Cannot even see Control Panel...Loaded with restrictions

Sorry in advance if I missed something referring to this topic.  Maleware is certain, mostly causing IE to go where it wants IN ADDITIONS to restricting my access to places like the Control Panel.  Can't even use Add/Remove programs by going directly to appwiz.cpl.  Cannot download anything with this computer due to IE's "mind of its own regardless of which browser I am using.  Running XP Home Edition (friends computer) mine is win98SE and working if that will help me get her going.  I did read "steps to take before requesting assistance but they require doing things that require access to add/remove programs and running (and/or) installing such.  I can't even install a anti spy/adware program from a disk.  The "install wizard" stops just before or after the "accept agreement."  Note I am in "owner" mode and there should be no restrictions.  Any suggestions before I can attempt to start doing your preliminaries?  Thanks, Dan in NY.   

[Malware Removal Specialist]

Welcome to the Computer Hope Computer Viruses and Spyware Forum.

In order to help you clean any malware on the computer we will need some more information from you and about the computer. Please go to this thread and read the instructions for posting the required logs.

Once the logs are posted a member of the malware team will be along to assist you in further removal instructions.

Thanks for the reply...unfortunately, I have read the "thread" and realize that you require certain information and that there are certain steps I should take prior to requesting help to "clean" this computer.  However, as my initial "Post" indicated, I am unable to perform the steps outlined in the "thread" for reasons stated in the original post.  Any help you can offer which will get me to a point of being able to submit the required information would be appreciated.

I will be off line for a while now but will check here when I come back.

Thanks again for any help you can give.  Dan

[Malware Removal Specialist]

Try to get the Hijackthis program installed. If needed download the installer then restart the computer into safe mode then run the installer and see if it will install like that.

Let me know.

Just a suggestion in case the install still fails...

Since you cannot install anything why not download the stand-alone HiJackThis.exe onto your machine and then transfer it to your friend's machine via a flash drive or something similar? Then manually create a new folder and place the HJT exe there and run it. You could then transfer the logfile it generates back to your machine using the same method and post it. That should at least get the ball rolling...

- JPH

Thanks both of you.  Will give both suggestions a shot.  Seems that I tried starting in "safe mode" a few times but kept locking up.  Will come back as soon as possible.  Dan

Hi again...When I try starting in safe mode, all I get are about two screens of drivers displayed and then all stops and locks up.  Have to power down to restart.  Tried "safe mode" and "safe mode" with prompts.  Both the same.

The ending screen is full and all lines are the same save for the driver name:

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS\System32\DRIVERS\driver name

Stop...Now after third time and long wait, kind of in "safe mode" but screen is blank except for "safe mode" in all corners and "Microsoft Windows...etc across the top.  No icons, nothing but black screen.  Pressing "Ctrl Alt Del" brings up the "Task Manager."  There are 11 processes running and no applications.  In XP, is it normal for "Ctrl Alt Del" to bring up the Task Mngr?"
I can navigate in the task manager.  Any of this tell you anything? tks, Dan 
 

[Malware Removal Specialist]

See if you can get this zip file to run. Do you have a flash drive to transfer it if needed?

Download to your Desktop this self-extracting ZIP archive FixPolicies.exe
 

• Double-click FixPolicies.exe
  
• Click the Install button on the bottom toolbar of the box that will open.
  
• The program will create a new Folder called FixPolicies
  
• Double-click to Open the new Folder, and then double-click the file named  Fix_Policies.cmd
  
• A black box will briefly appear and then close. This will enable your Control Panel, Task Manager and stop any Administrative warnings.
• Delete the FixPolicies files and folders.

.
Then see if you can get a Hijackthis log.

Hi evilfantasy, Before anything else, a huge TY (one of many to come I'm sure) from me and my lady in TX.  I'm in NY.  I downloaded both "FixPolicies.exe" and "HiJackThis.exe"  After running FixPolicies, I didn't get sight of the Control Panel BUT, I was NOW able to open Add/Remove Programs (without "Restrictions" as I had last night) with appwiz.cpl.  Major advanecment SO FAR!  Had to put them on floppy from my sys as currently don't have CD-R and x-fer that way.  I have removed a few programs with a list of ???programs.  Have not rebooted yet, however, was now able to install SpyDoctor (in hopes that I might be able to get her sys on line) and it shows a load of problems.  If removal of these "bugs" is a step I should take prior to continuing with you, I will either have to get her sys on line or order the disk?  Pls adv.  I did download CCleaner...too large for floppy.  Can try to get a CD-R working in my sys if I can't use hers on line.  Your time means a lot to us...no flash Dr.. Dan       

One last thing, do you think removing IE (since that is what keeps opening) might help me to get on line?  Or will any download probably get corrupted as long as I have this many problems?...Dan

[Malware Removal Specialist]

I would suggest to only use the tools in the removal instructions for now. They create logs which I need. The logs let me see what we are dealing with and in turn know the correct steps to take in removing everything.

You can post a Hijackthis log now if you can get that to run. I would like to see what is going on in case you run into any more obstacles.

Ok, thanks...will try to do that now.  Be back as soon as I get something..Dan

I hope this opens for you, will be here.  By the way, SD indicated I had 2.889 Infections Detected.  I haven't done anything else other than shut down SD and re-start.  Hijack opened without any problems but I have it in C:/ instead of Program Files...DB


[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

This is the worst I have see in a while.

Please download Combofix by sUBs from one of the below links.
(Try all three if necessary)

• Link #1
  
• Link #2
  
• Link #3

Important! Combofix.exe MUST be saved to and ran from the Desktop.

• Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
• Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
  • Click this link to see a list of security programs that should be disabled and how to disable them.
    
  • If yours is not listed and you don't know how to disable it, please ask.
• Warning: Combofix disconnects your computer from the internet. The connection is automatically restored before Combofix completes its run.
  
• Double click combofix.exe & follow the prompts.
• 
  
  • From the keyboard select 1 and press Enter[/COLOR]
  • When finished, it will produce a log for you.
  • Post that log in your next reply.
  Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall
  
  • If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
    
  • Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.
  .
  ----------
  
  Create An Uninstall List
  • Start HijackThis
    
  • Click on the Open the Misc Tools section
    
  • Click on the Open Uninstall Manager button.
    
  • Click on the Save list button and specify where you would like to save this file and click Save.
    • When you press Save button a notepad will open with the contents of that file.
  • Copy and paste that list in your reply.
  .
  ----------
  
  Run a new Hijackthis scan and post the log.
  
  ----------
  
  Next post please add
  Combofix log
  Uninstall list
  New hijackthis log

Good morning,
?: "Combo Fix will reconnect to the net prior to completing its run"  Does this mean that Combo Fix "has" to connect to the net to complete its run?  If so, I will default her sys to my dial-up.

I haven't "connected" with her sys since we started working on this as when I do, I immediately get no less than 8 to 12 instances if IE popping up making it impossible to go to any site I try to address.

I've downloaded Combo Fix to my sys, now all I have to do is get it to hers.

Please adv. and thanks again...Dan

[Malware Removal Specialist]

Combofix disconnects the computer from the internet while it is running. It may be reconnecting the internet connection. restarting the computer will do dthis also if combofix has any problems doing it.

Did it run? You can find the log in C:\combofix.txt

Hi,
Had to get a R/W CD-ROM working on this computer and finally got ComboFix installed on her system.  Started it about an hour and half ago, clicked the agreement etc and it did save and started "scanning."  Its been sitting there in "Auto" scan with the msg
Scanning for infected files...
This typically doesn't take more than 10 minutes
However, scan times for badly infected machines may easily double.
Blinking cursor (-)

("Windows Security Alert box"...click here to download spyware remover.) keeps popping up about every 5 minutes (like it usually does) and the cursor in the Auto scan Box disappears until I check "NO" in the "Alert Box."

Did not have an option to Enter 1 from the kybd.  Do you think this is running?  7:40 PM now EST.  Been seeing that window (Auto Scan) since 6:10 PM....DB
   

[Malware Removal Specialist]

Go ahead and exit out of it and try something else. If it doesn't work like this we will move to something else.

• Make sure combofix is located on your desktop.
• Now STOP all your monitoring programs
  
• Click this link to see a list of security programs that should be disabled and how to disable them.
  
• Click on your START button and choose Run.  Then copy/paste the entire content of the following Codebox (Including the "" marks and the Symbols) into the run box.
                                   
  Code: [Select]
  "%userprofile%\desktop\ComboFix.exe" /KillAll[/B]

• Click OK and this will start combofix in a special way.
  
• When finished, it will produce a log.
• Please save that log to a Notepad File and include it in your next reply.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

* ComboFix will automatically Restart your machine when the KillAll switch is used.

Combofix (CF) disconnects your machine from the internet. The connection is automatically restored before CF completes its run.
If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Hi...We had a pwr outage briefly (Flux) and "ComboFix" started again and this time, deleted a bunch of files but did stop again.  Do you want me to follow your last or restart again to see if it may finish? Dan

[Malware Removal Specialist]

Did combofix finish? I need the log, look in C:\combofix.txt to see if it is there.

If not then run it again and try to get the log.

Hi evilfantasy,

Finally got the logs you wanted.  Had to use the /KillAll to get the ComboFix report to complete.  Sorry I couldn't get back sooner...take care of my 85 yr Mom here and had to do some hardware maint on my sys to be able to transfer files back and forth.  Hardware is my area since 1978 (before the PC.)

I really appreciate your help here and am actually enjoying learning this area.

Will check for your reply later...Dan


[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

Good to know you have some computer experience, together we should be able to get through this. Things should start going smoother after these steps (I hope  )

Don't worry about a quick reply, I understand.....

Go to add/remove programs and uninstall.

WildTangent GameChannel (remove only)
WildTangent Web Driver

---------------

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://as.starware.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/Ywt/2xYhTlJWsTa T2qe9hmytdAJoE25pY3WIUBWZ7vhxCle3JobzTa ZoNa3dbzZtyamo5qZEQXR7oJEjrweFibNOENq5+tV vesgY5ULM7jxUI=
- R3 - URLSearchHook: (no name) - - (no file)
- O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm41430

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Now download The Avenger by Swandog46 and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
  
• Copy everything in the Code box below, and paste it into the Input script here window:

Code: [Select]

Files to delete:
C:\WINDOWS\system32\jzoiszad.dllbox
C:\Documents and Settings\All Users\Application Data\TEMP
C:\WINDOWS\system32\ansjdsqv.ini
C:\WINDOWS\system32\juhmrlgf.ini
C:\Program Files\tmp11251218.exe
C:\Program Files\tmp11239515.exe
C:\Program Files\11053328.exe
C:\Program Files\11067703.exe
C:\WINDOWS\system32\wvuspmn.dll

Registry keys to delete:
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1613FC40-73BD-43E3-3CAB-54FBBC3227B1}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6e60e56e-4f29-4448-b76c-38947546a4df}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94D4C983-7FF6-4626-AB3A-56F0587F94A4}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B02C0C3D-752C-4905-82E2-E2EED48F06A1}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F1DDFD59-6070-4FB1-92C1-E285DC8B3FBA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Services
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\System Services
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\plite731
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\78d2b5e2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jzoiszad
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnlkji

Note: the above instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

• Now click the Execute button.
  
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

• Please add the Avenger log in your next post.

.
---------------

Please download ATF Cleaner by Atribune. ATF Cleaner.exe

Make sure that all browser windows are closed.

• Under the Main tab, put a check next to Select All.
  Click the Empty Selected button. (Note: if you remove cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck Cookies)
  
• If you use the Firefox browser:
  Click on Firefox at the top and put a check next to Select All.
  If you would like to keep your saved passwords, click No at the prompt.
  Click the Empty Selected button. (Note: if you remove cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck Cookies)
  
• If you use the Opera browser:
  Click on Opera at the top and put a check next to Select All.
  If you would like to keep your saved passwords, click No at the prompt.
  Click the Empty Selected button. (Note: if you remove cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck Cookies)

.
Important: Restart the computer before continuing.


---------------

Please download Malwarebytes' Anti-Malware (MBAM) to your desktop from either of these two links.

• Link 1
  
• Link 2

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to
• Update Malwarebytes' Anti-Malware
  
• Launch Malwarebytes' Anti-Malware

• Click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad.
• Please  copy and paste the log into your next reply

Note: If you accidentally close the log it can be retrieved at any time from the Malwarebytes' Anti-Malware main screen.

• Launch Malwarebytes' Anti-Malware.
• Click the Logs tab.
  
• Double-click log-mm.dd.yyyy [xxxxxx].txt

.
---------------

Now run a new Hijackthis scan and post that log also.

Items needed in next post:
Avenger log
MBAM log
New Hijackthis log


Let me know how things are now.

Hi,
Things are looking a lotttt better!  Have Ctrl Panel and display settings back.  All on your list went smooth (Justs take extra time working from two computers and making disks back and forth etc.  After sending this, I will try to go on-line with Keri's system and see what happens.  I'll send a separate note.

All logs are attached and here is what I am getting on start-up:

Windows can't open MWSOEMON.EXE.vir...Search on-line? or elsewhere?  That comes up twice during startup (same file)

RUNDLL
Error loading
C:\Windows\System32\spbuqqxi.dll  and
C:\Windows\System32\pfhvlxjr.dll

Both "Specified Modual could not be found."

Will try going on-line with keri's sys now and drop another Post.

Thanks,
Dan

[recovering space - attachment deleted by admin]

Hi evilfantasy,

On-line now with Keri's system and so far, no pop-ups or interference from IE.  Using "Firefox"...just downloaded with this unit and all was good.

Looking forward to your review of the "reports" and "other" comments.

Will get a few Zzzzz now and catch you a little later.

Thanks,
Dan

[Malware Removal Specialist]

Glad things are improving!! I sort of thought they may after those steps.

The logs are all blank. Go to the locations they save to and post new ones.

Avenger is in C:\avenger.txt

MBAM can be retrieved at any time from the Malwarebytes' Anti-Malware main screen.

    * Launch Malwarebytes' Anti-Malware.
    * Click the Logs tab.
    * Double-click log-mm.dd.yyyy [xxxxxx].txt

Run a new Hijackthis scan for it's log.

Good morning,
Sorry about the logs being blank. I copied them from floppy and the data was on the floppy???

These came right out of her computer.  I hope they in tact.  Will get off line after this post and do another HiJack Scan and they come back and post it

Dan


[recovering space - attachment deleted by admin]

Here is the latest HiJack This Log...DB



[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

Looking better. I'm glad you are online with the PC now, I know how frustrating transferring everything can be.

Still some work to do.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if still there)

- O2 - BHO: 0 - {1613FC40-73BD-43E3-3CAB-54FBBC3227B1} - C:\Program Files\Windows Media Player\rybi.dll (file missing)
- O2 - BHO: {fd4a6457-4983-c67b-8444-92f4e65e06e6} - {6e60e56e-4f29-4448-b76c-38947546a4df} - C:\WINDOWS\System32\lklnfaim.dll (file missing)
- O2 - BHO: BndShell3 BHO Class - {8ABA9A9C-8791-4d61-8D5B-BCC9448EA573} - C:\Program Files\ISM\BndDrive7.dll (file missing)
- O2 - BHO: (no name) - {94D4C983-7FF6-4626-AB3A-56F0587F94A4} - C:\WINDOWS\System32\geedc.dll (file missing)
- O2 - BHO: (no name) - {B02C0C3D-752C-4905-82E2-E2EED48F06A1} - C:\Program Files\ComPlus Applications\nipysado4444.dll (file missing)
- O2 - BHO: (no name) - {F1DDFD59-6070-4FB1-92C1-E285DC8B3FBA} - C:\Program Files\ComPlus Applications\nipysado83122.dll (file missing)
- O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreloa d.ocx
- O16 - DPF: {54D53429-945C-4188-B460-C81356541882} (SaveImageFiles Class) - http://eshare.hpphoto.com/Download/HPeServicesLocalPrint.CAB
- O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Download Vundofix.exe to your desktop.

• Double-click VundoFix.exe to run it.
  
• When VundoFix opens, click the Scan for Vundo button.
  
• Once it's done scanning, click the Remove Vundo button.
  
• You will receive a prompt asking if you want to remove the files, click YES
  
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
  
• Turn your computer back on.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears at reboot.

Please let Vundo finish, sometimes it can take multiple passes

----------

Download SDFix.exe and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard).
  
• Finally add the contents of the Report.txt in your next post.

----------

Now run another NEW Hijackthis scan and post that log also.

----------

Next post please add
Vundofix log
SDFix log
New Hijackthis log

Hi again,
Sheesh...Was out for a while then sat back down at the computer, touched the keyboard and all *censored* broke loose (beeping)...stupid bad kybd connector.  Wouldn't even re-boot. Well 30 yrs in hardware and a little solder and back to you...
Couldn't find a "Vundofix.log" only the "addmorefiles.txt"  If not right, I'll look again.
The rest is there (I will check after post to be sure they contain data.)

FOR INFO: Still getting "Windows can't open MWSOEMEN.EXE.vir" twice on each re-boot.

Still getting RUNDLL "Error loading "C:\Windows\System32\spbuqqxi.dll and pfhvlkjr.dll.  I believe they were both removed.  Would have to read the logs again.

Let me know if I missed anything.
Dan


[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

Go to C:\QooBox and delete the entire QooBox folder and empty the recycle bin afterwards.

----------

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O4 - HKLM\..\Run: [Windows Network Management and Security Layer] "C:\WINDOWS\system32\nmsl.exe" *
- O4 - HKLM\..\Run: [plite731] C:\WINDOWS\plite731.exe
- O4 - HKLM\..\Run: [Network Translation Service] "C:\WINDOWS\nts.exe" *
- O4 - HKLM\..\Run: [78d2b5e2] rundll32.exe "C:\WINDOWS\System32\pfhvlxjr.dll",b
- O4 - HKLM\..\Run: [BM7be1867e] Rundll32.exe "C:\WINDOWS\System32\spbuqqxi.dll",s
- O4 - HKCU\..\Run: [System Services] aivbbzlgg.exe
- O4 - HKCU\..\RunServices: [System Services] aivbbzlgg.exe
- O4 - HKUS\S-1-5-18\..\Run: [Windows Network Management and Security Layer] "C:\WINDOWS\system32\nmsl.exe" * (User 'SYSTEM')
- O4 - HKUS\.DEFAULT\..\Run: [Windows Network Management and Security Layer] "C:\WINDOWS\system32\nmsl.exe" * (User 'Default user')
- O4 - Startup: MyWebSearch Email Plugin.lnk = C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir
- O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir
- O23 - Service: Windows Network Management and Security Layer (NMSL) - Unknown owner - C:\WINDOWS\system32\nmsl.exe (file missing)

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Download OTMoveIt2 by OldTimer.

• Save it to your desktop.
  
• Double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

Code: [Select]

C:\WINDOWS\system32\nmsl.exe
C:\WINDOWS\plite731.exe
C:\WINDOWS\nts.exe
C:\WINDOWS\System32\pfhvlxjr.dll
C:\WINDOWS\System32\spbuqqxi.dll
aivbbzlgg.exe
aivbbzlgg.exe
C:\WINDOWS\system32\nmsl.exe
C:\WINDOWS\system32\nmsl.exe
C:\WINDOWS\system32\nmsl.exe

• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window.
  IMPORTANT -- Paste only into the bottom input panel (under the Yellow bar),  The top panel will not help you.
  Right-click and choose Paste.
  
• Click the red Moveit! button.
  

Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.

Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start>All Programs>Accessories>Notepad), click File>Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present. Copy and then paste the contents of that document in your next post.

----------

Run ATF Cleaner and then restart the computer.

----------

Next post
OTMoveIt log
NEW Hijackthis log

Let me know how things are now.

Hi,
OTMoveit2 hung up twice (program not responding.)  I checked for a log, wasn't any...two empty folders.  I typed out what was in the "results box"

[Custom Input]
< C:\WINDOWS\system32\nmsl.exe >
File/Folder C:\WINDOWS\system32\nmsl.exe not found.
< C:\WINDOWS\plite731.exe >
File/Folder C:WINDOWS\plite731.exe not found.
< C:\WINDOWS\nts.exe >
File/Folder C:\WINDOWS\nts.exe not found.
< C:\WINDOWS\System32\pfhvlxjr.dll >
File/Folder C:\WINDOWS\System32\pfhvlxjr.dll not found.
< C:\WINDOWS\System32\spbuqqxi.dll >
File/Folder C:WINDOWS\System32\spbuqqxi.dll not found.
< aivbbzlgg.exe >

Don't know if that will help?  I did re-boot and checked again (wasn't told to by "OT") anyway, still nothing in the folder.

DB


[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

Ok, looking better again. Now we need to get some updates.

Go to Start > Windows Update or go to http://update.microsoft.com/microsoftupdate and install ALL critical security updates listed.

When it is complete run a new Hjackthis scan and post that log.

Hi "evilfantasy,"
TY (mail)

Not really sure I got what you wanted (searched MS's "Critical Security Downloads" and was directed to these and did them:

1st, Installed Windows Updates...then "Recommended Installs for this system
(found under (search) critical security Updates I hope this is what you requested?

Downloading Update for Background Intelligent Transfer Service (BITS) 2.0 and WinHTTP 5.1 (KB842773) (update 1 of 3)...
Downloading Update for Windows XP (KB898461) (update 2 of 3)...
Downloading Update for Windows XP (KB898461) (update 2 of 3)...
Downloading Windows Genuine Advantage Validation Tool (KB892130) (update 3 of 3)... done!
Initializing installation... done!
Installing Update for Background Intelligent Transfer Service (BITS) 2.0 and WinHTTP 5.1 (KB842773) (update 1 of 3)...
Installing Update for Windows XP (KB898461) (update 2 of 3)...
Installing Windows Genuine Advantage Validation Tool (KB892130) (update 3 of 3)...

ADDITIONALY, HOPE I didn't mess up what you are doing but I downloaded and installed Foxfire2 and Thunderbird.  If I shouldn't have done that at this time...very sorry and will cease further "enhancements."  Also want to install "Musicator" ,"Midi-OX". "Lilypond" (music and scoring/ Midi related)  Will wait pending your go ahead.

HiJack.txt is attached.

Tks,
Dan
 
 

[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

I was hoping to see the Windows XP SP2 update included. Was it an option, and if so please go back and install it as well.

Using Firefox is fine, but I would wait on any other downloads until we are done.

Please excuse me that was "Firefox"
db10

OK, will do both (XP2) and no more installs....tks
db

[Malware Removal Specialist]

Yes, please go back to the updates page and search for updates. Look for XP SP2 in the descriptions and install that.

Ok, there now and will install...INDICATED TIME FOR DOWNLOAD (DIAL-UP) FOR ME IS ABOUT 4 HOURS...

CATCH YOU LATER WITH A NEW HiJack Log also.

DAN

[Malware Removal Specialist]

Sorry it will take so long but it is crucial that it is installed. There are many security features included in it.

Hi evilfantasy,

I don't mind spending the time, I don't want to waste yours.

This "EULA" thing may take more than we both thought.  I did go to the Microsoft site as you advised and tried running the "WGA" but it wouldn't complete.  Reason: may not have proper ACTIVE X Controls and gave instructions to look at the "INFO BAR" and go from there.  All fine but have no "INFO BAR" on IE and couldn't find anywhere to activate it.  Sent a message to MS but who knows when they might reply?  Thought maybe I need a newer version of IE?  I have ver 6.0.2800.xpsp2.030422-1633.  Not sure about dropping in ver 7.xxx?

I realize that getting SP 2 installed is TOP LINE PRIORITY.  I am tenacious and I WILL GET IT INSTALLED!  You have the patience of a Saint.  TY.  I'll keep moving on this.  Need a little break.  Will see you later.  db-10     

[Moderator]

Talk to everyone you know and even make a few calls to the local Computer shops to see if anyone has the CD...they are still available to order if you cannot find one.

[Malware Removal Specialist]

You can also "try" to get the updates using Firefox from Windiz. I don't know if it will help but it is worth a shot.

http://windowsupdate.62nds.com/

Why use WindizUpdate?

Not only will it keep you up to date with the latest updates from Microsoft, it will also keep software and drivers from other vendors updated. However, that functionality is currently missing.


Good reasons to use WindizUpdate

    * No personally identifiable information is collected from your computer.
    * No more unwanted spyware -- Microsoft Internet Explorer can finally be removed from your computer (if that were possible).
    * It lists just the updates you need. If an update has been superceded by a newer one, it will not ask you to install the older one.
    * Using enhanced data from MBSA, WindizUpdate will find more security patches needed for your O/S than the "other" website.
    * If there is a security issue with a component that is not yet installed, it will not ask you to update it. For example, if you have not installed hyperterminal, it will not update it.
    * It is not restricted to just Microsoft products. Software from other vendors can also be updated.
    * Upgrading to the latest version of Internet Explorer is not considered a Critical Update!
    * Works on Windows versions no longer supported by Microsoft -- Windows NT 4.0 and Windows 95
    * Our plugin is not an ActiveX control.
    * Integrated download manager with error detection -- you can cancel downloads at any time, and the next time you wish to install the cancelled update, it will continue from where it left off. Only corrupted sections of the file are redownloaded.

If you are still not convinced that WindizUpdate is the site for you, please check out our page titled "do we need to say any more?

Disadvantages

    * There is a delay from when new updates are released from Microsoft to when they appear on this site.
    * If you're using Internet Explorer, you will need to use Microsoft's Windows Update site for updates -- this site will be of no use to you.
    * You'll need to upgrade your browser if you're using MSIE 4.xx -- This site won't work, neither will Microsoft's.

Hi evilfantasy and tks to patio also,

Working on getting SP2...sources (shops) around here are...well forget it.  All they see is $$$$$$$$$$$$.  Bring it in etc.  $100.00+ to "Clean" the computer and $50.00/GB too save programs or data?  I never tried to bilk My Customers the entire time I was active.  I have no doubt that you and Computer Hope are doing a much better job then they would ever do and not a program nor piece of data has been lost yet and I don't think any will.

Anyway, checking with Keri in TX  for the "UPdate" and in the meantime, had overnight response from Microsoft Tech Support for the EULA issue (they did validate the Key code as genuine) but either the System WASN'T installed with the Genuine Key or the WAG engine wasn't installed properly.  They will help me get that all corrected.  I think its important to get her (Keri's) system right and then install  SP 2.

Therefore, unless you want me to do something different, I will get this (these) other thing(s) out of the way and GET that SP 2 INSTALLED.

Until next...will post again ASAP.

Thanks again,
Dan

       

[Malware Removal Specialist]

You can ask MS to ship you a SP2 CD. They used to do it for free but I think they now charge shipping. Worth a shot as you won't have to rely on the dial up connection to get it installed.

Hi,

Yes they will ship and it is free and at 266MB certainly more appropriate that "trying" to download on dial-up.  But indications are 4 to 6 weeks delivery time.  Therefore, trying all other avenues.  If they will ship overnight, it would be worth the shipping.  Will try to get an answer to that today with the "Tech Rep" there.
dan
 

[Malware Removal Specialist]

I am pretty sure they do offer paid shipping.

Ok,
Let start working with MS and will get back here later.

Thanks
Dan

Hi,
Well did some things for MS and the Product ID Code did NOT match.  Although they said no problem and could resolve that, I haven't heard back in two days.  So still waiting there.

If I get a copy of SP 2 before they (MS) continue with me, can I install it when I get it or will this "Product Key" problem prevent that?

I don't like keeping you on hold, You've put a lot of time in on my problem already and that's really appreciated.

Thanks,

Dan

[Malware Removal Specialist]

I don't know if it will be a problem or not. I would have to think so but you never know.

I am here most days so I am not on hold. Some people simply just stop responding all together. I don't let it bother me.

OK evilfantasy, will just keep riding it out AND WILL NOT STOP RESPONDING.  Repairing a sick computer and learning a wealth...too irresistible for this old (SENIOR) Tech.

Dan

Hi again evilfantasy,

Keri got to download SP2 on disk and now I have it. (20 minutes vs 36 hours on dial-up.)

I HAVE INSTALLED IT and allowed ALL suggested options.   Microsoft (in terms of ID numbers,) is on hold as they haven't replied to the fact that SP2 is installed.

FOR THE RECORD, I now have SP2 on disk and would gladly share it with anyone in my situation (can't wait 4 to 6 weeks for MS to ship disk.)

I will read back the posts and proceed as per posts unless you offer further suggestions.  My phone will be tied for the next few hours however, I will check back here when I can.

Thanks so much,

Dan and Ker
i


 

[Malware Removal Specialist]

Glad to hear you are up to date!!!

Post a new Hijackthis log and lets see what all is still wrong - if anything.

Hello evilfantasy,

Here is my new Hijack log.

These are the parameters I selected prior to running the scan.

Off line: Yes
Shut down all protection: Yes (that I found)
Close all programs: Yes (except for HP Organizer)

Question(s)?  It took 10:20 (minutes/seconds) to bring up a usable screen.  Is that normal for XP? (I've not used XP before.)

She (Keri) has 91 Icons on her screen ( including 15 to 20 of mine for OUR labors.)  Again, does that sound normal?

Perhaps we can discuss this  "issue" after Her (Keri's) computer is completely clean?

She is currently using 12.8 GB of 30.2 GB (C drive, with 4.58 GB Sector  allocated to recovery on "D Drive.") with a Celeron 2.50 GHz (2.49 GHz) CPU and 2.48 MB RAM.  Could the processor or the small RAM be slowing things down?

Scan is in the attachment.

Evilfantasy.  I want to thank you  so much from the bottom of my heart, not only for sustaining this conversation,  also for the wealth of knowledge YOU HAVE GIVEN ME.  Some would say that at 60, "YOU'RE OVER THE HILL."  Well, I'm not!  New ventures find me every day.  Computer Virus etc. is only one and... to make contact with you (your knowledge today, my knowledge yesterday...not being sequential yet, in somewhat parallel) is a new development for me.

I will mail you privately about some thoughts I have.

Thanks for everything,

Dan (and Keri)



[recovering space - attachment deleted by admin]

[Moderator]

EF is one of our Resident Heroes here and it's nice that you recognised his efforts with your kind comments.

patio.

Hi,

I'm not sure my "log" got transmitted. so here it is , maybe a second time.

Dan


[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

No problem on the help. I took an interest in malware removal and this has been a good challenge. So we are actually helping each other.

Lets do some cleanup right now. Any logs or programs left on the desktop can be deleted after this step (if they are still there)

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

.

.
The above procedure will:

• Delete:
• ComboFix and its associated files and folders.
• VundoFix backups, if present
• The C:\Deckard folder, if present
• The C:_OtMoveIt folder, if present

• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

.
Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Now to start over with CF. It's been long enough that we would need to download an updated copy anyway so it's removal was necessary.

Please download Combofix by sUBs from one of the below links.
(Try all three if necessary)

• Link #1
  
• Link #2
  
• Link #3

Important! Combofix.exe MUST be saved to and ran from the Desktop.

• Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
• Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
  • Click this link to see a list of security programs that should be disabled and how to disable them.
    
  • If yours is not listed and you don't know how to disable it, please ask.
• Warning: Combofix disconnects your computer from the internet. The connection is automatically restored before Combofix completes its run.
  
• Double click combofix.exe & follow the prompts.
• Choose Yes to accept the Disclaimers.[

• When finished, it will produce a log for you.
• Post that log in your next reply.

Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall

• If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
  
• Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.

Next post
Combofix log

hi evilfantacy,

Your post was nothing short of "post." (Find the dry humor)

I will follow your directions and post appropriately.

Oh,... I LIKE A CHALLENGE TOO AND THIS IS CERTAINLY ONE FOR ME!

THANKS FOR NOT making me feel like an ah....

New post coming soon.

Dan
   

Hi evilfantacy,

Just a note (reply not required) concerning the SP2.  MS is now referring my problem to a "higher level" in an attempt to figure out why (with SP2 installed) the computer is still trying to download updates which are part of SP2.  I still think its the ID problem...

Well, I'm on wait for them another 72 hours.

I just wanted to touch base and let you know I didn't die.

Dan
 

Hello evilfantacy,

Been a while.  I have finally been able to get ALL Microsoft Critical Updates installed (one at a time basis) and to the best of my knowledge a good install on XP2.  Advised Microsoft of this about an hour ago.  I think I am done with them but NOT positive.

I will proceed with your instructions in "reply 55" (two or three above this) unless you advise me to do something differently or wait for a Microsoft response?

I'll hold lose in the meantime.

Thanks again,

Dan

[Malware Removal Specialist]

Lets start with a fresh Hijackthis log.

How is the computer acting now?

Computer is acting much better...NO "POP-UPS" AT ALL.  Startup is very slow but once running, everything seems to be running faster.

Here is the new Hi-Jack Log "hijackthis9.txt"


dan


[recovering space - attachment deleted by admin]

[Malware Removal Specialist]

Go to www.java.com and install the latest version of Java. Then go to add/remove programs and uninstall MSJava.

----------

Please download Malwarebytes' Anti-Malware (MBAM) to your desktop from either of these two links.

• Link 1
  
• Link 2

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to
• Update Malwarebytes' Anti-Malware
  
• Launch Malwarebytes' Anti-Malware

• Click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad.
• Please  copy and paste the log into your next reply

Note: If you accidentally close the log it can be retrieved at any time from the Malwarebytes' Anti-Malware main screen.

• Launch Malwarebytes' Anti-Malware.
• Click the Logs tab.
  
• Double-click log-mm.dd.yyyy [xxxxxx].txt

Hi,
I've installed the Java but not sure on the removal.  Don't see aMS Java, is that Java 2 Runtime Environment, SE v1.4_02 and Java Web Start?
db

[Malware Removal Specialist]

Yes, both of those should be uninstalled.

Ok, both are removed.  I have Malwarebytes' Anti-malware on desk top from prior install.  Will a new download overwrite the old or should I remove the old first? 

[Malware Removal Specialist]

Just use the same one. Be sure to check for updates before running it.

Hi evilfantacy,

Sorry for the delay...had to get some other things done.

Here are the results from Malwarebytes' Anti-maleware.

Malwarebytes' Anti-Malware 1.11
Database version: 707

Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 125313
Time elapsed: 1 hour(s), 29 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) ->

Quarantined and deleted successfully.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) ->

Quarantined and deleted successfully.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) ->

Quarantined and deleted successfully.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) ->

Quarantined and deleted successfully.


db

[Malware Removal Specialist]

I think you are in the clear. How is everything now?

Hi evilfantacy,

Lost my reply, will start again.

I too thought it looked good.

Here is what I have on "cold start-up."

2:15 (min : sec) "Welcome"
3:00 to be beginning of icons
11:30 to usable screen (after all icons and the HP (Hewlett Packard) screen

There are 104 icons on her (Keri's) screen, most will be be taken off.

Perhaps she doesn't have enough RAM (only 248 MB.)  Her Processor is Celeron 2.5 GH with a 30.2 GB HD and 17.xx GB Free Space.

There are absolutely NO pop-ups, and although a little sluggish in making access to home nested programs, it fares a decent rate of speed on accessing the net and sites.  Again, I am on dial-up.

If you would respond to those items, I would appreciate that.

Question(s):  I've only installed "Spyware Doctor (the free version) which   only (as I am lead to believe by them) will protect in "real-time" until I subscribe.  Is that program any good?

If so, using it for the purpose of "real-time" protection (the "Free" protection,) and used in conjunction with the free "Malwarebytes' Anti-malware" for "removal" purposes and in conjunction with AVG Anti-virus and aong with a firewall from Mozilla (Thunderbird Mail Client,) would this be a good protection?

If you would answer that I would like it very much.

Lastly on the questions of this nature, should I go ahead with  a previous post of yours (Posted on: April 05, 2008, 03:28:57 PM) and follow the steps which will finally set a new "Restore point?"


Enough technical.

Me and Keri can't thank you enough for all that you have done.  One other fine person stepped in and although I do not have that person's name in front of me, I will locate it and Keri and myself will thank you both more properly.

I had looked through this site for a means of making a donation.  Perhaps I just missed something.  Would you advise as to that possibility?

I'll ask one more thing.  We would like to send you a private mail (I know I can do that but I do like to ask first.)  You might find it interesting and what we have in mind may one day be quit a keepsake.  The mail will describe.

Computer Hope...the SALVATION for the masses who have finally tired of those "hope-to-be" (every Tom *censored* and Harry) "computer repair technicians" who only have one goal in mind.  Rape the customer, reap the profit.  As I had mentioned much earlier in our "posts," I have been in this business since 1978 (probably before many who read these post were born.)  Although I don't do much of this now, I have always treated my customers with respect and honesty.  Computer Hope and the technical support team such as yourself and all who are associated (I have read many of the other posts in all areas) display a professionalism and knowledge base which I have always demanded from my valued employees.  AND YOU FOLKS DO THIS OUT OF THE KINDNESS OF YOUR HEARTS!  Funny thing is that many of those "want-to-bes'" haven't the slightest idea as to what they are doing.

MAY COMPUTER HOPE LIVE FOREVER!

Looking forward to a response.

All best wishes,

Dan F. Blanar (and Keri Whittle)
CEO, DanMar GP.
   

       

[Malware Removal Specialist]

The protection you have in place now sounds like it is a good mix of protection and will serve well.

Try running MemTest 3.6 - http://majorgeeks.com/MemTest_d350.html
MemTest Directions - http://hcidesign.com/memtest/manual.html
Just follow the directions. The longer you can let it run the better.

As far as donations I have asked this question to the site owner (Nathan) and here is his response.

Please refer users who're wanting to donate to the below link:

Send me a PM from here and I will be glad to exchange emails with you. I only wish that we could have gotten the PC running faster by now. Maybe MemTest will reveal something. More RAM will certainly be beneficial though.

Talk soon, Kevin.

Thanks evilfantacy,

I'm awaiting a call from  Keri at this time so will run that test after I hear from her.

As to hopes of having completed sooner, please keep in mind that I had to deal with Microsoft and that took a whole lot of time.  We were going top gun if you remember.  We had it down until SP2 and the ID problem.

By-the-way, I did get a "clean bill of computer health" from Microsoft FINALLY!

THEY DID SOMETHING AND ARE NOT TELLING.

In RE; donations, did not find Nathan's response.  If it was the "Quote from...link" here is what I got "The topic or board you are looking for appears to be either missing or off limits to you."

Personal mail, I will initiate from here to start.  I guess that is what you meant (PM.)

Thanks,

db

[Malware Removal Specialist]

Here is the quote from Nathan. I messed up the first one.

Please refer users who're wanting to donate to the below link:

http://www.computerhope.com/issues/ch000586.htm

Although I've accepted donations in the past I originally created Computer Hope to help users and not make millions. The money I make from Google is enough to support me and Computer Hope and keep the site free without the need of donations.

As for the PM I was referring to a Private message from this forum. Click the under my user name and it will take you to the PM section and you can send from there.

Thanks evilfantacy,

Had a PM ready for you but timed out and it got lost.  Will do it again in Word and paste and send.

Will follow Nathan's instructions and help the site in a different way.

Should I proceed with the new "restore point" by following the earlier steps?

Mail to you coming soon I hope.

db

[Malware Removal Specialist]

Yes I think a new restore point would be advisable at this point.

I have had a few timeout problems on here tonight as well so I know how you feel Will await the mail.

Hi evilfantacy,

I ran the "Mem Test 3.6 for six and one half hours with "0" errors.  I will let it run all night and use Keri's computer while it is running.  I do believe she could use some more memory.

I will reset the restore point on her computer.

a "PM" is on they way.  If I can send it as an attachment, I will.  If not, I will copy and paste.

Thanks for the wonderful job you have done.  I hope that anyone who reads these "posts" and utilizes your services will (regardless of their stature) understand that you are the "Pro" and you can and will resolve their issues regarding this forum.

db10
Dan

Thanks!

Hello evilfantacy,

I have been running the Mem" test on Keri's computer for the last 20 hours.  All is fine.  Zero errors.  I will get her some more memory.  I believe this once very sick computer has now come back to life, thanks to you.

I sent you a long PM.  I hope you got it.  If not, please let me know.

Dan

[Malware Removal Specialist]

Yes I think more memory will help to improve the performance.

Haven't received the PM.

Thanks evilfantacy.

The memory is a must.

I am re-sending the PM (it is a copy and paste from MS Word.)  If it doesn't go thru this time perhaps you could e-mail me at dfblanar@cloud9.net and I will do a reply that way.

Thanks for all you have done,

Dan and Keri
 

evilfantacy,

PM has been sent again.  Please advise if you did  or did not recieve it.

db10