Author Archives: Steve Schardein

About Steve Schardein

The owner of the website!

Solution: STOP Error 0x0000007b (0xfffff880009a98e8 0xffffffffc000000d 0x0000000000000000…)

Posted on by
97

Hoo boy, this one’s a doozy.

So following the removal of certain rootkits (such as Rootkit.Boot.SST.a, which is associated with the Windows Recovery rogue), you may find that your Windows boot configuration data has been totally corrupted. Worse yet, the usual steps to remedy (such as those described in my earlier post about TDL4 and the resulting blue screen) all fall apart when you reach the bootrec /RebuildBCD command, which returns the message:

Total identified Windows installations: 0

Geez.  This essentially means that the bootrec command cannot identify your Windows installation, even though the Windows Recovery Environment has no trouble doing so upon starting.  So, now what?

Sometimes it’s as simple as opening up your favorite disk partitioning software and marking the C: partition as ACTIVE, and if there are still problems, subsequently recovering the boot data as I mentioned in the TDL4 post (keep in mind however that the System Managed partition is typically Active normally on a Windows 7 system thanks to the isolated boot partition that it uses).  This problem occurs because of some modern rootkits which create a hidden, encrypted partition at the end of the system drive and mark it as Active and Primary (while simultaneously marking the standard boot partition as Inactive).  This infection has been covered in other recent blog posts as well.

Sometimes, however, the BCD is totally corrupted and this doesn’t even work.  At this point, most every source on the internet comes up a dead end.  Everyone ends up reformatting or reinstalling Windows overtop their existing partition; nothing else seems to work.

You might not think it’d be helpful, but there’s an intimidating post over at the EasyBCD NeoSmart site which explains how to manually rebuild the Vista bootloader from the ground up in catastrophic situations.  As it turns out, this procedure applies to Windows 7 as well (which uses the same bootloader and BCD structure), and it’s the key to your recovery here.

It’s no easy feat however, so roll up your sleeves and get ready to do some typing.  Here’s the full procedure from start to finish:

  1. Boot to the Windows Recovery Environment either by selecting Repair Your Computer when Windows fails to boot, by inserting the Windows installation disc, or by using a Windows ERD/MS DART disc (if you happen to have access to one, that is).
  2. Cancel the recovery attempt if it tries to start on its own (it will fail anyway) and then choose the advanced options link at the bottom of the window.
  3. Choose to open the Command Prompt.
  4. Here’s the fun part.  Once at the prompt, enter the following commands one by one.  Take care not to mistype anything, and be sure to replace C: with whatever your system drive happens to be:

bootrec.exe /fixmbr
bootsect.exe /nt60 all /force
bcdedit /export C:\BCD_Backup
attrib -h -s C:\boot\BCD
ren C:\boot\BCD BCD.old
bcdedit /createstore c:\boot\bcd.temp
bcdedit.exe /store c:\boot\bcd.temp /create {bootmgr} /d “Windows Boot Manager”
bcdedit.exe /import c:\boot\bcd.temp
bcdedit.exe /set {bootmgr} device partition=C:
bcdedit.exe /timeout 10
attrib -h -s C:\boot\bcd.temp
del c:\boot\bcd.temp
bcdedit.exe /create /d “Windows 7” /application osloader

At this point, note the value within the curly braces {……..} as you will need it during the next steps.  Replace the dots within the curly braces below with that entire string on each line.  NOTE:  To make this easier, once you type it once, you can press the Up arrow to restore the last command and simply edit that line for the next one.

bcdedit.exe /set {…..} device partition=C:
bcdedit.exe /set {…..} osdevice partition=C:
bcdedit.exe /set {…..} path \Windows\system32\winload.exe
bcdedit.exe /set {…..} systemroot \Windows
bcdedit.exe /displayorder {…..}
bcdedit.exe /default {…..}
bcdedit.exe /set {…..} locale en-US

Thanks to Bitt Faulk for the final line, which restores the correct Windows loading screen as well.  You will need to replace the en-US entry with something different representing your region if you are not in the US.

Then you’re back in Windows, miraculously.  No reinstall necessary!

Side effects?  A little.  Hopefully you can handle not having the nifty new Windows 7 startup animation screen, because this will lose it for you.  Instead, you’ll be stuck with the old-school plain Jane Windows Vista progress bar.  You’ll also lose any special boot options you had previously.  But as a last resort, this works, and it’s still just as quick as ever.

Apart from that, once you’re back in Windows, of course, you’ll still have to disinfect the rest of the way.  In my customer’s case, the system damage was actually so bad that I ended up performing an in-place upgrade (the Vista/7 equivalent of a Repair Install), but after that, everything was great.  It was a triumph for sure, and yet another situation where the usual solution of reformat/reinstall was not necessary.  Now you know how to avoid it!

I hope you’ve found this post useful–if so, please take a moment to leave me a comment!

If you need computer help in the Louisville, KY area, there’s simply no one better.  Give me a call today!

STOP: c0000135 – The program can’t start because consrv is missing. Try resintalling the program.

Posted on by
33

Getting this error?  Wouldn’t you know, it’s actually the product of a nasty little rootkit called ZeroAccess MAX++ of which you might be familiar.  The particular variant that causes this error actually uses the consrv.dll file to ensure it is able to load at boot on 64-bit systems.  As such, among other items, this rootkit drops a file called consrv.dll into the %SYSTEMROOT%\system32 folder.  It’s the reference to this file in the registry which wreaks said havoc once the file is removed by any means (antivirus, offline deletion, etc.).

To rectify the problem, you will need to gain access to the %SYSTEMROOT%\system32\config\SYSTEM registry hive remotely (whether by Recovery Console’s regedit and the Load Hive… command or by booting to another operating system and loading the hive in similar manner) and change an entry modified by the rootkit back to its default value.

The infected machine will have a modified string (REG_EXPAND_SZ) data of the Windows registry value in HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SubSystems which looks like this:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
This value is wrong, and it’s the reference to consrv which is generating your c0000135 stop error.  Instead, change it to:
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

This will solve the problem and enable the machine to boot.  Please note that you should also modify the same value in HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\… for completeness.

For a little more background/ancillary info, on the machine I was repairing which experienced this issue, the rootkit was accompanied by an additional MBR bootkit of the family Rootkit.boot.Pihar.a.  TDSSKiller actually took care of this one and restored the clean MBR.  In addition, plenty of other malware was along for the ride (all of it predictably hidden by the rootkit combo).  It was a nasty situation, but nothing I couldn’t handle. 😉
I hope you have found this case study useful.  Please let me know if it has helped you!

Disable Google Chrome’s built-in Print Preview

Posted on by
Reply

Google Chrome Logo

Got Google Chrome but hate the new Print Preview design? Turn it off!

1) Open Google Chrome, type chrome:flags in the address bar, and press ENTER.
2) Find Print Preview and Disable it.

You need to have the latest version of Chrome (14) for this to be possible.

If you’re also having trouble with the built-in lightweight PDF reader, you can disable that just as easily and likewise enable your favorite replacement plugin (in my case, as much as I hate to say so, I stick with Adobe for all my clients, as it’s just more compatible than any other current solution).

1) Open Google Chrome, type chrome:plugins in the address bar, and press ENTER.
2) Find Chrome PDF Viewer and Disable it.
3) Find your favorite PDF plugin (it should be disabled by default) and Enable it.

Hope this helps!  Chrome is an excellent browser, even as its market share continues to rise (and, inversely, as its level of security drops).  It’s worth making the effort to make it work for you, as it will keep you safer.

“Infected” routers threaten death by DNS

Posted on by
Reply

Recently, I took delivery of a client’s PC which had been thoroughly scanned, but he was concerned that it might not be fully clean.  If you’ve followed my work, you already know that this is relatively common; scanners, for all their merits, can only access what they’re allowed to access, and they can only detect what they’re written to detect.  Even heuristic detection can only go so far, and with today’s polymorphic malware (a.k.a., malware which changes its form with every specimen), signature-based detection is hardly reliable for the ever-common zero-day threats.

Such was indeed the case with this client’s computer, which was indeed still infected, regardless of clean scans by Symantec, Ad-Aware, and other utilities.  Although nothing had identified them, they were almost certainly a new variant of the Trojan.Tracur family of malware.  Previous versions of the Trojan have been known to create copies of local system services, using legitimate descriptions for legitimate services and even the same names—just suffixed with the number “32”.  Normally it drops related files in the system32 directory, but this variant actually had created its sister files inside \ProgramData – over 30 of them, one for nearly every single service on the system.

But that isn’t the subject of this blog post.  More interesting was the phone call I received once this client had taken their PC back home and begun using it again: he was still having problems, he told me.  Web sites were loading with weird formatting, and when using Chrome, login attempts at popular sites popped up another window prompting a second login.  The behavior sounded very similar to what some rootkits attempt to steal passwords and financial data.

This situation might not sound strange, but you have to understand: I never return infected computers.  I had performed the same rigorous inspection on his before calling him to pick it up, including a full analysis of all OS loading points, drivers, services, and the master boot record of the system drive.  I also check for policies, malicious proxies, faulty DNS caching, and infected critical system files—nearly all of this manually, using tools which I have specially developed for the task.

So I wasn’t convinced that malware was still on the PC—but I was concerned that perhaps we were missing something else.  I reviewed his logs (of which I keep detailed copies for every client) and found no signs of any danger, so I began considering other possibilities.  What else could possibly be the problem?  His router.

Router infections are nasty little things.  Technically, they aren’t infections, but rather, corrupted settings (thanks to malware) which lead to compromised PCs and information. They aren’t necessarily new; this has been a trend which actually started a couple of years ago and has become increasingly common among malware.

It’s actually pretty simple how they work: once a client computer has been infected, the malware takes advantage of the fact that no one ever changes their default router password.  Equipped with this information, it accesses the router configuration and changes the DNS servers to malicious servers of its own, which can filter and steal traffic passing through them or even redirect users to altogether different sites when they request a page.  This can be made entirely transparent to the user, as the displayed web address (the so-called FQDN) is still the same—only the resolved IP address has changed.

It isn’t uncommon for such router infections to reinfect clients even after they’re cleaned, presenting a seriously hazardous situation.  The solution involves simultaneously performing a hard reset on the router (by holding down the reset button for 15 seconds or longer) and disinfecting the PC (and all affected PCs on the network) before connecting back to the router.  Following that, the network must be reconfigured on the router, and a password needs to be set to prevent future infiltrations.

In my client’s case, there really wasn’t any proof that this was what was happening with his PC, but it was the next logical step after rechecking his PC remotely using some log-generating deep system scanning software.  So we reset the router, which seemed to resolve the internet traffic issues.  However, the problems with Chrome persisted, even without any extensions installed.  Given the options, we eventually elected to uninstall Chrome, chalking up the additional problems to a possible unknown bug in the browser itself.  Case in point: no other browsers, including Mozilla Firefox, had the same issue.  Just to be certain, I rechecked all proxies, the master boot record, and system files.  The PC was indeed 100% clean, and my client was happy.

TDL4 removal leads to Windows 7 64-bit stop error on boot

Posted on by
2

I’m proud to say that it’s been literally two years since I’ve reformatted a PC due to malware, and I’ve disinfected many hundreds in that time period. But yesterday, I encountered a PC infected with TDL4 (which I’ve dealt with many times), however this one was a Windows 7 64-bit machine. Following removal of the rootkit offline via TDSSKiller in WinPE (set to scan Boot Sectors only), the PC began crashing on every boot, even when Safe Mode was attempted. The typical invasive offline procedures I use to rectify these issues — such as the disabling of nearly all third-party filesystem and NDIS filter drivers — did nothing to correct the issue. Restoring a previous System Restore point and even manually restoring the registry hives from the RegBack folder also accomplished nothing.

Finally, I decided to backup/restore the BCD. To do this, I used a Windows 7 recovery disc (in my case, ERD/MS DART) and opened a command prompt. From there, I (mostly) just followed the Microsoft guidelines for restoring a corrupted BCD:

c:
bcdedit /export C:\BCD_Backup
attrib -s -h c:\boot\bcd
ren c:\boot\bcd bcd.old
bootrec /fixmbr
C:\boot\bootsect.exe /nt60 all /force
bootrec /RebuildBcd
bootrec /FixBoot

(Note that C: must be replaced with the relevant Windows drive.)

This corrected the issue on this PC. I hope this helps someone in the future!

SOLUTION: “Click2Run Configuration Failure” when Office 2010 Starter is launched

Posted on by
366

Here’s a frustrating issue that hasn’t yet been solved by anyone at Microsoft from what I can tell. For as yet unknown reasons reasons I have now discovered (as detailed later in this article), occasionally some PCs exhibit an error when launching Office 2010 Starter (which is preinstalled on many new PCs). The error is worded as such:

“Click2Run Configuration Failure”

Although many solutions on the internet (even from Microsoft employees and the KB) suggest that a simple Repair install or Uninstall of Click2Run from the Programs and Features menu will correct this, executing the uninstaller actually triggers the exact same error message.

Update (June 2012): I have now been able to confirm that this problem is most often caused by the use of registry cleaners.  For more details on why you should never use a registry cleaner, see my blog entry here.

This error may also occur on other downloadable versions of Office 2010, but I haven’t seen it yet anywhere else. Correcting the problem with the preinstalled OEM Starter versions is tricky enough, so I decided to make that the focus of this post.

Here’s what you do to fix the problem. First, you’ll need a special Click2Run cleanup tool that has seemingly disappeared from Microsoft’s server. You can download it here:

Click2Run Cleanup Tool

Once in possession of this tool, take the following steps to correct the problem:

  1. First, be sure to have a copy of the required installation files for Office 2010. Make a backup of them if you don’t have access to them elsewhere by copying the following directory to another location:
    • %PROGRAMDATA%\Microsoft\OEMOffice14\OStarter\en-us
  2. Execute the CleanC2R.exe file from the zip archive provided above to completely remove C2R, including the virtual Q: drive containing the relevant install files.
  3. Reboot the PC, then execute the CleanC2R.exe tool a second time.
  4. Reboot once more, then execute the offcln.exe tool to completely remove Office 2010 Starter.
  5. Reboot yet again, then navigate to the ProgramData directory containing the Office Starter installation files (they must be located in the exact directory detailed above for the installation to work properly). Right-click the SetupConsumerC2ROLW.exe file and choose Run as Administrator to install C2R once again, along with a fresh copy of Office 2010 Starter.

This should finally correct the issue. If you happen to be missing the installation files for Office 2010 Starter, you can actually find them available for download in various places. Downloading the files and installing the suite is perfectly legal as long as it was already once provided with the PC new by the OEM.

If this tip has helped you, please drop me a line and let me know!

If you’re looking for computer help in the Louisville area, look no further.  Call me today and get it done right!

“Multimedia/Gaming Environment” setting on some wireless adapters

Posted on by
7

If you’re using a wireless network in your home or office (or you’re helping a customer with theirs), you might encounter problems streaming video or audio wirelessly without sutters and skips occurring.

This is a common problem with wireless networks due to the number of packets which are dropped during transmission, and in fact, it’s such a frustrating issue that many people consider wireless networks unsuitable for streaming media.

While it’s true that a wired network of nearly any type is superior to a wireless network for streaming purposes, there is something you can try that may solve the problem. It’s a little-known setting in the RaLink drivers of certain networking adapters which prioritizes packets more heavily.

This setting can be found within the Device Manager (Start > Run > devmgmt.msc) in theProperties window for the networking adapter. From there, click on the Advanced tab and choose the setting called:

“Multimedia/Gaming Environment”

Change the setting from Disabled to Enabled. You may also wish to disable Power Management on the adapter to ensure it is always alive and ready for action, at the expense of some battery life, of course.

Once enabled, it’s quite possible that your problems may simply magically evaporate.

If you’re looking for computer help in the Louisville area, look no further.  Call me today and get it done right!

Post-disinfection Stop Error: c000021a

Posted on by
1

On multiple occasions over the past couple of years (since kernel-patching rootkits have become prevalent), I have encountered a particularly troubling STOP Error that most often technicians simply respond to by running a repair or clean install of the operating system. It looks something like this:

STOP: c000021a {Fatal System Error}

The windows Logon Process system process terminated unexpectedly with a status of 0x[various] (0x[various] 0x[various]). The system has been shut down.

Where [various] represents any number of hexadecimal error codes that may apply.

In this case, simply restoring the registry to a previous state as I’ve written about before does not correct the problem.

There are posts and pages to address this situation scattered across the internet, but nearly all of them offer different solutions, and most of them don’t seem to work. Microsoft has a page that relates the issue to Windows NT OS, blaming it on the PendingFileRenameOperations registry key which is often used by malware and antimalware to perform a rename operation on reboot. However, fixing this key as they suggest also does not solve the problem.

Most often, when it’s encountered post-disinfection, I find that the problem relates to an issue with a patched system file. I’m not certain, but it nearly always seems to be winlogon.exe.

Regardless, there is one and one only way to ensure the problem is corrected: find and replace the suspect file! There are multiple ways to accomplish this:

  1. Boot to a custom OS or slave the drive, check the system files (or run a virus scanner through them), and replace the faulty files with good copies (see below).
  2. Run a system file check from the Windows Recovery Console by typing sfc /scannow.
  3. Boot to an MS DART ERD Commander disc for Windows XP and run a system file repair from within the environment (this is my method of choice).

If you are forced to manually inspect and/or replace the files, I suggest checking for Company information and investigating any files which are missing the usual Microsoft Corporation info. If a suspect file is encountered, check its MD5 hash and Google it to see if it’s a known patched copy.

Once the culprit(s) has been identified, navigate to the system32\dllcache folder and copy the corresponding file there to its correct location. If it isn’t there or the copy is also bad, restore it from the Windows CD, or look for a folder called \i386. You can also run a search for the file throughout the entire Windows directory to find copies which have been downloaded for Service Packs and other Windows Updates. Just be sure to get the correct version.

In my most recent customer’s case, the files at fault were explorer.exe and winlogon.exe. Both had been patched by a rootkit and needed to be replaced. Once that was finished, the system booted up just fine.

If you’re looking for computer help in the Louisville area, look no further.  Call me today and get it done right!

Windows Update “Managed by your system administrator” nightmare

Posted on by
4

Today I encountered a bizarre issue when performing a routine setup on a refurbished (read: practically brand new) Dell Studio laptop. The problem manifested itself when Windows Update was run; rather than successfully connect to the Windows Update server and download updates information, the client would return an error:

Error Code 0x80072EE2
You receive updates: Managed by your system administrator

This sort of behavior is expected if your PC is set to receive Windows Updates via the WSUS service; in other words, not from the standard Windows Updates servers. But this computer was all-new (a new Windows install) and had never had a group policy set related to this (at least, it wasn’t supposed to have had it set)!

None of the usual Windows Update repair tools corrected the problem. Luckily, however, after a bit of research and experimentation, I devised a solution. Please note that this solutionshould not be performed if your computer uses a Group Policy for Windows Update:

  1. Open RegEdit and navigate toHKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
  2. Remove any and all values within this key. Most likely, the culprit is a faulty Windows Update source server. Sometimes this is the result of a latent or previous infection.
  3. Finally, download and run Microsoft FixIt 50202. Try the Default settings first, and if that does not work, try Aggressive.
  4. Reboot the computer and check to see that Windows Update is working properly.

An annoying issue to be sure, but at least this solution works! Please let me know if this solution has helped you. 🙂

If you’re looking for computer help in the Louisville area, look no further.  Call me today and get it done right!

Never bother with Windows Update again.  If you’re a repair tech or sysadmin, check out WUInstall Pro today!