major problems on laptop

Discussion in 'Malware Help (A Specialist Will Reply)' started by newera, Aug 20, 2005.

  1. newera

    newera Private E-2

    i have run through the basic trojan/virus removal steps twice now and my laptop still has problems, i can barely access my computer without going into safe mode and even in safe mode my computer goes nuts. I have managed to get onto normal mode but now i am constantly getting this windows office xp with frontpage installer appearing everytime i do something, and also my computer seems to be running extrememly slow please help
    thanks in advance
     
  2. newera

    newera Private E-2

    ok here is the hijack this log
     

    Attached Files:

  3. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    To keep you moving along since D3m3nt3d isnt around at the moment.

    First you must unsinatll Microsoft AntiSpyware so it will not block anything we try to fix.

    Download LSP-Fix

    After download is complete, Run LSP-Fix

    Check the Box labeled "I know what I'm doing" and then click on the newdotnet6_38.dll file (in the “Keep” section) to select it.

    Then, Select the >> button to move newdotnet6_38.dll into the Remove section.

    Now, click the Finish Button. When the Repair Summary box appears, click OK.

    (Note: If the file newdotnet6_38.dll is already in the remove section, then just click FINISH.)


    After you complete the above...
    Download this trial version of Ewido Security Suite

    • Install ewido security suite
    • Launch ewido, there should be an icon on your desktop double-click it.
    • The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
    • After it completes the update, click the Scanner button

    Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

    Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

    Open up Ewido and do the following:


    • Click on Scanner
    • Then click Settings
    • Under What to Scan? Select Scan every file
    • Then click OK
    • Click on Complete System Scan and the scan will start.
    • Let the program scan the machine
    While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

    Once the scan has completed, there will be a button located on the bottom of the screen named Save report


    • Click Save report
    • Save the report to your desktop or anyplace you will be able to find it to upload here.
    Reboot into normal mode and reconnect to the internet.

    Come back here and post the Ewido Scan Report along with a fresh HJT log.
     
    Last edited: Aug 21, 2005
  4. newera

    newera Private E-2

    ive run into a problem dolsp.dll doesn't exist in lsp fix
     
  5. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Sorry about that, copied and pasted and missed that file name. I have fixed the post so you can procede with my previous post.
     
  6. newera

    newera Private E-2

    ok sorry it took so long couldnt get into normal mood for awhile but here are both logs
     
  7. newera

    newera Private E-2

    sorry forgot the logs
     

    Attached Files:

  8. newera

    newera Private E-2

    um sorry if i sound a bit impatient..but is there still stuff left for me to do? because it seems like my computer isn't working properly yet :S
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should also look for and delete:
    C:\Windows\System32\lexplore.exe <--- note this is a lower case 'L' . Lexplore.exe. It is not an 'i'.

    Do not confuse this with c:\windows\iexplore.exe which is valid!!
     
  10. newera

    newera Private E-2

    ok i did everything you told me to do and rebooted but now i can't get into normal mode :S:S so what should i do now :S
     
  11. newera

    newera Private E-2

    wait should i get the updates in safe mode?
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not post the follow up HJT log D3 requested. Try rebooting one more time and if you cannot get into normal boot mode, post the HJT log from safe mode.

    Did you have any problems at all while running the steps? Did you find and delete the files (and only those files)?
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    D3 should have had you fix the below line in HijackThis too:

    O4 - HKLM\..\Run: [Start Page] C:\WINDOWS\system32\svcnt32.exe home

    Also delete the C:\WINDOWS\system32\svcnt32.exe file in safe mode.
     
  14. newera

    newera Private E-2

    well ptcore.exe didn't exist after i fixed it in HJT, neither did lexplore.exe
     
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you see my message # 15?
     
  16. newera

    newera Private E-2

    ok i did what you told me to do but i could not get into normal mode so here is the hjt log from safe mode
     

    Attached Files:

  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What are the below items for?


    O4 - HKLM\..\Run: [JFaxMailNTHelper] C:\WINDOWS\JFaxMailNTHelper.exe
    O4 - HKCU\..\Run: [ENPY] C:\ENTICA\ENPPY\ENPPY.EXE

    Try powering your PC down completely. The wait a minute and power back up. See if you can boot normally. If not, tell us exactly what happens. If you get an error message, tell us the exact message. Use Windows Explorer and look for c:\boot.ini file. It is normally a hidden file. View it with notepad and tell us what is in it. Do not modify it (do not delete it either - it is a system file).
     
  18. newera

    newera Private E-2

    those two are programs that arent being used anymore
     
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you do not use them or need them you should look for an Uninstall and uninstall them.
     
  20. newera

    newera Private E-2

    should i look for boot.ini in normal mode ? because i cannot find it in safe mode

    oh and what happens when i try to get into normal mode is
    everything loads but then freezes and i get this thing trying to install windows office xp with front page but then it freezes
     
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Didn't you just say you could not boot in normal mode?

    It is a hidden file. You must have viewing of hidden files enabled inoder to see it (even in safe mode).
     
  22. newera

    newera Private E-2

    viewing of hidden files is turned on but it is not there

    C:/boot.ini is not there
     
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What about viewing system files? What about showing file extensions?

    Try booting with you connection to the internet physically unplugged.

    When do you get those messages? Immediately after reboot or when you try to open and run something (like your browsers)?
     
  24. newera

    newera Private E-2

    the installation window pops up as soon as i reboot the computer and it begins loading the desktop
     
  25. newera

    newera Private E-2

    oh and i still cannot find the boot file..
     
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What is your exact Win XP version? Home, Pro?
     
  27. newera

    newera Private E-2

    professional
     
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try copying the following quoted text into notepad and hen click File and then Save As. Change the Save as Type to All Files. Name the file boot.ini and save it to the root folder on drive C. Make sure you now see c:\boot.ini

    Did you uninstall those two programs you no longer use?
     
  29. newera

    newera Private E-2

    ok it is visibal now and i unistalled jfax but i uninstalled enppy a long time ago and it shouldnt be there..wierd
     
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you reboot after saving the file? Can you get into normal boot mode now?

    Have HJT fix:
    O4 - HKCU\..\Run: [ENPY] C:\ENTICA\ENPPY\ENPPY.EXE

    Then delete the C:\ENTICA folder (you may have to do it in safe mode).
     
  31. newera

    newera Private E-2

    ok! ::D i managed to get into normal mode but i am still getting the installation window and an lsa problem window
     
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Post a HJT log from normal boot mode.
     
  33. newera

    newera Private E-2

    okay heres the hjt log in normal mode
     

    Attached Files:

  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I thought you said you uninstall the below. Looks like you need to have HJT fix this line too and the delete the file after next reboot.
    O4 - HKLM\..\Run: [JFaxMailNTHelper] C:\WINDOWS\JFaxMailNTHelper.exe




    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).


    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.

    C:\WINDOWS\System32\soff.pif


    After killing all the above processes, click "Back".

    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\Run: [Microsoftf DDEs Control] soff.pif
    O4 - HKLM\..\RunServices: [Microsoftf DDEs Control] soff.pif


    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    c:\windows\system32\soff.pif or c:\windows\soff.pif


    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.


    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.


    Now reboot in normal mode and post a new HJT log. And tell us how things are working.


    After doing the above we probably really need to get you working on get better protected which includes getting your Windows updates. You seriously need them. See the below thread and start working thru it. Step 1 in Widows Update.

    How to Protect yourself from malware!
     
  35. newera

    newera Private E-2

    heres the new hjt log i will be starting the updates now
     

    Attached Files:

  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Your log is clean! The speed of your internet connection will have an impact on how long it takes to get these updates. If you are on dial-up, it will take a very long time.
     
  37. newera

    newera Private E-2

    i am still getting the windows xp professional with front page install window
    will that go away with the updates?
     
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure. Do you use Front Page and or Office Pro? You may have to insert your CD and repair something. That would be an issue for the Sofware Forum.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds