Rootrepeal problem

[ErikdeRed]

Ok, I ran rootrepeal as per the directions from this post:

http://forums.malwarebytes.org/index.php?showtopic=12709

Ran it successfully once, then the second time, something killed it and I got this error message:

Exception Code: 0xc0000094

Exception Address: 0x004eca19

[ErikdeRed]

Ok, I ran rootrepeal as per the directions from this post:

http://forums.malwarebytes.org/index.php?showtopic=12709

Ran it successfully once, then the second time, something killed it and I got this error message:

Exception Code: 0xc0000094

Exception Address: 0x004eca19

Oh, I should add that the first time I ran it the only "sys" file that showed up was hiberfil.sys. I tried wiping it anyway, but it didn't do any good, so that's why I tried running it again.

[noknojon]

Hi EricdeRed -

First, try to clean up your caches, Internet files and delete cookies by doing this:

The full quote was a bit long so I edetited it to the basics -

First ensure you have CCleaner installed - Run the program to delete unwanted downloaded files - Also go to Accessories > System tools > Disk Cleanup and run that program also - Then reply back if you still have problems -

Thank You -

[mountaintree16]

Hey there, ErikdeRed, and welcome to the forums here at Malwarebytes.org

You should really be in the Malware Removal Forum...

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

Also, when replying, please use the "ADD REPLY" button or erase what the person you are replying to said, as this makes the forum easier to read.

Thank you

[ErikdeRed]

Now, after running rootrepeal successfully again, here's the report that got generated:

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/03/15 17:47

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys

Status: Locked to the Windows API!

Path: c:\program files\microsoft windows onecare live\winsssvc_log.bin

Status: Allocation size mismatch (API: 917504, Raw: 786432)

Path: c:\documents and settings\hp_owner\local settings\temp\~df795e.tmp

Status: Size mismatch (API: 16384, Raw: 0)

Path: C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\VFYZWOQ6\imgbrows[1]

Status: Visible to the Windows API, but not on disk.

Path: c:\documents and settings\hp_owner\local settings\application data\microsoft\internet explorer\recovery\active\{3983c5c8-3085-11df-aae4-0011093e21dc}.dat

Status: Size mismatch (API: 404480, Raw: 379904)

==EOF==

I can't see anything there that would indicate what the problem file is. If rootrepeal won't work, what else can I do? I still can't reinstall Malwarebytes and my windows live onecare's automatic update is still spontaneously disabling.

[ErikdeRed]

Hey there, ErikdeRed, and welcome to the forums here at Malwarebytes.org

You should really be in the Malware Removal Forum...

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

Also, when replying, please use the "ADD REPLY" button or erase what the person you are replying to said, as this makes the forum easier to read.

Thank you

Whoops, sorry 'bout that.

Thanx for the tips, though

[mountaintree16]

You're welcome, no problem!

Good luck!

[noknojon]

Hi Eric -

If you deleted unrequired D/loaded files and still have this problem - Please refer to the post #4 above yours from mountaintree16 -

If you wish to open hidden files and folders you referred to in XP you can follow these instructions -

Show Hidden Files and Folders in Windows XP:

Click Start and select My Computer

Click the Tools item from the menu at the top of the window (if you don't see Tools press the Alt key on your keyboard and it will appear)

Select Folder Options

Click the View tab and make sure Show hidden files and folders is selected under Hidden files and folders

Next, uncheck the box next to Hide protected operating system files (Recommended)

Then, uncheck the box next to Hide extensions for known filetypes

Click Apply then click OK

Thank You -