Another computer, another virus

I posted a while ago about a virus on my computer. I think it's gone. I'm visiting my brother, and, guess what...I think he's got the same one, maybe a couple different ones! I went through the whole process, except that Root Repeal never finished, and I got a big blue-screen error message on MGTools (something about a Page Error where there was no Page. Sorry, I didn't write it down.). I thought I got it all fixed, last night, and then started having problems again today. I re-ran Root Repeal and MG Tools (no big blue screen).

Here are the problems:

Redirecting websites related to malware (seems to be fixed - now I can get here, for instance!)

Computer locking up when going online (still happening, not consistent, can't figure out if it's related to certain websites, happens in both IE and Firefox)

Phishing (Happened before on Wells Fargo site, happened this morning on Ebay site)

Stats: Windows XP Home version, multiple users - problems happen for all users, using IE and Firefox.

First four logs attached, next log to follow.

 

Other log... Did I miss any?

 

First, I want to let you know that I really, really do appreciate what you and the others do here. I do understand that you're volunteers, doing something that I certainly wouldn't be able to do, and that most folks who get *paid* to do can't do! (Witness the useless nonsense that the folks at Dell and Microsoft my brother has been dealing with have given!) If I had your address, I'd send you a box of chocolates. Heck, give me your paypal address, I'll send you money!

Next, though, I want to defend myself. I have to admit that I get a bit prickly when I'm accused (even in subtext) of being a liar, or sneaky. I do occasionally break protocol through ignorance, but I'm not willfully deceitful.

It's remotely possible that I do have another login here. I don't think so, though. This is the login I use, and have used for years and years, for all forums and newsgroups. I do, very rarely, use another one when I get to the point of "I can't remember what password I used here, because it's been so long, and the email I used with this site isn't active any more, and I'm getting really frustrated," but I don't think that's the case here - since this is my "normal" login. I really can't tell you why it says that I only have two posts. If I was trying to "pull a fast one" and log in with a different name, it'd be pretty stupid of me to say, in the same post, that I'd posted before, no?

This is my brother's computer. He lives in Arizona. I live in California. I'm visiting here. He's a plumber. I've been a (low-level) computer tech for some parts of my life. He's been dealing with this issue for about two months. He and his family have pretty much stopped using this computer. I can *promise* you that neither he, nor any of his family have written on this forum about this computer. I can promise you that I haven't written on this forum about this computer. It's very, very remotely possible that he asked one of his friends to help, and that they wrote on this forum about this computer, but I really doubt it - he doesn't have friends smart enough to figure out how to get here.

Therefore... earlier this week is the first time I've *touched* this computer to try and fix it. I ran through the "do this first stuff," and this is my first Thread about this computer.

So...if you're still willing to help me, I would very much appreciate your continued help...

I didn't know that he had given "everyone" administrative rights, (and even if I did know that, I didn't know it was a problem). As soon as I read your post, I took those rights away from "everyone." (I also changed the setting, so that when users change, they have to "log out" rather than just "changing," if that makes a difference.)

I did all of the next stuff that you said to do in your post to me, and I've attached the logs. There still seem to be problems. I'm still getting the Phishing at the Ebay site. I left the computer to sit for a while with Firefox open, and it locked up, just like before.

Here are a couple more datapoints, if it makes any difference:

When I went to run MGtools/GetLogs, I got a bluescreen error the first time: "Page_Fault_in_nonpaged_area. It worked the second time.

When I ran Prevx the first time, it came up with a bunch of "Threats," in two different programs, and I Uninstalled both of those programs. I ran it again, and it came back clean. (Both of the Reflexive games.)

He's running Avast, and every time I reboot, I get the same message about a virus: C:\Documents and Settings\Help Assistant\Shared\Reflexive... (and then I can't read the rest, it runs off the screen) Malware name: win32:malware-gen. Malware type: Virus/worm. VPS ver: 100212-2, 02/12/2010. I click "delete" each time, but it keeps coming back. I (just now) deleted the entire "Shared\reflexive" folder and all sub-folders, and emptied the recycle bin.

 

Ok, we're all friends now, want some chocolate cake? We've got some left over from dinner!

I attached the MGlogs.zip file - I got this error message four times, but clicked Ignore, in case it matters:

16 Bit MS Dos Subsystem
C:\Windows\System32\cmd.exe
NTVDM has encountered a System Error
NTVDM has encountered a System Error c0h choose Close to terminate the application

Also, here are three more pieces of information.

First, I found out that my brother hadn't password - locked his wireless. I locked it off.

At the same time, I told him to try turning off Avast - for whatever reason, I had a funny feeling about it, and now there are 16 other things loaded (all the stuff I've been putting on throughout this process.)

One of those two things seem to have *dramatically* reduced the amount of times that the computer freezes. Now they can pretty much use either browser (IE or Firefox) without any problems. The only time the computer seems to freeze now, is if they walk away from the computer with the browser open (for, maybe, 10 minutes or more of no activity).

Third, the directory that I deleted, keeps coming back every time the computer is rebooted. I delete it, empty the recycle bin, but it comes back. It's c:\Documents and settings\Donnie\Shared\Reflexive all games crack......works 112%. There's a file in it called "reflexorator.exe" which prevx identifies as a threat. So...something keeps putting it back. (And, you don't have to ask - I already did - he didn't download anything like that, he doesn't recognize it, doesn't know what it is. I'm pretty sure he's being honest.)

TIA...

Donna

 

OK, here are the logs.

Shipping Assistant is OK. It's on purpose. It's a USPS application, so I can print up postal labels on their printer. (Long story...selling stuff on Ebay...) I use it on my computer at home, as well as my laptop (and I'm super-careful with my laptop), and I'm pretty sure it's clean.

Did everything, and... Ebay is still phishing. Don't know if the computer is still locking up if the browser is left open - it's midnight (which usually isn't past my bedtime, but it's been a long day), I'm tired, and I'm not going to stay up any longer to let the computer stew and think about locking up. It hasn't throughout the process of doing all this stuff.

Sigh. I'm starting to agree with him that he should just pull off all his important files, then take a big, fat magnet to it, call Dell and cry Warranty, and get the hard drive replaced.

:cry

 

Hey, so here's something fun. I tried to reboot into Recovery Console. Got the lovely blue screen - it's almost a lapis lazuli, quite pretty, actually... Sigh. The error I got was "A Problem has been detected and windows has shut down to prevent damange to your computer..... Check for viruses....." Yup, thanks. It won't let me get into recovery console to run fixmbr to get rid of a virus, because there's a virus.

So...I didn't do the rest of the stuff you said to do, because I'm thinking that it won't make a difference until I get the first part done?

Hm... Maybe I'll just open it up with a screwdriver and take a toothbrush to the drive and bits. Think that'll work? Maybe an SOS pad? It's either that or a bullet at this point...

 

(Yes, I'm replying to myself, sorry...)

And...no XP CD's. The computer comes with "Recovery discs." I tried to reinstall Recovery Console from the hard drive, thinking maybe that'd do the trick, but (and this one is fun, too...) I got two errors: First, something like, "The version of windows you are using is newer than this one, please update to a newer version," (they gave him a backup on his hard drive that's a different version that they installed?); Second, it flashed a request for a passkey, flashed away too fast for me to even put one in, if I even had one, which I don't, because there isn't any with the documentation. So... No XP CD's, no way to try to set up Recovery Console from the hard drive, not sure if it's even set up properly to use it, and, if it is, it isn't working because of the virus which we need to get into it to fix.

W00t. (Hrmph.)

 

::Banging head against wall::

Ignore my last post. As I was walking around the house, muttering with a lot of four letter words, about blue screens, and stupid computer manufacturers who distribute computers without sending along XP discs, my brother (I have to love him, I guess, he's related...), says, "Oh, I think you mean this one? I pulled it out of the box..." (he's a bit OCD and keeps *all* of the hardware related discs in one box, which I'd searched and searched and searched for the XP disc) "...about two weeks ago when I knew you were coming, and set it right here, so you could find it. I thought you'd probably need it. I guess the kids buried it with their stuff." I couldn't use any more four letter words right then, because the kids were around at that point. I said them very loudly in my mind.

So, I *did* manage to get into Recovery Console, and I *did* manage to run fixmbr, and I *did* do the rest of the stuff, and now there is *not* any more phishing on Ebay, and I'm crossing my fingers (and arms and legs and toes and everything else) that the next day or so shows that things are fixed!!!!!!! Brother, Mom, and Kids have to get on and do their various things, and I'll wait for complaints.

Meanwhile, I'm going to go pet the dog. I can mutter at him all I want. He doesn't care about four letter words. (Except for W - A - L - K!)

Oh, and MGlogs.zip wouldn't upload, becasue there was a huge file in it, called newfiles.txt. It's 2mb zipped, and the limit to upload is 97k? I deleted it from the MGlogs.zip, and upped the rest. If that one is vital, let me know - I don't know how to make it smaller if it's already zipped.

 

OK, I wasn't quite precise. The zipped file is actually *more* than 2mb. It was closer to 2.5mb. I cut it into two pieces manually, zipped up the pieces, and attached them as two files.

(I'm going home tomorrow! If this baby isn't cured by then, well, they're just going to have to make do until I come back in a month or two!) :wave

 

My brother says, "Thank you, what a nice guy. Why in the world would someone go to all this work for us for free?"

I say the same thing, and from the bottom of my heart.

Hugs and kisses.