104 ответов в этой теме

[KPbICMAH]

A while ago I had a similar problem with all my CD-ROM drives failing - even the virtual ones! Similar to your case, the system could not load the cdrom service (due to some bad registry keys left after uninstalling Zune and Itunes software). So try this: Start - Run - type 'regedit.exe' (without the quotes). BE CAREFUL IN REGEDIT! In the left pane (tree view) of the Registry Editor window navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPIDER. Right click SPIDER (in the left pane) and select "Export". Make sure "Selected branch" is checked in the bottom of the window, enter a name (say, SPIDER), and click SAVE. Repeat the same procedure with SPIDERNT branch, just below the SPIDER (name the resulting file SPIDERNT). Close Regedit, locate the two files you saved and attach them here. DrWeb guys will look at them - maybe, something wrong there.

See screenshot attached for guidance.

Прикрепленные файлы:

•  regedit.PNG   78,55К   46 Скачано раз

[Eugeny Gladkih]

Sorry for the bad screenshot...

well, things are the same... please take a look at the KPbICMAH's post.

[Borka]

Sorry for the bad screenshot...

well, things are the same... please take a look at the KPbICMAH's post.

DavidR: and after that repeat logs please.

[DavidR]

A while ago I had a similar problem with all my CD-ROM drives failing - even the virtual ones! Similar to your case, the system could not load the cdrom service (due to some bad registry keys left after uninstalling Zune and Itunes software). So try this: Start - Run - type 'regedit.exe' (without the quotes). BE CAREFUL IN REGEDIT! In the left pane (tree view) of the Registry Editor window navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPIDER. Right click SPIDER (in the left pane) and select "Export". Make sure "Selected branch" is checked in the bottom of the window, enter a name (say, SPIDER), and click SAVE. Repeat the same procedure with SPIDERNT branch, just below the SPIDER (name the resulting file SPIDERNT). Close Regedit, locate the two files you saved and attach them here. DrWeb guys will look at them - maybe, something wrong there.

See screenshot attached for guidance.

Krisman,
Thank you very much for your suggestions and advice. I will follow this procedure later this evening when I have time to be very careful about what I am doing! I especially appreciate that you added the screenshot--that will be a great deal of help to me, as I am not experienced very much in working with the registry. I'll post back as soon as I can. Thanks again!

[Eugeny Gladkih]

DavidR: and after that repeat logs please.

logs? that won't help us much. the spider guard havn't been started even once since the reboot, take a look at `sc' output http://forum.drweb.com/public/style_emoticons/default/sad.png

DavidR

could you tell us your computer configuration description in short?

[Borka]

DavidR: and after that repeat logs please.

logs? that won't help us much. the spider guard havn't been started even once since the reboot, take a look at `sc' output http://forum.drweb.com/public/style_emoticons/default/sad.png

I would like to see - are all third-party security programms (especially drivers) removed.

[KPbICMAH]

Krisman,
Thank you very much for your suggestions and advice. I will follow this procedure later this evening when I have time to be very careful about what I am doing! I especially appreciate that you added the screenshot--that will be a great deal of help to me, as I am not experienced very much in working with the registry. I'll post back as soon as I can. Thanks again!

Well, maybe I shouldn't have used red, bold and caps in one sentence. http://forum.drweb.com/public/style_emoticons/default/smile.png It's not any scarier than Explorer - as long as you don't press Delete without looking, nothing terrible would happen. Anyway, here is an easier option: copy and paste the following lines into the Run box (Start - Run):

reg export HKLM\system\currentcontrolset\services\spider c:\spider.reg
reg export HKLM\system\currentcontrolset\services\spidernt c:\spidernt.reg

First copy and paste the first line, then press "Ok". Then repeat with the second line. After that, collect spider.reg and spidernt.reg in the root folder of C: drive and attach them here.

[DavidR]

A while ago I had a similar problem with all my CD-ROM drives failing - even the virtual ones! Similar to your case, the system could not load the cdrom service (due to some bad registry keys left after uninstalling Zune and Itunes software). So try this: Start - Run - type 'regedit.exe' (without the quotes). BE CAREFUL IN REGEDIT! In the left pane (tree view) of the Registry Editor window navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPIDER. Right click SPIDER (in the left pane) and select "Export". Make sure "Selected branch" is checked in the bottom of the window, enter a name (say, SPIDER), and click SAVE. Repeat the same procedure with SPIDERNT branch, just below the SPIDER (name the resulting file SPIDERNT). Close Regedit, locate the two files you saved and attach them here. DrWeb guys will look at them - maybe, something wrong there.

See screenshot attached for guidance.

Krisman,
Thank you very much for your suggestions and advice. I will follow this procedure later this evening when I have time to be very careful about what I am doing! I especially appreciate that you added the screenshot--that will be a great deal of help to me, as I am not experienced very much in working with the registry. I'll post back as soon as I can. Thanks again!

Krisman,
Here are the registry entries, as you advised. That was easier to do than I thought! I'll provide the other requests as soon as I can get a chance. Thanks again for your help!

Прикрепленные файлы:

•  Spider_Registry.zip   822байт   39 Скачано раз
•  Spidernt_Registry.zip   793байт   41 Скачано раз

[DavidR]

DavidR: and after that repeat logs please.

logs? that won't help us much. the spider guard havn't been started even once since the reboot, take a look at `sc' output http://forum.drweb.com/public/style_emoticons/default/sad.png

DavidR

could you tell us your computer configuration description in short?

Windows XP Home Edition; SP3.
I have Look 'n' Stop Firewall; Windows Defender; Dr. Web SS (hopefully!). Eugeny, I've attached some basic system info--please let me know what other info you need.
I will send the logs later when I get home from work.
Thanks!

Прикрепленные файлы:

•  System_Info.JPG   72,83К   43 Скачано раз
•  hijackthis.log   8,99К   48 Скачано раз

[Eugeny Gladkih]

DavidR

please show me the output of the command

dir C:\PROGRA~1\DrWeb

[Borka]

Here are the registry entries, as you advised. That was easier to do than I thought! I'll provide the other requests as soon as I can get a chance.

Strange. http://forum.drweb.com/public/style_emoticons/default/unsure.png The only difference comparing my registry keys and attached I've see is "DRWEB" and "DrWeb" in "ImagePath". And all the same.

[DavidR]

DavidR

please show me the output of the command

dir C:\PROGRA~1\DrWeb

Here it is, Eugeny...

Прикрепленные файлы:

•  Command_Screenshot.JPG   78,62К   45 Скачано раз

[KPbICMAH]

Krisman,
Here are the registry entries, as you advised. That was easier to do than I thought! I'll provide the other requests as soon as I can get a chance. Thanks again for your help!

Hmmm, everything looks normal - yet nothing is working. http://forum.drweb.com/public/style_emoticons/default/blink.png How about these two keys?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPIDER
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPIDERNT

Borka, my DrWeb keys are all the same, except I also have INITSTARTFAILED type:REG_DWORD data:0x000000001 under HKLM\System\CurrentControlSet\Services\SPIDER\Enum. Is that normal? Not sure what that is about, but everything seems normal.

[Eugeny Gladkih]

Here it is, Eugeny...

everything seems to be OK, I have no idea anymore http://forum.drweb.com/public/style_emoticons/default/sad.png did you contact to the Customer Support Service?

[DavidR]

Here it is, Eugeny...

everything seems to be OK, I have no idea anymore http://forum.drweb.com/public/style_emoticons/default/sad.png did you contact to the Customer Support Service?

Eugeny,
It is clear that there is some anomaly with my computer that just will not allow Spider to load and function correctly. The problem is with my computer, not Dr. Web. I am sorry to say that this puzzle is just too time-consuming, and I will abandon it and install something else. I am certain that the technical expertise of you and everyone else who posted their help is at least as great, if not greater, than the help that Customer Service could offer.
I truly appreciate everyone's time and energy in offering suggestions, and I learned a lot!
Thanks again!

[sr]

Hi, can you run again rootkit unhooker (http://www.rootkit.com/vault/DiabloNova/RkU3.8.342.554.rar) and from main menu "Tools" use "Notify Routines" and attach screenshot of showed window here. drweb don't need to be installed for this

[Eugeny Gladkih]

Thanks again!

welcome. it's interesting what goes wrong way.

[Borka]

Borka, my DrWeb keys are all the same, except I also have INITSTARTFAILED type:REG_DWORD data:0x000000001 under HKLM\System\CurrentControlSet\Services\SPIDER\Enum. Is that normal? Not sure what that is about, but everything seems normal.

I know nothing about this key. http://forum.drweb.com/public/style_emoticons/default/sad.png

Thanks again!

It would be better make logs we need.

[DavidR]

Borka, my DrWeb keys are all the same, except I also have INITSTARTFAILED type:REG_DWORD data:0x000000001 under HKLM\System\CurrentControlSet\Services\SPIDER\Enum. Is that normal? Not sure what that is about, but everything seems normal.

I know nothing about this key. http://forum.drweb.com/public/style_emoticons/default/sad.png

Thanks again!

It would be better make logs we need.

OK, Borka, I'll continue with this puzzle!
I uninstalled Dr. Web; downloaded a fresh copy, which is dated 5/15/2009, and installed that. I have the same original issue.
I have attached two logs--is there another type of log you would like to see?
Thanks!

Прикрепленные файлы:

•  Latest_HJT_Log.txt   9,29К   44 Скачано раз
•  Latest_RkU_Log.txt   20,51К   55 Скачано раз

[DavidR]

Hi, can you run again rootkit unhooker (http://www.rootkit.com/vault/DiabloNova/RkU3.8.342.554.rar) and from main menu "Tools" use "Notify Routines" and attach screenshot of showed window here. drweb don't need to be installed for this

Hi, sr!
Here's the screenshot--not much on it!

Прикрепленные файлы:

•  RkU_Notify_Routines_Screenshot.JPG   23,64К   42 Скачано раз