Troj/Ana-01, My System crashed after I......

Viruses and worms
1

Well all was well but didnt end well. I finished downloading the update package for xp = xp sp2, attempted to install it and the up popped this error:
http://SYSTEM ERROR

Core system file (kernel) used to start this computer is not a MS Windows file. Service pack not installed. Knowledge base article - Q327101 Contact support at
http://supportmicrosoft.com

:oAnyone know what that is supposed to mean? And them the system flashed red, beeped and ended. Wouldnt reboot twice, then it did on its own, but I lost everything that I had fixed previously on my last topic in reguards to Troj/Ana-01 yesterday. I have fixed the registry and all looks ok again. I removed virus and still have the download intact. But am affraid to try and install the sp2, again. System erased all my network connection settings. Just got this resolved. Is it safe to try this again??? Am sending a HJT log. Dont see any repeats from the previous problems. Do u? Ran avast4, spytract, adtrack, shredder, and xoft found nothing. Please advise. Thanks again - Sitting sideways in cali>
Lalabugu
lalabugu

2

:ook so it wont let me upload the attachement so here is a paste copy version?!? ::)thanks lala

Logfile of HijackThis v1.98.2
Scan saved at 4:45:22 PM, on 10/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\WinPcap\rpcapd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\dmadmin.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
D:\Program Files\Stardock\ThemeManager\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WLAN\802.11 Wireless LAN\WlanMonitor.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Innovative Solutions\Innovative System Optimizer - Platinum Edition version 2\MemoryOptimizer.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
D:\Program Files\SpySub.exe
C:\Documents and Settings\Kelley\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1037
O1 - Hosts: entry should be kept on an individual line. The IP address should
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU..\Run: [MsnMsgr] “C:\Program Files\MSN Messenger\MsnMsgr.Exe” /background
O4 - Startup: SpySubtract.lnk = D:\Program Files\SpySub.exe

3

Try this:
start > run > cmd > sfc /scannow
Replace all changed system files it finds with the original ones from the windows cd

It looks like youw windows is messed up.

4

:smiley: Thank you eddy. I actually located the kernel, winsock, wssock system files on my D:/ drive. Wierd? 1 so I put it back in the system32 location that it was supposed to be. All seems well so far and system is currently allowing me to down/upload again!!! I will keep your suggestion in my history books case it goes buggy on me again. I totally appreciate your help!! You are a doll!!Ill let you know if the install works
:-*Love from cali, lala

5

Always nice to hear a problem is solved.