaner needs to be ran on every user on the system. How does the other acount work? If it works better tjan yours, may want to run combofix from that account.
 
I had to close combo-fix. It wasn't responding. I left it running for an entire day. It stopped doing anything after it deleted C:\xcrashdump.dat. Is there anything else I can do? Like maybe I can get u a log some other way? Are there anyother programs like rkill, hijackthis, or combofix? I have a windows xp cd but I'm having problems installing it. I can't boot it from bios and it freezes when installing through my main account.

Oh, there are two account on my pc. I created the second after I noticed problems on my main account. I thought that if I set my main account to a limited account then maybe I could stop the virus somehow and then run a scan from the new admin account and run a virus scan from there. I din't get the chance to test that out though. My main account seems to be working better than the other. I was actually able to get to the combofix stages yesterday on this account.

Anyways, now I'm getting a pop up on start up that says, temp\dwm.exe is missing or corrupted. I looked it up and found out that EXEs are not supposed to be in that folder but then someone mentioned that I should repair it using registry cleaner.

I followed your instructions at ran ccleaner then rebooted and opened combo fix. My pc froze twice while trying to do this.

edit: ok I feel dumb. I just read online that I shouldn't mouse click while combo fix is running. I did mouse click but I can't remember if it was before it stopped working. But still it said it would cause it to stall, the stall lasted nearly 7 hours so maybe not....I dunno


I ran rkill again just cause I had nothing left to do and new things came up.
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\tv\Local Settings\Temp\5.tmp\pev.rkexe
C:\WINDOWS\system32\imapi.exe

I read on another forum that OTL should get rid of it?
 
Last edited:
that din't work.

ok i'm gonna try to reinstall windows from bios. how do i fix it if it doesn't detect the cdrom or usb?

I tried booting from both options.
 
Thanks for trying to help me :) I realize you can't do much without those logs but I think I"m going to ask in a few other forums....desperate here. Combofix isn't working on either accounts. Neither is mbam or hijackthis. The only option I have left seems to reinstall windows but that isn't working. BIOS is set to boot from the cdrom and then ide-0. I also tried setting all 3 boot options to cdrom. The cd drive is working fine but the setup disc was not detected. so don't know what to do anymore. thanks though :)
 
Are you sure the cd is bootable? Is it a genuine Microsoft install CD? Is it a burned copy?
 
You must log in or register to reply here.
Back
Top