AntiVirus 2009 - Can't install Windows XP Recovery Console

Discussion in 'Malware Help (A Specialist Will Reply)' started by ladie, Jan 7, 2009.

  1. ladie

    ladie Private E-2

    Hi, I'm new to the forum though I've often come to read and learn as a visitor. In particular I read, followed and shared with friends your post on 'How to Protect Yourself from Malware'.
    Happy that I've not found a scrap of malware since, I'm so embarrassed that last night I carelessly googled my way to a site that said I needed Antivirus 2009. Knew it was bogus and not to click any answer, but it wouldn't shut down in the usual way, just kept giving more warnings. Finally used CtrlAltDel and End Programs to shut down firefox. Went back to Google with no further problems, but I understand that although it doesn't show up on my program list or add/delete programs, I may have inadvertently downloaded it just by going there or backing out, so I came here just to check and be sure.
    Following your instructions not to post until doing so, I've followed all the steps on your 'read & run me first - malware removal guide' including removing Online Armor (temporarily using XP Firewall junk along with my router) and am halfway through the 'Windows XP Cleaning Procedure' with a clean bill of health so far from SuperAntiSpyware, Spybot and MBAM. However I can't access the files for the Windows XP Recovery Console from my Toshiba Satellite P100 Recovery DVD-ROM, Windows XPHome Edition SP2 that came with my laptop as instructed in bleepingcomputers in their tutorial on using ComboFix.
    Worked for since the wee hours on this. No sign of AV 2009, but ads popping up particularly on bleepingcomputer site.
    What do I do now? Please be specific (and kind) as my knowledge is only fair to middling and I've had a sleepless night and day carefully going through all the procedures so far.
    My apologies for the length of this, and thanks for your patience.

    ladie
     
  2. ladie

    ladie Private E-2

    Success! Went back to bleepingcomputers.com and they had changed things to automatically download the recovery console. Maybe they read my post.

    Now finished with all the required scans and am attaching 3 of the logs here with the others in the next post.

    Hope someone can go through them and let me know if there are problems that the procedures done so far haven't eradicated.

    Thanks in advance,
    ladie
     

    Attached Files:

  3. ladie

    ladie Private E-2

    Here are the other two logs.

    Thanks again,
    ladie
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean....If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  5. ladie

    ladie Private E-2

    Hi, Tim and many thanks for taking the time to go through the logs.

    You say:

    Your logs are clean....If you are not having any other malware problems, it is time to do our final steps:

    I am having a problem but not certain if or how it is related, so thought I should check with you before continuing with the steps you've outlined.

    Since I've run these tools, my laptop isn't holding its wireless internet connection. It comes on briefly when I reboot, but then goes off until I reboot again. Sometimes exiting and re-entering my browser is sufficient, but not always. I can only get on the desktop reliably.

    Is this something that will go away when I go through these final steps or is it evidence of malware not detected by these scans or an unrelated issue?

    Thanks for your help so far,
    ladie
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I believe it is an unrelated issue. Have you tried uninstalling your wireless card in device manager and rebooting? Have you gotten into your wireless router and checked that all setting are right?
     
  7. ladie

    ladie Private E-2

    Thanks for the quick reply.

    Just to be contrary, my laptop has stayed online for over 30 minutes now, and came out of hibernation and managed to reacquire the network address. The only thing I did was to unplug my internet connection and my router and then plug them in again, a suggestion I found online. On the chance (likelihood?) that it will not continue to work, I will try your suggestions if you think I should, though I'm not sure how to do either of them.

    Have you tried uninstalling your wireless card in device manager and rebooting?

    Will this reinstall just by rebooting or will I need to use the disk (Toshiba recovery dvd??) and reinstall?

    As for settings on the router, can you tell me what to look for?

    The other possibility that comes to mind is that I downloaded Uniblue Driver Scanner recommended on your site and it found that both my network adapters and 6 other system devices (2 of them Intel) are out of date. Only scan is free, but when I went to MS Update to try to update them there, it wouldn't allow me to do an update. I know that the last auto update seemed to hang up and not go thru but thought that was due to the malware or perhaps some of the stuff I was using to scan for it.

    I'm out of my depth here.

    Meanwhile I'm wondering if I should go ahead and do the final steps you outlined in your first message.

    Sorry to be such a bother. I'm doggedly trying to learn how to do things for myself, but realize the only way is to have guidance and I greatly appreciate it.

    ladie
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Recycling the router should take care of it. You do not need to uninstall the card ( though when you do need to do this, on a reboot the system will find it and install it.)
    You can go to the manufacturer's website for your computer and look for downloads to update your drivers.

    Yes you should finish my last instructions for the final clean up and if you have any other issues, you need to post in the software section. :)

    Safe surfing. :)
     
  9. ladie

    ladie Private E-2

    Hi Tim,

    Thanks for the info re the internet connection. I found the update site and will download them asap.

    To finish off the malware process, I'm having trouble accessing combofix for step 2.

    Following the directions in your message, I get the message
    Windows cannot find 'C:Documents and Settings\OwnerDesktopcombofix'.
    I copied and pasted the name so that much is correct.

    I wonder if I installed it the way you wanted me to. I have a shortcut to combofix on the desktop and there is also a combofix.exe file in downloads in my documents. There is an empty folder in C:\ as well as a small 15 kb text file. What do you suggest?

    Looking ahead in the directions, #4 is only for vista users, so with xp I skip that and do all the others. Is that correct?

    Re the link on how to protect yourself from malware, I thought I'd followed all of those steps carefully and I update and scan with avira antivir daily as well as running spyware blaster and Spyware Dr, so I was especially shocked that I wasn't locked out of a dangerous site. Maybe the malware guys had updated after my last virus update at noon. Is there anything more I should be doing?

    Thanks again,
    ladie
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.And any other instances that you find of combo.

    I happen to like McAfee's Site Advisor.

    Yes, skip step #4.

    You are most welcome...safe surfing. :)
     
  11. ladie

    ladie Private E-2

    I'm so new that I just found the button to post thanks. As well as the smileys. ;)

    Many of them!!

    Two questions remain that aren't as urgent as the needs of those who are currently shut out by malware, but I hope you can answer when you have a moment:

    1. Was my computer infected with malware?

    Since there were no further procedures after running the scans, but realizing that one or the other of the things that were run could have isolated and deleted malware without my knowledge, I'm left wondering.

    2. Re McAfee's Site Advisor

    Will it play nicely with what I already have installed on my XPSP3 Toshiba laptop using a Firefox browser for most things:

    Avira Antivirus
    Online Armor
    Spyware Dr.
    Spyware Blaster

    as well as these that only run on demand:

    SuperAntiSpyware
    Malwarebytes' Anti-Malware
    Spybot Search & Destroy
    Ad-Aware
    CCleaner
    Registry Mechanic

    All of these are free versions, though I'm tempted to go to the paid version of Online Armor due to the fact that it updates automatically. It also has other features which until I try them I'm never sure I can make use of or if they'll just frustrate.

    I assembled most of them some time ago when I read your sticky 'How to protect yourself from malware.' Don't know why I wasn't protected from my own stupidity and allowed into the AntiVirus 2009 site, but guess nothing's perfect. Or maybe there wasn't an infection, and I've just been overly cautious.

    Again: Many, many thanks and keep up the good work.

    Best regards,
    ladie with a nice clean computer :)
     
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You had managed to not be infected...:)

    McAfee works quite well and will not have a problem with your security programs.

    As to Outpost...my opinion is that PCTools Firewall is much easier to use and set up than Outpost.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds