always start in safe mode

[Guest]

Running XP Prof and when I on the pc, it always goes to the safe mode menu.
The keyboard does not seems to work as I cannot make my selection. When the
time run out, it will reboot and again to go the safe mode page. How can I
rectify this situation, please help, Mnay thanks

 

[Rich Barry]

Are you using a USB Keyboard. If yes, can you switch to a PS2
Keyboard temporarily. If you boot into Safe Mode
go to Start>Run type: msconfig Select Boot.ini tab and Uncheck
Safeboot, click Apply Ok.

 

[Guest]

I tried both USB and PS2 keboard andit does not work. Anywhere did a scan
and manage to get it to desktop and now trying to remove the malware. Any ide
awhat is qttask, istsvc, thanks

 

[Malke]

I tried both USB and PS2 keboard andit does not work. Anywhere did a
scan and manage to get it to desktop and now trying to remove the
malware. Any ide awhat is qttask, istsvc, thanks

To get into Safe Mode without using the key presses:

Start>Run msconfig [enter]

Look on the boot.ini tab and put a checkmark next to \SAFEBOOT. Apply
and OK out and when you restart, the system will automatically go into
Safe Mode. After you have done your work in Safe Mode, reverse your
actions to undo the safeboot.

"Qttask" is harmless; it is the Quicktime taskbar display and you can
disable it from within Quicktime's preferences. "Istsvc" is malware.
Here are general malware removal steps. You need to do everything with
updated tools in Safe Mode.

First delete all Temporary and Temporary Internet Files. For IE's
Temporary Files, go to Control Panel>Internet Options>General tab.
You'll see where you can delete cookies and files. For Firefox, clear
its cache by going to Tools>Options>Privacy>Cache> Clear. For Windows
Temporary files, Start>Run cleanmgr [enter] and then:

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix or WinSockFix for XP - see links
below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and About:Buster works well in removing the
About:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.intermute.com/products/cwshredder.html
http://www.tomcoyote.com/hjt/ - HijackThis
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke

 

[Guest]

Many thanks for the response.Just read your post and will try after this
post. Thought just let you know what I have done. Using updated NIS/NAV 2005,
doing the 3rd scan now (guess should have done in safe mode but will try on
the 4th scan). On the 2nd scan, it says the following:-

asm.exe adware topsea
asmps.dll adware
istsvc.exe adware Istbar
temperror32.dat adware EliteBar

ala are at risk and uncleanable and don't seems tro be 'delete' when I click
the delete function in NAV.

When I look into the details, it gives the following
Marshal.dll Adware.P2PN
sais.exe Asdware.180s
saishook.dll Adware 180s
uhyhilyz.exe Adware 180s

On the LSPFix, how do we use this. I cannot figure out when I look up at the
website.

I tried both USB and PS2 keboard andit does not work. Anywhere did a
scan and manage to get it to desktop and now trying to remove the
malware. Any ide awhat is qttask, istsvc, thanks

To get into Safe Mode without using the key presses:

Start>Run msconfig [enter]

Look on the boot.ini tab and put a checkmark next to \SAFEBOOT. Apply
and OK out and when you restart, the system will automatically go into
Safe Mode. After you have done your work in Safe Mode, reverse your
actions to undo the safeboot.

"Qttask" is harmless; it is the Quicktime taskbar display and you can
disable it from within Quicktime's preferences. "Istsvc" is malware.
Here are general malware removal steps. You need to do everything with
updated tools in Safe Mode.

First delete all Temporary and Temporary Internet Files. For IE's
Temporary Files, go to Control Panel>Internet Options>General tab.
You'll see where you can delete cookies and files. For Firefox, clear
its cache by going to Tools>Options>Privacy>Cache> Clear. For Windows
Temporary files, Start>Run cleanmgr [enter] and then:

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix or WinSockFix for XP - see links
below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and About:Buster works well in removing the
About:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.intermute.com/products/cwshredder.html
http://www.tomcoyote.com/hjt/ - HijackThis
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

 

[Guest]

Malke, appreciate if you can help. I am on a discovery journey. Amist of
doing all these.....

I have a hdd (#2)which previously was used as the pri master (only 1
partition, with xp still inside also but now used as storage because of sever
virus infection).

Senario is When I have:-

XX) 1 hdd (2 partitions) as pri master and Sony as sec master (2nd ide
cable, end connector, jumper as master), pc detect as 1st hdd as C, E and
Sony as D.

YY) 1 hdd (2 partitions) as pri master and Sony cd as secondary master
(2nd ide cable ,end connector, jumper as sec master) and hdd#2 as secondary
slave (in the middle connector, 2nd ide cable no jumper)
- pc detect, 1st hdd as C, E and Sony as D and cannot dectect the 2nd hdd

ZZ) Senario ZZ is the same as YY except that the jumper for Sony is at
secondary slave and the pc detect 1st hdd as D,E and Sony as F while it is
able to detect hdd#2 as C.

My question is why can't it detect hdd#2 in senario YY when connections
seems to be ok.Many thanks

I tried both USB and PS2 keboard andit does not work. Anywhere did a
scan and manage to get it to desktop and now trying to remove the
malware. Any ide awhat is qttask, istsvc, thanks

To get into Safe Mode without using the key presses:

Start>Run msconfig [enter]

Look on the boot.ini tab and put a checkmark next to \SAFEBOOT. Apply
and OK out and when you restart, the system will automatically go into
Safe Mode. After you have done your work in Safe Mode, reverse your
actions to undo the safeboot.

"Qttask" is harmless; it is the Quicktime taskbar display and you can
disable it from within Quicktime's preferences. "Istsvc" is malware.
Here are general malware removal steps. You need to do everything with
updated tools in Safe Mode.

First delete all Temporary and Temporary Internet Files. For IE's
Temporary Files, go to Control Panel>Internet Options>General tab.
You'll see where you can delete cookies and files. For Firefox, clear
its cache by going to Tools>Options>Privacy>Cache> Clear. For Windows
Temporary files, Start>Run cleanmgr [enter] and then:

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix or WinSockFix for XP - see links
below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and About:Buster works well in removing the
About:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.intermute.com/products/cwshredder.html
http://www.tomcoyote.com/hjt/ - HijackThis
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

 

[Malke]

Malke, appreciate if you can help. I am on a discovery journey. Amist
of doing all these.....

I have a hdd (#2)which previously was used as the pri master (only 1
partition, with xp still inside also but now used as storage because
of sever virus infection).

Senario is When I have:-

XX) 1 hdd (2 partitions) as pri master and Sony as sec master (2nd
ide
cable, end connector, jumper as master), pc detect as 1st hdd as C, E
and Sony as D.

YY) 1 hdd (2 partitions) as pri master and Sony cd as secondary
master (2nd ide cable ,end connector, jumper as sec master) and hdd#2
as secondary slave (in the middle connector, 2nd ide cable no jumper)
- pc detect, 1st hdd as C, E and Sony as D and cannot dectect the 2nd
hdd

ZZ) Senario ZZ is the same as YY except that the jumper for Sony is at
secondary slave and the pc detect 1st hdd as D,E and Sony as F while
it is able to detect hdd#2 as C.

My question is why can't it detect hdd#2 in senario YY when
connections seems to be ok.Many thanks

OK, first let's address the malware issue. Go ahead and clean up your
computer per the general removal steps I gave you in the earlier post.
Since you are running XP, you don't need LSPFix. If you don't have SP2,
then download the WinsockXP fix. If you have SP2, you don't need to
download anything extra. Those programs are because often you'll lose
Internet access because of malware damage. If you have the programs
that fix it on hand, then you aren't stuck needing to get to the
Internet after malware repair and no way to get the necessary tools.
It's just a precautionary measure.

I must admit I'm a little confused by your hard drive scenario and what
you are really asking me. I've been up since 3AM, so make it easy for
me and just clearly tell me:

1. Which hard drive is master.

2. Which hard drive is slave.

I assume both those hard drives are attached to the IDE0 connector.

3. What do you have connected to IDE1? Two cd drives?

4. And what can't be seen and by what. Are you talking about the
hardware being recognized by Windows or by the BIOS? If we are just
talking about device recognition, the partitioning scheme doesn't
matter.

IOW, make it clear for me please.

Malke

 

[Guest]

1/ virus issue all clear now, thanks

2/ pri master (maxtor 40bg 2 partitions C and E partitions) and attached to
ide0, nothing else. Jumper as pri master

ide1 - end connector Sony CD (jumper as slave) while hdd2 is in the middle
connector(no jumper) and pc identify as D. Sony as "F"

(pls note all the lettering C,D,E,F are allocated/identify by the pc)
We can see this when I am in "my computer" and when I go to Disk Mgt,it shows
C-healthy (system)
D-healthy (Active)
E-healthy

Hpwever, when Sony is set as sec master jumper, the pc does not detect or
recognised hdd2 as when I go to "my computer", there is no "D", It can be
any alphabet but its just not recognised or registered in "my computer".

( the hdd2 was previously used as pri master in this computer but decided to
used as slave as the XP was crippled by virus. there is only 1 partition
which is the pri. may be the pc see it as 'active'). So by question is why
cant I set Sony as Sec Master so that hdd2 as Sec slave? Thanks

 

[Malke]

1/ virus issue all clear now, thanks

2/ pri master (maxtor 40bg 2 partitions C and E partitions) and
attached to ide0, nothing else. Jumper as pri master

ide1 - end connector Sony CD (jumper as slave) while hdd2 is in the
middle connector(no jumper) and pc identify as D. Sony as "F"

(pls note all the lettering C,D,E,F are allocated/identify by the pc)
We can see this when I am in "my computer" and when I go to Disk
Mgt,it shows C-healthy (system)
D-healthy (Active)
E-healthy

Hpwever, when Sony is set as sec master jumper, the pc does not detect
or
recognised hdd2 as when I go to "my computer", there is no "D", It
can be any alphabet but its just not recognised or registered in "my
computer".

( the hdd2 was previously used as pri master in this computer but
decided to used as slave as the XP was crippled by virus. there is
only 1 partition which is the pri. may be the pc see it as 'active').
So by question is why cant I set Sony as Sec Master so that hdd2 as
Sec slave? Thanks

OK, now I get it. Thanks for clarifying. Your hard drives always need to
be master on an IDE channel or slave to another hard drive. You are
just setting up your computer hardware wrong and that is why you are
having problems.

Best arrangement for you - both hard drives on IDE0 and optical drives
on IDE1. If you have two optical drives and one is a burner, make that
one the master on IDE1.

Malke

 

[Guest]

many thanks

OK, now I get it. Thanks for clarifying. Your hard drives always need to
be master on an IDE channel or slave to another hard drive. You are
just setting up your computer hardware wrong and that is why you are
having problems.

Best arrangement for you - both hard drives on IDE0 and optical drives
on IDE1. If you have two optical drives and one is a burner, make that
one the master on IDE1.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User