Jim Lawrence
accessd at shaw.ca
Sat Apr 30 11:54:31 CDT 2011
You do have a real problem there. As a systems support tech, I run into similar issues all the time and at that point have to decide whether to actually attempt to resolve the problem or re-image/re-install. (A client is not going to pay for me to spend 4 to 6 hours fixing desktop and there is just no way to do it fast or at least guarantee it fast.) You have done all the appropriate surface diagnostics but those types of processes can only go so far. If you do really want to solve the problem and time is not that important then its time to start becoming serious and start hacking. The first test I would do is check to see whether the kernel has been hacked. You can just download/run a rootkit scanner. Some of these apps actually say they can repair the kernel but I tend to be suspicious. In most cases if your kernel has been compromised it is time to re-install. http://www.techsupportalert.com/best-free-rootkit-scanner-remover.htm The second problem is that apps can start in a dozen different places went Windows boots so the moment you re-boot all the work you may have done is just written over when some applications re-runs in the boot cycle and replaces all your handy-work. Below is an excellent app for finding various start points in a system and suggesting whether a start suspect or not. They also have a forum dump review service that may suggest solutions. http://free.antivirus.com/hijackthis/ The third problem is that Windows uses a system of cascading to find some of it components for an application. It does not necessarily do direct location calls. This gives a hacker a chance to stick a fake component further up the search chain. Finding and fixing this can be real grunt work. You have to start looking for duplicate files...one may be real, a backup or a hidden malware component. The app hackthis may supply you with a start point and then you have to work down the cascading chain. http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html There are a thousand services that will allow you to search a questionable dll or executable and give you the location in a system where it should be and the appropriate size. Here is one of many: http://www.file.net Then there are some really deep bugs. Some malware can actually place itself on a hard drive and mark its position as a bad track so it can never be scanned or removed and all it needs is one of its' components to access it directly...not even spinwrite will remove it. You can try some daring tactics like making a file image of the computer on to a portable hard drive, doing a full re-format of the drive, installing a fresh copy of windows and restoring the file image. It has its risks but it will get most everything that is hidden in drive tracks and boot sectors. http://www.runtime.org/driveimage-xml.htm HTH Jim -----Original Message----- From: dba-tech-bounces at databaseadvisors.com [mailto:dba-tech-bounces at databaseadvisors.com] On Behalf Of Tina Norris Fields Sent: Saturday, April 30, 2011 6:56 AM To: Discussion of Hardware and Software issues Subject: Re: [dba-Tech] Not Sure Quite What I'm Dealing With Here - Update 2 [Continued from Update 1] Having cleaned out the 54 infected items with MalwareBytes, I went back to trying to install Vipre. Guess what! Right back to "the Windows installer cannot be accessed." I gave another go to the unregistering and reregistering trick. No joy. Tried another update - back to the houglass followed by nothing! Found some more information on repairing the windows update agent - downloaded WindowsUpdateAgent30-x86.exe from support.microsot.com/KG/946929, and following instructions, placed it in the root, then ran it with the /wuforce switch. This did not fix the problem. Yes, I rebooted - it did not fix the problem. Another bit of advice was to use the WinXP CD, and from the command line run sfc /scannow - to verify whether all the protected Windows files are intact and in their original versions. Reboot. Attempt to install Vipre - "installer cannot be accessed." Next, I booted from the WinXP CD and ran the Repair Install. After that, I tried again to go to Windows Update to bring this fresh installation of WinXP SP2 up to date, especially to get SP3 installed. Failed - hourglass, followed by nothing. I ran WindowsUpdateAgent30-x86.exe /wuforce again - it failed with error 0x80070020. However, not I was able to reach the update site, with error 0x8.DDD0007 message that I must restart the computer before getting any more updates - turn off and install 5 updates. Next, I did a Windows update search for ServicePack 3 - found and downloaded the ISO image file xpsp3_5512.080413-2113_usa_x86fre_spcd.iso, with which I created my SP3 update CD. I ran the SP3 update. It did not complete - update.exe extended error code = 0xf200. Received instruction to run dcomcnfg, attempting to verify DCOM security - expand Component Services > Computers. When I attempted to expand the Computers folder, the whole Component Services window disappeared. I repeated that effort enough times to note that it happened consistently. I opened Admin Tools in the Control Panel, Computer Management - there is no entry for Local Users & Groups. I tried the SP3 update CD again. This time it said it did the job. But, Windows Installer is still not accessed, so I still cannot re-install Vipre. Clicking Windows Update link still produces an hourglass and nothing more. Tried the hotfix for WindowsXP-KB942288-V3-x86.exe again, after making sure it was unblocked. Reboot. Try to install Vipre. Installer cannot be accessed. Tried the hotfix for WindowsUpdateAgent30-x86.exe /wuforce, after making sure it was unblocked. Install failed with error 0x8007041d. Going directly to the windows update site, rather than trying to connect through the link, I get through the "checking your system for the latest software" screen, to the "Express" or "Custom" install screen - where no matter which choice I select, I get the message to reset my Internet Security options - error 0x800A0046. I check those settings and they are correct - they match exactly what I am instructed to set. Even if I unset them and Apply - and reset them and Apply - with or without IE restarts - I get the same message from Windows Update. The update window acknowledges that the computer is set for automatic updates - yet, it will not allow me to do any updates. I've decided to go back to the beginning. I'm running Spin-Rite on the computer right now, at level 4. Once I get that finished, I'll do another Repair Install, followed immediately by an SP3 update, and see what I have at that point. I'll keep you advised. I'll welcome and appreciate any more thoughts you guys have on this. Thanks, T