Xp sp2/3

Hi and welcome

If your sister is having multiple popups in IE then its likely that the PC has malware infection and SP2 or 3 will not load on a PC with malware so before installing those service packs you will need to clean up the PC, and a guide is below.

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

• READ & RUN ME FIRST. Malware Removal Guide

• If something does not run, write down the info to explain to us later but keep on going.

• Do not assume that because one step does not work that they all will not.

Notes:

1. If you run into problems trying to run theREAD & RUN ME or any of the scans in normal boot mode. You can running steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
   

Once finished please start a new thread in the Malware Forum plus a guide on how to attach the logs HOW TO: Attach Items To Your Post

 

The first thing to do is Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

The second thing you need to do is Disable Spybot's TeaTimer

* Run Spybot and click Mode
* Select Advanced Mode.
* Then click Tools and select Resident.
* Now in the right window pane, uncheck TeaTimer.
* Also while this is open, in the left column now select IE Tweaks
* and then in the right pane make sure all the Miscellaneous locks are unchecked.
* Now quit Spybot!

First question is did you have MWAM actually fix the items it found or did you first attach the log before having it do so? Or did you not fix any of it? If you did not have it fix the items, then I want you to re-run it and do so, and then run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from MWAM.

 

Ok...your logs look good. However I would like you to remove all your IE toolbars and add-ons.

Use windows explorer to find and delete:
Java 2 Runtime Environment, SE v1.4.2"
Java(TM) 6 Update 4

Now tell me what this is:

Code:

C:\Documents and Settings\Owner\
~             Nov 10 2007      176594  "~"

If you don't know, delete it.

Now lets get rid of this:

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now I want you to Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
Then reboot and Enable System Restore to create a new clean Restore Point.

Now tell me if you can install SP3.