winlogon/ntdll.dll problems

[basilbr]

im getting a combination of various crashes and unforced restarts to my machine. whenever this happens, the error report that comes up on reboot states either winlogon or ntdll.dll caused it.

 

the past few days the most frequent one i've been getting is an almost regular restart occurring from 24 hours after my machine has been switched on. the thing i found strange was this happened whether or not i was connected to the internet.

 

searching on the internet i have seen this has happened to other people a fair amount, and in most cases the response has been to reformat and reinstall windows because the users pc has been compromised in some way. doing thorough scans on my pc i havn't found any malicious files that seem capable of causing the crashes, only some minor adware which has been easy to remove.

 

i am reluctant to reformat, and was asking here if anyone could help me in regard to some sort of fixes specific to winlogon and ntdll.dll . my OS in windows XP home sp2.

 

thanks in advance

[iq_132]

Try downloading service pack 3 beta. It's fairly polished, faster, and will (hopefully) fix your problem.

[gavin19]

i am reluctant to reformat, and was asking here if anyone could help me in regard to some sort of fixes specific to winlogon and ntdll.dll . my OS in windows XP home sp2.

 

thanks in advance

 

As iq_132 said, SP3 should hopefully resolve any problems. If not, you don't have to reformat to repair Windows. You could try using the Repair function built into the XP CD. Boot from it and let it run as if you were going to re-install Windows but instead choose to repair your existing installation.

 

It should be pretty easy to find, I think it says press F3 to repair, something like that. Whether or not that fixes your specific problem I don't know, but it won't affect your existing installed apps etc, worth a shot.

 

Good luck!

[basilbr]

thanks for the advice guys

[iq_132]

np. Please let us know if that works out for you.

[basilbr]

well i got sp3, but it didn't help

 

infact after trying out various spyware/adware progs it's looking rather bleak

hijackthis found 2 specific entries which scream malware but I can't manage to delete them, finding them in regedit with my pc in safemode the permissions on the files/folder are screwed up, with a 'CREATOR USER' having special permissions I just can't get rid of.

 

the specific hijackthis entries

 

O2 - BHO: (no name) - {56320505-CFA5-463A-B95F-161E17450FAB} - c:\windows\system32\cljdclj.dll

 

O20 - Winlogon Notify: jvheynhl - C:\WINDOWS\SYSTEM32\cljdclj.dll

 

the jvheynhl folder i found in regedit has some unpleasant looking entries in it that may explain my winlogon restarts. it too has the creator user permission problem, whenever selecting to fix the entries in hijackthis, they are not removed when i rescan.

Ideally I need help either with regedit type tutorials (im doing that now) to sort out that permissions issue, or an anti-malware prog that can remove these files.

Edited March 6, 2008 by basilbr

[Robert]

start in safe mode, delete that cljdclj.dll file manually with Windows explorer. Then go into regedit and delete that jv.. folder.

And do a search of regedit for either name and delete those entries too.

 

Then reboot. Hopefully your pc will still work.

[basilbr]

believe me, deleting them manually in safe mode was the first thing i tried when i found them. the reason i mentioned that special permission thing is im fairly certain that the reason i can't delete them.

 

im gonna try this vundo fix prog in safe mode see how it works out.

[gavin19]

believe me, deleting them manually in safe mode was the first thing i tried when i found them. the reason i mentioned that special permission thing is im fairly certain that the reason i can't delete them.

 

im gonna try this vundo fix prog in safe mode see how it works out.

 

Use ComboFix in conjunction with VundoFix as it covers a lot of other unwanted files.