Many services won't start - Network and much more is unavailable

[zilbermm]

Hi,

Two days ago i had a popup message from Mcafee but i closed it without taking a look, was kind of in a hurry. Yesterday morning, after the first reboot, windows started but nothing seems to work. I'll list some of the problems -

1. Many services do not start -
Workstation
Server
DHCP client
DNS client
Audio Service
HP Wireless Assistant
and many more

2. Services are missing -
Network Store Interface Service (i tried to add it manually through the registry)

3. Windoes Services dependencies tab cannot be accessed, i get an error message "Win32: The specified module could not be found."

4. When i try to start services i get different messages -
Workstation - "Error 1068: The dependency service or group failed to start"
(this is the most common message)
Audio Service - "The audio service on the local computer started and then stopped. Some services stop automatically if they are not in use by other services or programs."
HP wireless assistant service - This one starts and stops after a few seconds.

5. I have no network access, nor can i connec any USB devices.

6. the "RUN" option is missing from the start menu
7. I've noiced that "bowser" was missing from the services list in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services
tried to add it manually as well, with no success

I did manage for a while to connect my mobile phone and transfer malwarebytes and combobox, but none could solve the problem. Now it won't recognice my mobile either.
System restore is disabled for some reason, so that's not an option either.
I can't even backup my data and prepare for a fresh installation (which is a bad option as is).

Any help will be greatly appreciated.

Thanks

 

[wanchoo]

Welcome to Seven Forums, Zilberman.

Seems like a severe virus attack. Have you got a back-up image saved? Are you in a position to do a thorough Virus Scan with McAfee? If yes then please do it and post the results of the scan.

If you have not saved an image then it looks to me that the easiest way out would be to clean reinstall Windows 7. After that please do not install McAfee again. Instead use MSE or Avast! Free A-V.

 

[zilbermm]

Unfortunately i have no image of the system. I am running McAfee right now, and will post the results once it is completed.
This is the default A/V provided to us by IT, so i'm not sure i can replace it.
By clean install do you mean that the OS will be installed on top of the existing one or on a clean partition?
I have only one partition and must preserve the data, it is only partially backed up.

 

[DeaconFrost]

Then your IT staff should be the first place you go for help. I don't mean that to be rude, but in many companies, messing with your system could result in disciplinary actions.

That being said, Mcafee is absolute junk. If your IT staff knew what they were doing, they'd be using a much better product.

 

[zilbermm]

Already been there, they're just taking the easy path - dump a fresh image without even giving me the possibility for a backup.

 

[wanchoo]

Please post a screen-shot of your Hard Disk. If you have a large enough Hard Disk then please partition using the Partition Wizard Boot Disk (Tutorial http://www.sevenforums.com/tutorials/93322-partition-wizard-use-bootable-cd.html). Then transfer the data to the Partition (perhaps D drive) that you have created on your Hard Disk.

Simultaneously download an ISO image of your OS Windows 7 enterprise 64-bit from Official Windows 7 SP1 ISO from Digital River « My Digital Life. As your version is not there you shall have to download any 64-bit version say Windows 7 Ultimate and make it an all version DVD by downloading and applying eicfg Removal Utility on the ISO image.

Then make a Windows 7 Installer DVD from the ISO image and install your 64-bit Enterprise Verssion. All this is very easy and not as difficult as it seems by reading this message.

After that you delete all the partitions to the front (left) of the D drive and create unallocated space over there. The unallocated space should be at least 50 gigabytes or more. Then pop in the DVD that you have burned and clean install Window 7 Enterprise 64-bit. Activate the OS with the same Product Key that you are using at present.

You shall then have got rid of McAfee for good and use a good, free A-V of your choice. And as DeaconFrost has very rightly suggested please keep your IT Staff in the circuit for whatever you do.

 

[zilbermm]

Please post a screen-shot of your Hard Disk. If you have a large enough Hard Disk then please partition using the Partition Wizard Boot Disk (Tutorial http://www.sevenforums.com/tutorials/93322-partition-wizard-use-bootable-cd.html). Then transfer the data to the Partition (perhaps D drive) that you have created on your Hard Disk.

Simultaneously download an ISO image of your OS Windows 7 enterprise 64-bit from Official Windows 7 SP1 ISO from Digital River « My Digital Life. As your version is not there you shall have to download any 64-bit version say Windows 7 Ultimate and make it an all version DVD by downloading and applying eicfg Removal Utility on the ISO image.

Then make a Windows 7 Installer DVD from the ISO image and install your 64-bit Enterprise Verssion. All this is very easy and not as difficult as it seems by reading this message.

After that you delete all the partitions to the front (left) of the D drive and create unallocated space over there. The unallocated space should be at least 50 gigabytes or more. Then pop in the DVD that you have burned and clean install Window 7 Enterprise 64-bit. Activate the OS with the same Product Key that you are using at present.

You shall then have got rid of McAfee for good and use a good, free A-V of your choice. And as DeaconFrost has very rightly suggested please keep your IT Staff in the circuit for whatever you do.

If i'm not mistaken, all that means i'm going to lose my data, but i would like to avoid that if still possible. My phone is suddenly recognized again BTW, so i have a way to transfer small files.
I'm not sure i can post sections of log file here, but i found this in the OnAccessScanLog of McAfee from 2 days ago -

19/05/2012 22:15:14 Engine version = 5400.1158
19/05/2012 22:15:14 AntiVirus DAT version = 6713.0
19/05/2012 22:15:14 Number of detection signatures in EXTRA.DAT = None
19/05/2012 22:15:14 Names of detection signatures in EXTRA.DAT = None
19/05/2012 22:32:36 Deleted EMEA\zilberst C:\Users\zilberst\AppData\Local\Temp\ms0cfg32.exe C:\Users\zilberst\AppData\Local\{5161028f-a359-8f81-632f-2e598399ccd4}\n ZeroAccess (Trojan)
19/05/2012 22:32:48 Deleted NT AUTHORITY\SYSTEM C:\Users\zilberst\AppData\Local\Temp\ms0cfg32.exe C:\Windows\Installer\{5161028f-a359-8f81-632f-2e598399ccd4}\n ZeroAccess (Trojan)
19/05/2012 22:44:58 Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe C:\ProgramData\McAfee\Common Framework\Current\ENCPTCNT6000\EceptCntDet.mcs
19/05/2012 22:44:58 Engine version = 5400.1158
19/05/2012 22:44:58 AntiVirus DAT version = 6716.0
19/05/2012 22:44:58 Number of detection signatures in EXTRA.DAT = None
19/05/2012 22:44:58 Names of detection signatures in EXTRA.DAT = None
19/05/2012 22:45:04 Not scanned (scan timed out) EMEA\zilberst C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\zilberst\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TQM91QYW\FileProgress[2].htm
19/05/2012 22:45:04 Not scanned (scan timed out) EMEA\zilberst C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\zilberst\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TQM91QYW\FileProgress[1].htm


Does that help in some way?

 

[DeaconFrost]

Already been there, they're just taking the easy path - dump a fresh image without even giving me the possibility for a backup.

Is there anywhere to go above them? Not to sound like I'm harping on them, but it's actually quite easy for them to image your current system and pull your files out of it before reimaging to solve your issue.

 

[zilbermm]

Already been there, they're just taking the easy path - dump a fresh image without even giving me the possibility for a backup.

Is there anywhere to go above them? Not to sound like I'm harping on them, but it's actually quite easy for them to image your current system and pull your files out of it before reimaging to solve your issue.

I'll try again.
So, according to the replies in this thread i understand that the OS itself is not recoverable. Correct?

 

[mach04]

As this is a laptop you use for work, and you have not made a backup of your files, I think what you need in the first place is to make a backup of the files you need by purchasing an IDE/SATA hard drive cable or cabinet. With such cable/cabinet you can easily attach the hard drive of your laptop (after disassembling the hard drive first) to another pc, just like as you attach a USB dongle, and copy the necessary files to the next pc.

 

[zilbermm]

I only have backup for my work related files, but i have over 200GB of personal stuff. I'm pretty sure IT can find a solution for the backup, if they want, such as your solution.

 

[DeaconFrost]

Keep in mind that most IT staff won't jump through any special steps to backup 200 GB of personal data that shouldn't be stored on a business computer. I wouldn't wait to let them do it, as I'd copy it off the system ASAP to an external drive.

 

[mach04]

I can't even backup my data and prepare for a fresh installation (which is a bad option as is).

Already been there, they're just taking the easy path - dump a fresh image without even giving me the possibility for a backup.

So you have 200 Gb data and need help in making a backup. What I told you is the easiest and safest way to recover your data.