Log-on issue with computer

[kls490]

Thanks very much, essexboy.  I'll repost when everything is completed.

[kls490]

Morning essexboy,

     I believe there is a problem with running the "fix" with OTL.  I started at 5:56 p.m. last night.  The user interface showed the statement at the bottom which read, "Killing processes, "DO NOT INTERRUPT..."

There was no significant change on the screen, no icons disappeared, not even any hard drive activity.  The only change I did see was the digital time display on the Taskbar was stopped at 5:57 p.m. last night, and just after the "fix" was started, and the OTL program icon showed up on the Taskbar, the MBAM program icon also showed up beside the OTL program on the Taskbar.  Since it is now over 12 hours later, I would think that is far more than sufficient time for the fix to run, and something else must be hindering it functioning properly. 

I have included the 2nd scan results for your review.

Thanks very much for the help though.  

Best regards.

[essexboy]

Do you have MBAM 1.6 ?  If so you need to disable it prior to running OTL as MBAM blocks it

[kls490]

Hi again essexboy,

     Yes, I have MBAM Pro (latest version).  Do you want me to go back to your last post on page 1, copy that text in the quote box & try running the OTL fix again?  If so, how long does it usually take for it to complete?

Thanks again.

[essexboy]

That size fix should take no more than two or three minutes max

Yes disable MBAM please as it takes umbrage at OTL trying to stop the process and blocks it

[kls490]

Essexboy,

     Encountered another problem while the fix was running & then stopped.  I received the following error message:

Access violation at address 0040295B in module 'OTL.exe'.  Read of address 001F8000.

After getting back on the computer, I got the Security Warning message about a program still being open (OTL.exe).

Regards.

[essexboy]

A question ... How many memory sticks do you have in your computer ?

[kls490]

Besides the C drive (hard drive), there are two USB flash drives connected to the computer, but access to them is controlled by Outpost Firewall's File & Folder Lock feature which I have enabled on them.  Access to them was blocked at the time I ran the fix.

Shall I remove them from the computer and try running the fix again?

[essexboy]

Sorry I meant how many modules of RAM are in your system 1 or 2

[kls490]

There are two 1 GB sticks.  Another note...these are NEW RAM chips which were installed back on Janury 6th.

[essexboy]

OK lets do a final confirmatory run that it is not a malware problem

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[kls490]

Hi again essexboy,

     First, I appreciate all your help on this one!  It appears the problem has not been resolved.  When ComboFix went to reboot, the system generated an error message on the screen behind the ComboFix window.  After waiting 15 minutes and nothing happening, I minimized the CF window to read the error message which was this:

Unable to create backup of current registry file C:\Windows\System32\config\Security!  Continue with restoration of this file?

I clicked on YES.  A second error box opened after this one with a similar type message (didn't recall the exact wording though).  I clicked YES on that one too.  CF finally rebooted, but the computer again hangs at the Dell logo screen with that whistling sound until I pressed the F12 key.  Then it displayed a partial section of the Windows log-on screen, until about 20 seconds after I pressed the <ESC> key, then I was able to log back on.  The computer will still NOT display the Windows DEFAULT Administrator account after I press <CTRL>, <ALT>, <DEL>, like it used to do.  Still have to manually type it in the username box.

The CF log is appended here for your review.

[essexboy]

Could you download the McAfee removal tool and run please  http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

This is starting to look like a definite hardware problem

Especially as the registry is not being saved in a timely manner

Have you done a chkdisc lately ?

[kls490]

Hi again,

     I'll try that MCPR tool, though I've run it before, but don't think it removed everything.  It's been a month or so since the last chkdsk was done.  The only way the system will do it is on a reboot though.  For some reason, it always generates a message that some program it needs is in use by another program.

Will run the chkdsk also and post back.

[essexboy]

Aye thats right as it can only check the primary disc when it is not in use