Just fnished updating WindowsXP and IE8

zamorazeke · Oct 28, 2012

Hi Guys 'n' Gals,

Earlier in the week you helped me deal with FBIMoneypak to get this computer back online...and in the process I re-installed WindowsXP Home Ed, then had to install SP2, then SP3 and almost 100 Windows XP updates, etc., etc.

Finally, the machine appears to be working near normal. However, I thought if I sent in some logs I could not run the first time, as well as some repeat logs, you might be able to look them over and tell me whether or not I have issues remaining.

Needless to say, if you could look at the attached logs I will be very grateful for any advice. Hopefully things will be shown as okay now.

Thanks bunches.

Kestrel13! · Oct 28, 2012

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 <--- Are you deliberately set up to use this proxy?

Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

Right-click OTM.exe And select " Run as administrator " to run it.

Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.
Code:
:Files
C:\Documents and Settings\Dan\Application Data\lapfxt.dll
C:\Documents and Settings\Dan\Application Data\xsecva
:Commands
[emptytemp]
[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.

OTM may ask to reboot the machine. Please do so if asked.

Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

zamorazeke · Oct 28, 2012

Kestrel13! said: ↑

Right-click OTM.exe And select " Run as administrator " to run it.
Click to expand...

When I right click the program on the desktop I am given only the option of "Run as..." (just the suspension points, not the words "Run as Administrator"). And when I click that it gives me the normal Run or Cancel start option.

Is this the actual run-as-administrator procedure you were speaking of?

Thanks!

chaslang · Oct 28, 2012

zamorazeke said: ↑

When I right click the program on the desktop I am given only the option of "Run as..." (just the suspension points, not the words "Run as Administrator").
Click to expand...

You don't need to run it as administrator since you are using XP not Vista or above. As long as your user account for XP is an admin account you can simply double click it.

zamorazeke · Oct 28, 2012

Thanks to both of you (and all of you) for the terrific job you are doing to help so many people on the forum. :-D

I have attached the logs you need to determine if things are "all better."

Kestrel13! · Oct 28, 2012

Logs look good. All running nicely?

zamorazeke · Oct 28, 2012

Yessss! Thanks!!! Y'all have a good week, and don't work too hard!!

Kestrel13! · Oct 29, 2012

OK Here we go:

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

zamorazeke · Oct 30, 2012

Now I'm having a problem signing in to my hotmail. account.

Originally posted by Kestrel13:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 <--- Are you deliberately set up to use this proxy?

So we eliminated this proxy, I think.

Now, I am trying to log into my hotmail account on MSN; I click the "hotmail" link in the upper left hand corner, and it won't load the hotmail signin page. This message comes up instead: "Internet Explorer cannot display the webpage."

Could this have been caused by eliminating the proxy override? Would the elimination of the proxy override make it so I cannot sign in to my hotmail account on Internet Explorer?

Any help will be greatly appreciated. :confused

Kestrel13! · Oct 30, 2012

Did you purposely set up the proxy yourself or not? You did not address this when I previously asked, and I didn't ask you to delete.

chaslang · Oct 30, 2012

Kestrel13! said: ↑

Did you purposely set up the proxy yourself or not?
Click to expand...

No proxy was being used to begin with so this did not matter. Also that setting is a proxy override not a proxy itself. It just meant that if/when a proxy server is being used, don't use the proxy ( i.e., override it ) when the IP address is 127.0.0.1. This means a local loop back attempt will not go thru the proxy server if one existed. This has nothing to do with any problems being experienced with hotmail.

Kestrel13! · Oct 30, 2012

I would ask about the hotmail issue in the software forum. Thanks Chas.

zamorazeke · Oct 30, 2012

Thanks for your answers and advice to go to software forums for help.

Would you permit me to present one little detail before leaving this exchange, on the chance you might be able to explain what is happening?

I copied the link/address that would not open sign-in page for hotmail on the desktop

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1351653518&rver=6.1.6206.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx%3Frru%3Dinbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Then I compared it to the link that did open hotmail on the laptop we are using.

The only difference was in a 10-digit number: 1351653518 in the link/address for hotmail on the desktop, contrasting with the 1351645171 in the link/address on the laptop that successfully opened the sign-in page for hotmail.

When I replaced the last 5 digits in the desktop link/address:53518, with the last 5 digits from the successful laptop link/address: 45171, and hit the enter key, immediately the sign-in page for hotmail presented.

Whenever I replace the five digits in the (unsucesful) desktop with the five digits from the (successful) laptop, the sign-in page for hotmail comes up.

Is there malware involved here?

Thanks for letting me explain what I see happening.

Kestrel13! · Oct 31, 2012

Well, your logs were clean when I gave you final steps, so I am saying I do not suspect malware.

You can run this for peace of mind, be aware that most of what it finds is probably false positives.

Run this and attach the results.

Using ESET's Online Scanner

zamorazeke · Oct 31, 2012

I realize this isn't your problem, but when I went through the steps...clicked yes, and start at the EULA. (had closed down my ZoneAlarm)

Then I got a window with pale blue field and nothing but a small red x in a white square in the top left hand corner. Title of the window: ESET online scanner - Windows Internet Explorer.

http://www.eset.com/us/online-scanner-popup/

and it stopped there, wouldn't do anything else.

Anyway, Kestrel13!, thanks for your help.:cool

Kestrel13! · Oct 31, 2012

Try using Firefox instead. If that does not work, you will need to post in the software forum about your original issues you outlined.

zamorazeke · Nov 2, 2012

Hi, and thanks for the Firefox suggestion; it worked.

I've attached the txt file results. Hope it's not too bad.

Kestrel13! · Nov 2, 2012

And lots of false positives but it removed a couple things that were bad. How are things running now?

zamorazeke · Nov 3, 2012

It seems to be working quite crisply for the amount of trouble and work involved in bringing it back.

I took the liberty of running ESET again because I didn't follow the full directions the first time:

"Now click on Advanced Settings and select the following:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology"

The second time through it found ten more items...hopefully false positives.

Results are attached.

PS. As remarked at beginning of the post, machine seems to be doing quite well now. Maybe I should try running it for several days then go through the final procedures you recommended earlier?

Thanks ever soooooo much for hanging in with this extended problem solving session. :-D

Kestrel13! · Nov 3, 2012

Yes. You can follow the final steps in post #8 if all is well

zamorazeke · Nov 5, 2012

Yesterday for the first time I can remember I got a (dreaded?) blue screen, and the message said it was closing down windows in order to prevent damage, doing a memory dump, and saving to disk 8 (?). It said to close down the computer and re-start it. The rest of the message said what to do if it didn’t start properly in normal mode…start in safe mode, etc. etc. So I did the close-down and restarted it in normal mode. There was not a repeat episode.

Later, my spouse was using the computer and remarked that it seemed to be bogged down in doing things (hard drive working) that resulted in its pausing a lot when she was deleting emails while in her online Hotmail account.

So I got up this morning, ran all the obligatory scans and have attached the results in this post. The only problems I remember seeing at the time (inexperience speaking here) were in 1) RKReport: MBR problems, and in 2) HitmanPro: (false?) MGTools and Old Timer (OTM).

When I closed Rogue Killer, it asked me if I really wanted to close without correcting the MBR problem…and I closed it anyway, (according to the how-to-use instructions?)

Sorry for the inconvenience, but the “blue screen” was very unsettling, and when I ran CCR this morning prior to running the scans it said it had deleted around 750,000K in a system memory dump…

Thanks for your patience in looking at the logs and determining any "further" needed corrections. :-o

zamorazeke · Nov 6, 2012

Here's an update...it (blue screen) appeared again this morning when I booted up the computer, about ten minutes in.

I tried to write down everything on the screen, but it disappeared when a (self-induced?) reboot took place.

The (partial) message on the blue screen:

"A problem has been detected and windows has been shut down to prevent damage to your computer.

"If this is the first time you've seen this stop error, restart your computer. If this screen appears again, follow these steps.

"Check to be sure you have adequate disk space. If a driver is identified in the stop message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters..."

It was at this point that the blue screen disappeared and a reboot started. During the reboot, the attached messages appeared on the screen as further confirmation that the computer is in trouble.

Sorry I didn't get the rest of the blue screen message written down. But is there enough information here to give a better idea of what is happening?

Additional information that might provide insight to the problem:

1. When it happened today, the Maxtor external "F," backup drive was "synching" itself with (writing files to) the primary C drive of the computer.

2. I have checked, and both drives have adequate space.

Thanks for helping me out. I will do anything (under your direction) to finally put this one away.

Kestrel13! · Nov 6, 2012

Please also download MBRCheck to your desktop

Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)

It will show a Black screen with some information that will contain either the below line if no problem is found:

Done! Press ENTER to exit...

Or you will see more information like below if a problem is found:

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.

MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.

Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

zamorazeke · Nov 6, 2012

Thanks for your reply Mr. Kestrel13!

I have done as you suggested and attached the MBRCheck log.

Really appreciate your help.

zamorazeke · Nov 6, 2012

There appear to be some differences from the first MBRCheck log attached to post #1 on 10-27, but only you can tell their significance, I think.

Thanks again... :wave

Kestrel13! · Nov 6, 2012

Thanks for your reply Mr. Kestrel13!
Click to expand...

You're most welcome. I'm a MISS though, not a MR.

Your logs are clean. I suggest you post in the software forum regarding anything non malware related.

zamorazeke · Nov 6, 2012

Sorry; pardon me, Miss Kestrel13! LOL Totally my mistake...

I can't thank you enough for your having stayed in this seemingly ultra-marathon.

Please have a good week!!! :wave

Kestrel13! · Nov 6, 2012

No problem. You can follow the final steps in post # 8.

Just fnished updating WindowsXP and IE8

zamorazeke Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

zamorazeke Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Attached Files:

zamorazeke Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Attached Files:

zamorazeke Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

zamorazeke Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member