My machine was infected with a virus/spyware earlier. I was able to get rid
of the virus/spyware. Now, I have the following problems:

1. Getting svchost.exe application errors the instruction at xxx referenced
memory at xxxxx. The memory could not be read. xxx and xxxxx have different
values for each svchost.exe applicatoin error. I used Process Explorer to
check whether all the running svchost.exe are c:\windows\system32\svchost.exe
and they are. So, I try to run Disk Defragmentation and get the message that
cannot run it because chkdsk /f is scheduled to run.
2. When I try to run chkdsk on c: without any parameter, I will get this
during verifying indexes <stage 2 of 3>...
Deleting index entry......
Index verification completed.

Errors found. CHKDSK cannot continue in read-only mode
3. When I try to chkdsk on c: with /f, I will get the following:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another process. Would
you like to schedule this volume to be checked the next time the system
restarts? (Y/N)

I answer Y but the reboot the system will not run chkdsk at all.
In the HKLM\System\CurrentControlSet\Control\Session Manager, BootExecute
has this:
autocheck autochk /p \??\C:
autocheck autochk *
Am I suppose to see anything in control panel\scheduled tasks? There is no
task scheduled.

4. I want to run sfc /scannow but sfc is asking for XP SP2 CD and I don't
have the SP2 CD since SP2 is downloaded from MS thru this link
http://www.microsoft.com/downloads/d...displaylang=en. How can I run sfc without the CD?


Thanks for any help.

You're either still infected or your attempts to remove the infection,
however valiant, left pieces behind. It ain't easy to rid yourself of
malware these days.
---
Leonard Grey
Errare humanum est

Peter wrote:
> My machine was infected with a virus/spyware earlier. I was able to get rid
> of the virus/spyware. Now, I have the following problems:
>
> 1. Getting svchost.exe application errors the instruction at xxx referenced
> memory at xxxxx. The memory could not be read. xxx and xxxxx have different
> values for each svchost.exe applicatoin error. I used Process Explorer to
> check whether all the running svchost.exe are c:\windows\system32\svchost.exe
> and they are. So, I try to run Disk Defragmentation and get the message that
> cannot run it because chkdsk /f is scheduled to run.
> 2. When I try to run chkdsk on c: without any parameter, I will get this
> during verifying indexes <stage 2 of 3>...
> Deleting index entry......
> Index verification completed.
>
> Errors found. CHKDSK cannot continue in read-only mode
> 3. When I try to chkdsk on c: with /f, I will get the following:
> The type of the file system is NTFS.
> Cannot lock current drive.
>
> Chkdsk cannot run because the volume is in use by another process. Would
> you like to schedule this volume to be checked the next time the system
> restarts? (Y/N)
>
> I answer Y but the reboot the system will not run chkdsk at all.
> In the HKLM\System\CurrentControlSet\Control\Session Manager, BootExecute
> has this:
> autocheck autochk /p \??\C:
> autocheck autochk *
> Am I suppose to see anything in control panel\scheduled tasks? There is no
> task scheduled.
>
> 4. I want to run sfc /scannow but sfc is asking for XP SP2 CD and I don't
> have the SP2 CD since SP2 is downloaded from MS thru this link
> http://www.microsoft.com/downloads/d...displaylang=en. How can I run sfc without the CD?
>
>
> Thanks for any help.

I think Leonard may be correct about the infection remaining. On several
highly infected machines (200+ infections), I have had great luck using
Anti-Malware 1.33, which can be downloaded from here:

http://www.download.com/Malwarebytes...dlPid=10997763


--
Regards

Ron Badour
MS MVP
Windows Desktop Experience


"Peter" <(E-Mail Removed)> wrote in message
news:97F4143F-6980-458F-8064-(E-Mail Removed)...
> My machine was infected with a virus/spyware earlier. I was able to get
> rid
> of the virus/spyware. Now, I have the following problems:
>
> 1. Getting svchost.exe application errors the instruction at xxx
> referenced
> memory at xxxxx. The memory could not be read. xxx and xxxxx have
> different
> values for each svchost.exe applicatoin error. I used Process Explorer to
> check whether all the running svchost.exe are
> c:\windows\system32\svchost.exe
> and they are. So, I try to run Disk Defragmentation and get the message
> that
> cannot run it because chkdsk /f is scheduled to run.
> 2. When I try to run chkdsk on c: without any parameter, I will get this
> during verifying indexes <stage 2 of 3>...
> Deleting index entry......
> Index verification completed.
>
> Errors found. CHKDSK cannot continue in read-only mode
> 3. When I try to chkdsk on c: with /f, I will get the following:
> The type of the file system is NTFS.
> Cannot lock current drive.
>
> Chkdsk cannot run because the volume is in use by another process. Would
> you like to schedule this volume to be checked the next time the system
> restarts? (Y/N)
>
> I answer Y but the reboot the system will not run chkdsk at all.
> In the HKLM\System\CurrentControlSet\Control\Session Manager, BootExecute
> has this:
> autocheck autochk /p \??\C:
> autocheck autochk *
> Am I suppose to see anything in control panel\scheduled tasks? There is no
> task scheduled.
>
> 4. I want to run sfc /scannow but sfc is asking for XP SP2 CD and I don't
> have the SP2 CD since SP2 is downloaded from MS thru this link
> http://www.microsoft.com/downloads/d...displaylang=en.
> How can I run sfc without the CD?
>
>
> Thanks for any help.

Hi Ron,

When I try to install it, I get the svchost.exe application error at the end
of the installation. It seems the installation is completed but it won't run
at all.

I think if I can figure how to run chkdsk /f to fix the drive error first.
I may able to run it.

"Ron Badour" wrote:

> I think Leonard may be correct about the infection remaining. On several
> highly infected machines (200+ infections), I have had great luck using
> Anti-Malware 1.33, which can be downloaded from here:
>
> http://www.download.com/Malwarebytes...dlPid=10997763
>
>
> --
> Regards
>
> Ron Badour
> MS MVP
> Windows Desktop Experience
>
>
> "Peter" <(E-Mail Removed)> wrote in message
> news:97F4143F-6980-458F-8064-(E-Mail Removed)...
> > My machine was infected with a virus/spyware earlier. I was able to get
> > rid
> > of the virus/spyware. Now, I have the following problems:
> >
> > 1. Getting svchost.exe application errors the instruction at xxx
> > referenced
> > memory at xxxxx. The memory could not be read. xxx and xxxxx have
> > different
> > values for each svchost.exe applicatoin error. I used Process Explorer to
> > check whether all the running svchost.exe are
> > c:\windows\system32\svchost.exe
> > and they are. So, I try to run Disk Defragmentation and get the message
> > that
> > cannot run it because chkdsk /f is scheduled to run.
> > 2. When I try to run chkdsk on c: without any parameter, I will get this
> > during verifying indexes <stage 2 of 3>...
> > Deleting index entry......
> > Index verification completed.
> >
> > Errors found. CHKDSK cannot continue in read-only mode
> > 3. When I try to chkdsk on c: with /f, I will get the following:
> > The type of the file system is NTFS.
> > Cannot lock current drive.
> >
> > Chkdsk cannot run because the volume is in use by another process. Would
> > you like to schedule this volume to be checked the next time the system
> > restarts? (Y/N)
> >
> > I answer Y but the reboot the system will not run chkdsk at all.
> > In the HKLM\System\CurrentControlSet\Control\Session Manager, BootExecute
> > has this:
> > autocheck autochk /p \??\C:
> > autocheck autochk *
> > Am I suppose to see anything in control panel\scheduled tasks? There is no
> > task scheduled.
> >
> > 4. I want to run sfc /scannow but sfc is asking for XP SP2 CD and I don't
> > have the SP2 CD since SP2 is downloaded from MS thru this link
> > http://www.microsoft.com/downloads/d...displaylang=en.
> > How can I run sfc without the CD?
> >
> >
> > Thanks for any help.
>
>
>

You may have to pull the drive out and mount it in another XP machine and
use the system of that PC to clean the drive. I fixed a PC last weekend
that had malware that was smart--they only blocked the .exe files of tools
that I use to clean infections. It blocked AdAware, SpyBot, Malware, AVG,
combofix, another AV program and other cleaning tools. If you want to try
this and need help, post back and I or another poster will give some
directions.

--
Regards

Ron Badour
MS MVP
Windows Desktop Experience


"Peter" <(E-Mail Removed)> wrote in message
news:EA51D993-B6FB-450D-B1B8-(E-Mail Removed)...
> Hi Ron,
>
> When I try to install it, I get the svchost.exe application error at the
> end
> of the installation. It seems the installation is completed but it won't
> run
> at all.
>
> I think if I can figure how to run chkdsk /f to fix the drive error first.
> I may able to run it.
>
> "Ron Badour" wrote:
>
>> I think Leonard may be correct about the infection remaining. On several
>> highly infected machines (200+ infections), I have had great luck using
>> Anti-Malware 1.33, which can be downloaded from here:
>>
>> http://www.download.com/Malwarebytes...dlPid=10997763
>>
>>
>> --
>> Regards
>>
>> Ron Badour
>> MS MVP
>> Windows Desktop Experience
>>
>>
>> "Peter" <(E-Mail Removed)> wrote in message
>> news:97F4143F-6980-458F-8064-(E-Mail Removed)...
>> > My machine was infected with a virus/spyware earlier. I was able to
>> > get
>> > rid
>> > of the virus/spyware. Now, I have the following problems:
>> >
>> > 1. Getting svchost.exe application errors the instruction at xxx
>> > referenced
>> > memory at xxxxx. The memory could not be read. xxx and xxxxx have
>> > different
>> > values for each svchost.exe applicatoin error. I used Process Explorer
>> > to
>> > check whether all the running svchost.exe are
>> > c:\windows\system32\svchost.exe
>> > and they are. So, I try to run Disk Defragmentation and get the message
>> > that
>> > cannot run it because chkdsk /f is scheduled to run.
>> > 2. When I try to run chkdsk on c: without any parameter, I will get
>> > this
>> > during verifying indexes <stage 2 of 3>...
>> > Deleting index entry......
>> > Index verification completed.
>> >
>> > Errors found. CHKDSK cannot continue in read-only mode
>> > 3. When I try to chkdsk on c: with /f, I will get the following:
>> > The type of the file system is NTFS.
>> > Cannot lock current drive.
>> >
>> > Chkdsk cannot run because the volume is in use by another process.
>> > Would
>> > you like to schedule this volume to be checked the next time the system
>> > restarts? (Y/N)
>> >
>> > I answer Y but the reboot the system will not run chkdsk at all.
>> > In the HKLM\System\CurrentControlSet\Control\Session Manager,
>> > BootExecute
>> > has this:
>> > autocheck autochk /p \??\C:
>> > autocheck autochk *
>> > Am I suppose to see anything in control panel\scheduled tasks? There is
>> > no
>> > task scheduled.
>> >
>> > 4. I want to run sfc /scannow but sfc is asking for XP SP2 CD and I
>> > don't
>> > have the SP2 CD since SP2 is downloaded from MS thru this link
>> > http://www.microsoft.com/downloads/d...displaylang=en.
>> > How can I run sfc without the CD?
>> >
>> >
>> > Thanks for any help.
>>
>>
>>

hartog wrote:
> Seems Ron is really onto something here!
>
> I had a virus alert on my Dell laptop, Windows XP SP3 which was
> seemingly picked up by Norton antivirus. But computer repeatedly crashes
> now. Volume is not flagged as dirty and sfc /scannow comes out OK. But
> CHKDSK in read-only mode reports windows file errors. And the following
> programs are all being blocked from running: chkdsk /F, MS defrag,
> System Restore (whether in normal or safe mode). After reading this post
> I downloaded the Malwarebytes program, and it is also blocked from
> running! So this would appear to be clever malware which preventing
> itself from being removed.
>
> Don't think I will be able to remove the harddisk from my laptop to run
> it in another machine. Perhaps I could try to fix this problem by
> booting XP from a CD-Rom drive? Any advice gratefully received....

Burn BitDefender, or another program listed, to a CD (using a working
machine) and test the infected machine with it:

http://www.techmixer.com/free-bootab...download-list/

Then run these again:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/supe...freevspro.html

--
Joe =o)

hartog wrote:
> Not sure how I can burn a fully executable version of bitdefender to a
> CD. Wouldn't that just be an installation file on a CD, which then
> attempts to install bitdefender to the infected machine, where it will
> be blocked from running by the malware?

Any of those .exe files will burn a Linux Live OS to a CD. The newly
created CD then runs independent of your HD, updates its virus
definitions, scans for and removes malware.

Download and run one of the exe's rather than trying to figure out how
to burn the image rather than a copy of the iso to the CD. A copy of
the ISO will not run.

--
Joe =o)

hartog wrote:
> Great - all sorted out. Really appreciate the help!

That's great! Thanks for reporting back.

[Previous correspondence]

hartog wrote:
> > Seems Ron is really onto something here!
> >
> > I had a virus alert on my Dell laptop, Windows XP SP3 which was
> > seemingly picked up by Norton antivirus. But computer repeatedly crashes
> > now. Volume is not flagged as dirty and sfc /scannow comes out OK. But
> > CHKDSK in read-only mode reports windows file errors. And the following
> > programs are all being blocked from running: chkdsk /F, MS defrag,
> > System Restore (whether in normal or safe mode). After reading this post
> > I downloaded the Malwarebytes program, and it is also blocked from
> > running! So this would appear to be clever malware which preventing
> > itself from being removed.
> >
> > Don't think I will be able to remove the harddisk from my laptop to run
> > it in another machine. Perhaps I could try to fix this problem by
> > booting XP from a CD-Rom drive? Any advice gratefully received....

Burn BitDefender, or another program listed, to a CD (using a working
machine) and test the infected machine with it:

http://www.techmixer.com/free-bootab...download-list/

Then run these again:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/supe...freevspro.html

--
Joe =o)