5

I recently have a malware/trojan on my computer Windows 7 OS, and I did this post to get some help

The site's security certificate is signed using a weak signature algorithm! can't access any HTTPS's site

Now, what happens is after I use Microsoft Security Essential to scan and detected 4 trojans and I remove them. What happens is after the reboot now it gives me this error

stop: c0000135 the program can't start because %hs is missing from your computer. Try reinstalling the program to fix this problem.

So I did a lot of searches and people mentioning AVG, but I'm confused I never even install any program call AVG where the problem could be?

Refer to this blog SOLVED: STOP: C0000135 The program can’t start because %hs is missing. Try reinstalling the program

I believe they also have a similar problem and they refer that something about the register

The fix for this problem requires a registry edit to remove a reference to the consrv.dll file that was a virus and was removed. Using regedit from the repair console, the following keys required editing:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SubSystems

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\SubSystems

The problem is that now I can't even access my computer what can I do to fix this?

Please help because I have very important data that I need to at least backup.

Thanks in advance

Ali
  • 1,351

1 Answers1

4

0xC0000135 is defined as STATUS_DLL_NOT_FOUND in WinNT.h and ntstatus.h.

Which means, some critical DLL file has been deleted or has not been installed yet on the system. Usually, this is either the Microsoft Visual C++ Redistributable or the .NET Framework; in case you want to try them, install all versions of them that you can find. All of them should be downloadable from Microsoft's Download Center, you don't need to find anything obscure.

You will more likely want to figure out what DLL file was deleted to get more clue, two options here:

  1. The obvious one, looking in the log of the anti virus scanner what file was quarantained.

  2. The less obvious one, checking which dependencies are missing using the Dependency Walker on the executable that you are trying to launch; which will explain what / why.

In case you are getting a BSOD, read this article which also explains how to figure out the DLL.

In case the DLL is a virus, you will want to remove any refrences to it.

Tamara Wijsman
  • 57,463
  • Thanks for your answer, but I can't even go to the start up screen how can I scan what .DLL file is missing? – Ali May 06 '12 at 18:07
  • 2
    @Ali: Have you tried safe mode? Alternatively you can try to boot from the Windows DVD and get into the repair console there, which will give you access to at least registry editor to do the task you described in the bottom of your question. Note that I have added one more sentence to my answer. Given that you have mentioned consrv.dll I looked it up and didn't see it being a legitimate file, I don't have it on my system either; thus it might be better to just remove the references to that file. – Tamara Wijsman May 06 '12 at 18:11
  • @Ali: Short instructions: 1. Boot from Windows DVD. 2. Choose your regional settings. 3. Hit SHIFT+F10 to launch the command prompt. 4. Execute regedit.exe 5. Click on one of the HKEY keys. 6. Go to File > Load Hive 7. Load the right hive from C:\Windows\System32\config 8. It will appear as a folder under the current selected HKEY keys given the name you gave. – Tamara Wijsman May 06 '12 at 18:13
  • I've tried with safe mode and not successfully boot the Windows. And I'm not on the registry key editor by going to the System Recovery Options and running the cmd and using command line to regedit but what happen is that the registry key that mention in that blog is no different so I don't know what is the different. – Ali May 06 '12 at 18:14
  • @Ali: See my previous comment, did you load in the hive? The registry keys are different from the ones on your computer so you first need to load the HKEY (stands for hive key) that you want to access as per steps 5 to 8. – Tamara Wijsman May 06 '12 at 18:17
  • Sorry now I got the load hive but I'm confuse on #8 you mention above. – Ali May 06 '12 at 18:19
  • @Ali: Yeah, some HKEY keep it gray; glad that you have it. If you have loaded the hive (and named it abc for example) it will make you HKEY_LOCAL_MACHINE\abc. – Tamara Wijsman May 06 '12 at 18:23
  • Sorry but what hive I have to load from C:\Windows\System32\config – Ali May 06 '12 at 18:25
  • @Ali HKEY_LOCAL_MACHINE\SYSTEM means you have to load the SYSTEM file. – Tamara Wijsman May 06 '12 at 18:27
  • let us continue this discussion in chat – Ali May 06 '12 at 18:30
  • I'm really sorry to disturb you a lots @Tom – Ali May 06 '12 at 18:36
  • @Ali: The biggest one without any extension at all. – Tamara Wijsman May 06 '12 at 19:34