XP Home - many strange issues

Howdy folks. This one has been fun thus far. XP Home.

1. Start button is empty, except All Programs, and log off, turn off -

2. You can't see the start button because it is either off the screen to the left, or covered up by a large gray box in the task bar (see below)

3. Large gray box covering most of the taskbar except the notification area on the far right. Cannot move it, remove it, etc....(Have tried everything).

4. The start menu is on the top of the screen...

5. Ctrl-Alt-Del does nothing.

6. When you click on most programs, you get: this application has failed to start because the application configuration is incorrect. Reinstalling the app may fix this problem.

7. I can get online with IE, but the menu bar is gone - cannot fix it.

8. When I try to run a online scan, when I go to install the activex part, it says that " your security settings do not allow web sites to use ActiveX controls installed on your computer" - I have all security settings at default.

9. Safe mode does same thing.

* I have tried a repair install - no change.
* Pulled the HD and scanned it offline - nothing to speak of except "shopperreports"
* Hijackthis log looks clean (to me). I'm surprised it actually ran.

I cannot format this drive....

Where to start?

Thanks in advance.

Slave the drive and get anything you can.

Then zero fill, reformat, reinstall.

There are times you need to cut bait!

The first thing to do would be to download Combofix from HERE Then download Malwarebytes from HERE install and update. Restart PC in safemode, turn off system restore. Run the combofix, when it reboots the PC, make sure to go back into safemode. When it is done and displays the log, close the log, then start Malwarebytes, and run full scan. Sounds like you may have a rootkit or one of the nasty trojans. Good luck.

Quote:

---

Originally Posted by Zonie

The first thing to do would be to download Combofix from HERE Then download Malwarebytes from HERE install and update. Restart PC in safemode, turn off system restore. Run the combofix, when it reboots the PC, make sure to go back into safemode. When it is done and displays the log, close the log, then start Malwarebytes, and run full scan. Sounds like you may have a rootkit or one of the nasty trojans. Good luck.

---

I agree on trying this first. I've encountered a few infections that did exactly what you describe. it's gonna be a pain in the butt to get out if it's rooted in enough too however it can be removed.

Yah, I thought about running Combofix on it - its a regular running tool here. Wasn't sure if it would be able to run....I'll try it in a little bit.

Malwarebytes is awesome. Its the first scanner I run on boxes - I also like Asquared's scanner.

I'll post results later. Thanks for the suggestions.

Swing and a miss.

Combofix in safe mode gives me the same error message: "this application has failed to start...." as above.

Quote:

---

Originally Posted by jakkwb

Swing and a miss.

Combofix in safe mode gives me the same error message: "this application has failed to start...." as above.

---

Try renaming Combofix to something like 123A.exe. If this does not work, run the Malwarebytes first. I have found this helps in some cases and allows the other tools to work.

You need a rootkit analyser too.

There are many apps that will not run for getting the error message listed above. Hijackthis and a few windows apps are all that I've found so far that I can use.

Then you are better off rescuing what data you can and zero filling the drive.

Just for future reference since this helped me on the tough infections.
1. Re-enable administrator control for applications to be run by making the appropriate changes in the registry.
2. Always rename the exe files of your tools even the installers to something that's not the same name as it would be on acquisition.
3. make a batch file for each exe and run the batch files to activate the programs.

Quote:

---

Originally Posted by NooNoo

Then you are better off rescuing what data you can and zero filling the drive.

---

Personally, I'd try plugging the drive into another machine and scanning it first. Assuming of course you have a machine you don't mind exposing to some risk, and the space and time requirements aren't too much of a production bottleneck. I think its worth the investment to have a machine (fairly old and slow works) that just exists to do data recovery and malware removal, along with a quiet corner for it and perhaps a KVM switch. When you have a machine where you don't trust the backup, if it has a recent one at all, it takes a lot of time to get the machine back to where it was when things went wrong. How much software has to be reloaded, how many years of updates and service packs, how many plugins, addons, and patches for them? Still, sometimes only the Nuclear Option works.

I gave up. Reformatted. I like a challenge, but....

Owner is just upset b/c I'm not going to reinstall all their pirated (maybe) software.

No original CDs, no install.

Cheers.

Quote:

---

Originally Posted by jakkwb

I gave up. Reformatted. I like a challenge, but....

Owner is just upset b/c I'm not going to reinstall all their pirated (maybe) software.

No original CDs, no install.

Cheers.

---

So, jakkwb, seems like there was something you forgot to mention in your previous posts. Not like that might have violated forum policy or anything.

I'm not taking sides but I am just going to say it is possible he wasn't aware the client was using pirated software until he requested the CDs. I come across that quite often. A client will dance around the topic and say they are still looking for them but in the end run I usually get them to admit the CD never existed. Typically I get that answer AFTER I blow away windows.

You are absolutely right Niclo. And I'm really not accusing jakkwb of anything improper. I'm just suggesting that if his client was in fact running some warez, we might have saved some time and effort had we known. I think jakkwb probably didn't understand the situation. We've all been there. Tell a client we need to reinstall his software and listen to 45 minutes of him saying he isn't a thief and a pirate and do you actually have to buy software, isn't it free?

Personally, I always address this upfront as a worst case scenario. "If your hard drive explodes, I'll need your original media or your licenses to get replacements for you." As professionals, this is just one more thing of which we need to be aware.

Edit: The problem with dealing with thieves is that they'll steal from you as quickly as anyone. Just from a purely practical standpoint, there's no reason to do them a favor. It just marks you as a chump and a target.

I am simply amazed how many people are running pirated office from a CD from a friend. With the cost of home and student with 3 licences being around £60, why do it? They will spend that much in one evening down the pub!

Quote:

---

Originally Posted by NooNoo

I am simply amazed how many people are running pirated office from a CD from a friend. With the cost of home and student with 3 licences being around £60, why do it? They will spend that much in one evening down the pub!

---

Because that would make sense!
Actually my step dad pirates movies, and music when he can (Not warez he just finds ways to make copies of the media for himself). I can't figure out why as I've looked at the pains he goes through to achieve it and in a lot of cases I see it as being just as expensive if not more just to pirate whatever it is. I think people get a misplaced sense of revenge on the stores that sell items at prices that are too high for the buyer by giving that money to someone else.

OK, let me clear this up. I do NOT pirate software. This laptop had a valid XP Home key on it (label). MS-Office was also on it, but no key or media. Other softwares of less value.......

I put XP Home back on it. That's all. I then suggested Open-Office to them. They will probably get back online and get the pirated version of Office again and reinstall.

Thank you forum people for all the help you give,

Jakkwb

Never said you did pirate software I was just putting in my two cents worth of thoughts about piracy in the general consumer aspect.