My XP doesn't save settings, amongst other problems. FOLLOWUP

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by zachkeenan, Sep 18, 2009.

  1. zachkeenan

    zachkeenan Private E-2

    I have now run through all the steps on the Windows XP Cleaning Procedure up until the "yes, i still have problems." Here are the logs.


    I had the Windows Police Pro virus thing, or whatever exactly it was called, and that lead to many pop-ups and more problems with my laptop. I was running Windows XP SP2 on my 4 year old Gateway laptop. I couldn't seem to do a thing on it but was able to d/l TeamViewer and I gave my friend remote access to it. For the next 48 hours he worked and I worked. We could not open any virus programs such as my MalwareBytes or AVG, as the virus would always just shut them down, even in Safe Mode. We used a certain company's "we fix it for you disc" to boot through and work. It found problems, of course, then we tried installing and running various scanner but to no avail. Eventually, we just tried renaming the scanners such as MalwareBytes, HijackThis, and others. ComboFix worked! It found this big and nasty SKYNET rootkit that was wreaking havoc in my registry. I thought the problems were all fixed. I ran the scanners again and it seemed clean.

    Then more problems.

    Everytime I turn the computer on, it seems to overheat now. The active desktop does not ever apply a new background image. It always goes back to a plain blue screen. Every time I open a program, it goes through update and installation/setup (Microsoft Word, AIM, Mozilla, amongst others) and neither him nor I can find out why. I ran the same company's fix it disc program again yesterday and it didn't fix the problems. I have MalwareBytes, HijackThis, Spyware Doctor, and Spybot Search & Destroy. Apparently without me noticing, my friend also upgraded and/or reformatted my computer to now having XP Service Pack 3. I thought about contacting Microsoft but I will not spend $59 to not even have a guarantee about it getting fixed. There were some weird policies on my computer after all of removal the first time, like not allowing registry tools.

    I am at my, and my friend's, wits end on this one. Can anyone help me???
     

    Attached Files:

    zachkeenan, Sep 18, 2009
    #1
  2. zachkeenan

    zachkeenan Private E-2

    Here's the MBAM log.

    Two things worth pointing out.
    On SAS, I ran it 4 times and it kept freezing and taking upwards of 12 hours. I ran it a fifth time and once I got those 7 registry errors, I just clicked next and deleted them, rather than waiting for it to properly finish.

    Secondly, under the Settings tab on MBAM, nothing was checked at all, so it kept saying that there was nothing to scan. I checked everything on the list except for: Closing of IE upon scan, Creating a right-click menu, and Anonymously report. It did not turn up a text file for me on either scan I did. When I would check those items and go to another tab other than Scanner, it would reset those items as unchecked. Weird.
     

    Attached Files:

    zachkeenan, Sep 18, 2009
    #2
  3. zachkeenan

    zachkeenan Private E-2

    Oh, and I can't open my Recycle Bin. Just keeps on getting better.
     
    zachkeenan, Sep 18, 2009
    #3
  4. zachkeenan

    zachkeenan Private E-2

    Really? Nothing? No help? No sign of life? Please!
     
    zachkeenan, Sep 22, 2009
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Please remove combofix from the below location which is not where you were supposed to put it:
    c:\documents and settings\Owner\My Documents\Downloads\ComboFix.exe

    Then download a new copy and put it on your Desktop as specified.

    You should have read the links given in the procedure you ran. It gave you this link: Don't Bump! It Only Hurts You!!!

    This last message cost you at least 4 more days.

    Whatever you were doing before you came here, did not finish properly cleaning up from the WPP infection you had. It may be difficult now since you did not start by working here and we have no idea about what you have done.


    Please run the below.
    • Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
    • Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log
    C:\win32kdiag.exe -f -r


    Is your copy of Spyware Doctor a paid version. If not then uninstall it now. Also I suggest that you uninstall ClamAV because it provides no protection and you need protection. You will be able to install a real antivirus program after we finish your cleanup.

    Do you know what the below startup is?
    O4 - HKLM\..\Run: [Everything] "C:\Program Files\Everything\Everything.exe" -startup


    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 2

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment
    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    Last edited: Sep 27, 2009
    chaslang, Sep 27, 2009
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds