1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Malware problem?: problems with windows7 starter

Discussion in 'Malware Removal' started by ChemMD, Apr 9, 2013.

  1. ChemMD

    ChemMD Private E-2

    I started having problems with my notebook earlier this afternoon. First, I could NOT find the usual button for internet access on the right side of the horizontal bar on my desktop. When I look for it under Networks it is labeled as unknown. Second, Microsoft Outlook stops working when I start it. I first discovered this when I rebooted under Safe Mode to find out if this corrects the problem. Third, I get a warning message to a) Turn on Windows Firewall, and b) Change Windows Update settings. Clicking on these do NOT correct the problem, ie, Windows Firewall remains off and Windows Update setting are NOT changed.

    Attached Files:

  2. ChemMD

    ChemMD Private E-2

    Hello to all! I tried to fix my problem by restoring my system to an earlier restore point, but I got an error message. "The specified object was not found. (0x80042308)" It also tells me no changes were made, and that I should try system restore again.

    I checked the Microsoft Community forums for a similar problem. They suggested to troubleshoot as follows: disable antivirus, place the computer in clean boot state, and try to create a restore point. Creating a restore point was unsuccessful, and I got the same error message above. BTW, i undid the temporary changes recommended.

    What should I do next to solve my continuing problem?
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is the below proxy server setting something you installed?

    [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer ( -> FOUND

    Also one more question, did you install Check Point VPN
    Last edited: Apr 13, 2013
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Only fix the proxy server entry below if it is not something you installed.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=6c6aa03700000000000054d4c0b44710
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
    R3 - URLSearchHook: (no name) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - (no file)
    O2 - BHO: Blekko Search Bar Helper Object - {BAE35237-8D73-44D0-905C-8A95EA1E7E69} - C:\Program Files\blekko\spamfreesearch\\bh\spamfreesearch.dll
    O3 - Toolbar: Blekko Search Bar Toolbar - {EECF410C-006C-4A05-AD13-6741A0814DBF} - C:\Program Files\blekko\spamfreesearch\\spamfreesearchTlbr.dll
    O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE
    O20 - AppInit_DLLs: C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll

    After clicking Fix, exit HJT.

    Now uninstall the below programs
    Blekko Search Bar
    Search-Results Toolbar

    Please download OTM by Old Timer and save it to your Desktop.
    • Run it by double clicking on it (Note: if using Vista, Win7, or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    C:\Program Files\SEARCH~1
    C:\Program Files\blekko
    C:\Users\Inocencio Alejandro\AppData\Local\Temp\*.*
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A4705A98-123C-4F53-8742-1D43275C867A}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAE35237-8D73-44D0-905C-8A95EA1E7E69}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
    [start explorer]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.txt log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
  5. ChemMD

    ChemMD Private E-2

    Is the below proxy server setting something you installed?

    [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer ( -> FOUND

    Also one more question, did you install Check Point VPN

    I saw this earlier message after I read and started implementing your suggestions on what to do. On the first point, I am unsure. It may be my web service provider settings but I already removed it as recommended in your second post. On the second question, I did NOT install that. Thanks. Will let you know how to things work out after I finish all the steps in your second post.

    Thanks a lot!
  6. ChemMD

    ChemMD Private E-2

    The problems persist: the error message on failing to connect with windows service; "the dependency service or group failed to start." when I click on the icon for my internet connection; "Action Center can't turn on Windows Firewall."; and "Microsoft Outlook has stopped working" when I try to open Microsoft Outlook. I also noticed for the first time two hidden files on my desktop named desktop.ini. I changed the view options to NOT show the hidden files.

    I followed all the steps indicated in your post. Here are my notes on what happened as I followed the steps...
    At the point "Now unistall the below programs"... I uninstalled the programs using Control Panel/Programs and Features/Unistall or Change a Program

    I followed the steps from "Please download OTM" up to "Now click the large Move It! button"... at this point I got the below error message...
    OTM:OTM.exe - Bad Image C:\User\Inocencio Alejandro\AppData\Local\Temp\yplazprv.dll is either not designed to run on Windows or it contains an error. Try installing the progam again using the original installation media or contact your system administrator or the software vendor for support.

    The computer automatically went into reboot after giving me a message on OTM that it was successful.

    There were NO problems in the Junkware Removal Tool steps and the MGtools step.

    Attached Files:

  7. ChemMD

    ChemMD Private E-2

    YES (this is the CORRECT ANSWER, please ignore my earlier response. Sorry about that. I checked my info)
  8. ChemMD

    ChemMD Private E-2

    Just an update. Microsoft Outlook is now working. I think it may be due to Microsoft Windows update that happened while I was following help from Microsoft forums. The Internet connection icon on the taskbar still has an X, and Windows Firewall still can not be turned on.

    I have also downloaded and installed the drivers for the chipset, wireless and the WLAN from the PC manufacturer's website. This has not corrected the Code 31 error in Device Manager/Network Adapters.

    Hope to hear about suggestions to move forward in solving these. Thanks!
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Be patient while doing the below. The fixes can sometimes take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.

    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
  10. ChemMD

    ChemMD Private E-2

    Thanks! Will start work on this right away and let you know what happens.
  11. ChemMD

    ChemMD Private E-2

    When I did this Windows Repair started repairs as seen in Log tab, but I got this error message... Execute processes remotely has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solutions is available....

    I pressed Close Program and the program continued work. This happened several time. It then automatically stopped, but did NOT restart the computer. I restarted the computer and proceeded with the next steps.
  12. ChemMD

    ChemMD Private E-2

    Here's the MGLogs.zip after running MGTools.bat... The error messages still persist: X on Network icon, turn on windows firewall. A new one on Update Windows Defender also appeared. Thanks for continuing to help.

    Attached Files:

    Last edited: Apr 20, 2013
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Windows Repair did not run properly. Please boot into safe boot mode and run it there. Then reboot back into normal mode and attach another new MGlogs.zip file after running C:\MGtools\GetLogs.bat again. ​
  14. ChemMD

    ChemMD Private E-2

    Thanks for the next step. Windows Repair ran without a hitch, but I did notice while watching that a few of the permissions failed on the popup screen. I still have the red X on the Network icon, and the error message on updating Windows Defender.

    Here are the new logs. Will wait for the next step :)

    Attached Files:

  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Based on your logs, no network interface card is showing up. You will most likely have to reinstall the drivers for your network card. Another thing that may work could be to delete the hardware using Windows Device Manager but do not allow it to delete any files. The reboot. It should automatically redetect the hardware and possibly reinstall and repair the connection.
  16. ChemMD

    ChemMD Private E-2

    Thanks for the possible next steps. I do NOT know how to do the 2nd option: "delete hardware using Windows Device Manager.."

    When I checked Device Manager to reinstall the drivers for network card, I saw an error icon that looks like a yellow triangle with an ! mark in the middle for several items: one item marked Unknown Device in Other Devices, and eleven (11) items in Network Adapters. The eleven items are: Reatek PCIe FE Family Controller, Realtek RTL8188CE Wireless LAN 802.11n COMBO PCI-E NIC, Teredo Tunneling Pseudo-Interface, WAN Miniport (IKEv2), WAN Miniport (IP), WAN Miniport (IPv6), WAN Miniport (L2TP), WAN Miniport (Network Monitor), WAN Miniport (PPPOE), WAN Miniport (PPTP), and WAN Miniport (SSTP).

    The Device Status on NIC reads: "This device is not working properly because Windows cannot load the drivers requested for this device. (Code 31)"

    The Device Status on Unknown Device reads: "The drivers for this device are not installed. (Code 28) There is no driver selected for the device information set or element. To find a driver for this device, click Update Driver."

    I tried to reinstall the NIC as you recommended by Uninstalling the Driver and then Scan for Driver Changes. The error message was "Device driver software was not successfully installed."

    Thinking that the Unknown Device is the Network Interface Card, I tried to uninstall it, reboot, then scan for hardware changes. The Other Devices icon is no longer there, but the yellow error marks are still the same under Network Adapters.

    Encouraged by this, I proceeded to uninstall NIC and got the error message (Code 1) under the Device Status. I found the NIC driver from the Lenovo site and installed it. The computer said it was installed successfully and to reboot which I did. When I checked Network Adapters in Device Manager, I saw the same yellow error mark in the NIC as well as the others mentioned above. I tried Update Driver in NIC, and got "The best driver software for your device is already installed."

    BTW, when i check ipconfig /all the information i get is just Windows IP Configuration. Host Name and Primary Dns suffix is blank. Mode type is Hybrid, and NO for both IP Routing Enabled and WINS Proxy Enabled. Does this help?

    What do I do next? :) I am leaving in 12 hours for several days, but will be back 29-Apr morning (GMT+8). I can still do more work on this today in case you have a quick reply.

    Thanks a lot!
    Last edited: Apr 23, 2013
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not really. That is what you would expect with no NIC installed or working.

    I suggest that you post in the Networking Forum to see if you can get help repairing this. It is not a malware problem.
  18. ChemMD

    ChemMD Private E-2

    Thanks for your help! I will do that. Does this mean that my notebook is now free of malware? I uninstalled the antivirus to test whether program conflicts were causing the problems during malware removal, may I install one now?
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member


    Yes. I'm going to give you final instructions now, but I'm not going to included the removal of System Restore points just in case you want to try using an old one ( if there are any. Your logs did not show any available.) in hopes it would fix the network interface.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.
    7. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    8. After doing the above, you should work thru the below link:
  20. ChemMD

    ChemMD Private E-2

    I tried System Restore before I asked help from this forum (and that did NOT work).

    1. I uninstalled this after running it the first time. Will re-install this and the antivirus software once I have regained internet access on my notebook computer.



      I failed to right-click to Run As Administrator, so I closed the popup window. When I checked the desktop and the C:\ folder MGTools-related folders are no longer there. Hope I did not mess anything up?

    I noticed that the first step was to work on Windows Update. I stopped here and will resume work once I have internet access on my notebook computer.

    I have posted on the Networking forum as you suggested. Waiting for a reply.

    Thanks again for your help.

Share This Page

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds