Computer Hope
Software => Computer viruses and spyware => Topic started by: familyfun on January 08, 2010, 08:05:43 AM
-
Hello. I have a problem with my computer fan running loud all the time. I searched the problem on your site and went through all the malware steps. First removed 2 programs, wild tangent and the logitech messenger service. Then removed my spybot program. I had Symantec but it would no longer update due to an error, so I removed symantec and installed avast. I went through all the other steps you suggested and now have the log reports for you to check, if you will. The main problem I've had is a slow, glitchy computer, that the fan runs loud all the time. If the fan stops running loud, sometimes the computer will just shut off. The computer also does not want to come out of screen saver / sleep mode, so I changed the settings to be on all the time, ugh. But the loud fan is the main problem. Any ideas? Thanks so much for your help!!
[Saving space, attachment deleted by admin]
-
Have the fans always been loud / when did it start happening?
Alan <>< :D
-
it's been loud for several weeks... and when it stops being loud sometimes it will shut off. (Loud enough that I need to turn it off if I'm not using it...) any ideas? I ran all the malware suggestions and there were some things that had to be removed, but I don't think I'm done with that yet (sent the logs already). But it is still loud.
-
the fan noise has nothing to do with the virus forum please ask the question in the hardware forum
but you have a number of issue's in your pc that a malware expert will help you with so please do not do
anything and wait for one to come along
-
Hello familyfun and welcome to Computer Hope Forum. My name is Superdave but you can just call me SD. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
Open HijackThis and select Open the Misc Tools section. Select open process manager. select
C:\WINDOWS\ALCMTR.EXE
C:\WINDOWS\SHINE.EXE
and click on kill process. To select more than one process, hold down the CTRL key while selecting.
Close HJT
Click Start. My Computer.
Select the Tools menu Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.
Click Start, Search, select All Files and Folders. Copy and paste
C:\WINDOWS\ALCMTR.EXE
C:\WINDOWS\SHINE.EXE and click search. Delete these files.
NOTE: You will have to do each file separately
Please go to Jotti's malware scan (http://virusscan.jotti.org/)
(If more than one file needs scanned they must be done separately and logs posted for each one)
* Copy the file path in the below Code box:
C:\WINDOWS\pacificService.exe
* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.
Download Disable/Remove Windows Messenger (http://www.majorgeeks.com/DisableRemove_Windows_Messenger_d2327.html) to the desktop to remove Windows Messenger.
Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.
Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.
Exit out of MessengerDisable then delete the two files that were put on the desktop.
Open HijackThis and select Do a system scan only
Place a check mark next to the following entries: (if there)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=:;gopher=:;http=:;https=:;socks=:
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Tiger] C:\WINDOWS\SHINE.EXE RUN
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
(Description: Intel hotkey applet. Unnecessary. Removing this will free up a small amount of system resources.)
O4 - HKLM\..\Run: [TkBellExe] \"C:\Program Files\Common Files\Real\Update_OB\realsched.exe\" -osboot
(Description: RealPlayer scheduler. Completely unnecessary. Removing this entry will free up a small amount of system resources.)
O4 - HKLM\..\Run: [Reminder] \"C:\Windows\Creator\Remind_XP.exe\"
(Description: Subscription reminder to unlock unkimited use for SoftThinks CD Creator CD/DVD rewriting software, usually supplied with HP PC's as a pre-installed package. Unnecessary. Removing this will free up a small amount of system resources. )
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] \"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\"
(Description: Adobe reader startup - unnecessarily uses system resources.)
O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Java\jre6\bin\jusched.exe\"
(Description: Sun Java update scheduler. Checks for updates. Not necessary. Removing this entry will free up a small amount of system resources.)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
Important: Close all open windows except for HijackThis and then click Fix checked.
Once completed, exit HijackThis.
Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.
link # 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
link #2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.
Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.
Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts.
Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.
NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.
Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.
-
Thanks so much for your help... I have started your instructions and am to the part where I need to search for the 2 different files. I deleted the first fine, but when I tried to delete the shine.exe file, it will not let me delete it. Error message says access is denied...make sure the disk is not full or currently in use, etc. The other file of shine. deleted fine. Any ideas?
-
Just skip it and do the other stuff. We'll get it another way.
-
OK, I finished all the steps... and attached the new logs. Here is the link for jotti's http://virusscan.jotti.org/en/scanresult/8d51297fdab5e5a8b5415bd59cf67a2ed95e046c
I also have a new error message which I don't know what it means or if it's important, (sorry for more stuff, but this is why I'm here!!)
ASSERT FAILED\PRojects\wtKernel\src\win32\cm\Core\cmCore\Module.cpp:9om_Codehandle !=NULL
and the application error comes up as this... ddcmigrate.exe says it "failed to initialize properly"
(oX80000003)
Thanks for all your help!!!!!!
[Saving space, attachment deleted by admin]
-
Don't worry about that error. I believe it's related to WildTangent which will be removed. There is evidence of Norton Anti-Virus left on your computer. Here's a tool to remove all of it.
Download the Norton Removal Tool (SymNRT) (http://fileforum.betanews.com/detail/Norton-Removal-Tool-for-Windows-2000XPVista/1169144666/1) to your desktop.
Once downloaded please close ALL open browsers, also save any work because this may require a restart.
* Go to your desktop and double click on the 'Norton_Removal_Tool' and then click Setup.
* Once open Click Next
* Accept the license agreement and click Next
* Type in the letters/numbers that you see into the text box then click Next.
* Then click Next and the tool will start running.
* Once finished restart the PC.
* Delete the 'Norton_Removal_Tool' from your desktop.
1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C
KillAll::
Folder::
c:\program files\WildTangent
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Tiger"="-
3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!
(http://i154.photobucket.com/albums/s258/evilfantasy69/CFScript-1.gif)
ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.
Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze
-
OK... I did all the steps and have attached the log report from combofix. Thanks again and I'll wait for your next instructions!
[Saving space, attachment deleted by admin]
-
I really messed up that script. Let's try that again.
1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C
KillAll::
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Tiger"=-
3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!
(http://i154.photobucket.com/albums/s258/evilfantasy69/CFScript-1.gif)
ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.
Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze
-
Ok...I ran the combofix as instructed and attached the log. (combolog2.txt) And I not really worried about a messup! You're still the pro... Thank you for helping!!
[Saving space, attachment deleted by admin]
-
You're still the pro
If only you knew!! I'll be back as soon as I figure out this log.
-
What does "pacificservice" mean to you? Everything points to this file being infected but I want to make sure before I delete it.
-
I have not heard of it before... but if it's bad, it needs to go right?
-
Please go to Jotti's malware scan (http://virusscan.jotti.org/)
(If more than one file needs scanned they must be done separately and logs posted for each one)
* Copy the file path in the below Code box:
C:\WINDOWS\pacificService.exe
* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.
-
Did I already send this back to you? Scary that I can't remember! Sorry, here are the results again if you already got them...
File size: 400384 bytes
Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5: 242d3b0c1e483a5d7c6fca57fa9e1698
SHA1: d8cc1422d73496d02c1379a63c2da033e0c255b 4
http://virusscan.jotti.org/en/scanresult/68ad293161ca8c56638dc3c835bce8a6a9efb7b9
-
Did I already send this back to you? Scary that I can't remember!
You're correct. This infection is driving me around the bend. We're going to try something else.
Click Start, Search, select All Files and Folders. Copy and paste
C:\WINDOWS\pacificService.exe and click search. When you find this file, right-click on it and rename it to pacificService2.exe
If this file is necesary, we then can get it back. If not, we will delete it later. I don't want to delete it until I'm sure it's not used for something. If you get a message that you can't rename it, go to "Safe mode" and then rename it.
Here's (http://www.computerhope.com/issues/chsafe.htm) how to get into Safe Mode.
1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C
KillAll::
Folder::
c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Wildtangent
c:\windows\wt
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tiger"=-
3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!
(http://i154.photobucket.com/albums/s258/evilfantasy69/CFScript-1.gif)
ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.
Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze
-
Ok. I renamed the file and ran the combofix. There were actually 2 files that come up when you search:
pacificservice.exe which is 391 kb and also
PACIFICSERVICE.EXE-062AA009.pf
which is located in windows\Prefetch and is 9kb. Don't know if that's important but they are both there. I renamed both with a 2.
Here is the log. Hopefully this "challenge" is fun and not too much of a pain...
I do really appreciate all your help!!
[Saving space, attachment deleted by admin]
-
Internet Explorer's security is based upon a set of zones. Each zone has different security in terms of what scripts and applications can be run from a site that is in that zone. There is a security zone called the Trusted Zone. This zone has the lowest security and allows scripts and applications from sites in this zone to run without your knowledge. It is therefore a popular setting for malware sites to use so that future infections can be easily done on your computer without your knowledge as these sites will be in the Trusted Zone. Therefore, I recommend that nothing be allowed in the trusted zone. If you agree, please do the following.
Open HijackThis and select Do a system scan only
Place a check mark next to the following entries: (if there)
Trusted Zone: chase.com\www
Trusted Zone: evenue.net\pleasehold
Trusted Zone: fortunerep.com\www
Trusted Zone: gamespot.com\www
Trusted Zone: militaryhistoryonline.com\www
Trusted Zone: mlb.com\arizona.diamondbacks
Trusted Zone: yahoo.com\login
Trusted Zone: yahoo.com\sports
Important: Close all open windows except for HijackThis and then click Fix checked.
Once completed, exit HijackThis.
ESET Online Scan
Scan your computer with the ESET FREE Online Virus Scan (http://eset.com/onlinescan)
* Click the ESET Online Scanner button.
* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.
* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.
In your next reply please include the ESET Online Scan Log
-
OK. I did the HijackThis scan and of the 8 choices to check mark, the first six were there, so I check marked them and ran the fix. Then I ran the ESET scan and it came back with 6 infected files; and then it looked like they were cleaned. I've attached the report from ESET.
Just to note... the P: drive is an external hard drive where I store photos and videos. There were 2 infected files on this drive in a "Windows OneCare Backup" folder that for some strange reason is on the P: drive. There is an empty folder in Programs called Windows OneCare Backup, (no files or folders in it), suggesting that some how those files got moved to the external hard drive (and I have no clue on that one). So... is this OneCare Backup important? Or can I get rid of it? Or is it useful to me and I didn't even know it?
And thank you again! You are doing a terrific job!!
[Saving space, attachment deleted by admin]
-
"Windows OneCare Backup" is a product of MicroSoft and somehow was installed on your computer and was probably set to run the backup to your external drive. Do you have it on your computer? Here's (http://onecare.live.com/standard/en-gb/prodinfo/backuprestoredetails.htm) some information about OneCare Backup.
-
The Windows OneCare Backup shows up under start / programs, but it is empty; and it does not show up on my add or remove programs list. Another actual OneCare folder, full of files and folders, mostly zip files, is on my external hard drive. Should I move it off my external hard drive and put it back under programs on my computer? Or???? And if it had 2 infected files, does that mean it has been backing up my files? Or can the program itself have infected files?? Sorry, this area is unfamiliar to me...
And I'm not quite sure why I have OneCare /or where I got it... Thanks for your help and any recommendations / suggestions!!!
-
Windows OneCare was MS's attempt at an Anti-Virus program which then evolved into MicroSoft Security Essentials. I think they have given up on updates for OneCare. If you don't need it, then you should uninstall it and also delete it from your external drive. Here's (http://Windows OneCare was MS's attempt at an Anti-Virus program which then evolved into MicroSoft Security Essentials. I think they have given up on updates for OneCare. If you don't need it, then you should uninstall it and also delete it from your external d) a free backup program I found on Bleeping Computer so I know that it's safe:
According to this link (http://onecare.live.com/standard/en-gb/purchase/default.htm) it may be still available to existing subscriptions.
1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C
KillAll::
Folder::
c:\documents and settings\brocks kool lil sis\Local Settings\Application Data\Wildtangent
3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!
(http://i154.photobucket.com/albums/s258/evilfantasy69/CFScript-1.gif)
ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.
Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze
It looks like renaming those two pacificservice files did the trick. If your computer is running well without them, go ahead and delete them. You may have to do it in "Safe Mode"
-
OK, I deleted the 2 pacificservice files and nothing crashed so I'm looking good and you are doing a great job!!
I ran the repair and attached the report for you. Quick question... the link for the free backup program from Bleeping Computers wouldn't work for me, could you send it again when you get a chance.
Thanks so much!!!!!
[Saving space, attachment deleted by admin]
-
Your log looks good. If there are no other issues, it's time for some cleanup. You can uninstall HJT & ESET but you can keep SAS and MBAM. Update them and run them about once a week depending on your internet activity.
Here's (http://www.educ.umu.se/~cobian/cobianbackup.htm) the correct link for the backup.
* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /uninstall in the runbox
* Make sure there's a space between Combofix and /Uninstall
* Then hit Enter
* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
----------------------------------------------------------------------------------------------
Clean out your temporary internet files and temp files.
Download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop.
Double-click TFC.exe to run it.
Note: If you are running on Vista, right-click on the file and choose Run As Administrator
TFC will close all programs when run, so make sure you have saved all your work before you begin.
* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.
Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
----------------------------------------------------------------------------------------------------
Looking over your log it seems you don't have any evidence of a third party firewall.
Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.
Remember only install ONE firewall
1) Comodo Personal Firewall (http://www.majorgeeks.com/Comodo_Personal_Firewall_d5033.html) (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor (http://www.majorgeeks.com/Online_Armor_Free_d4872.html)
3) Agnitum Outpost (http://www.majorgeeks.com/Outpost_Firewall_Free_d1056.html)
4) PC Tools Firewall Plus (http://www.majorgeeks.com/PC_Tools_Firewall_Plus_d5470.html)
If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
-----------------------------------------------------------------------------------------
Use the Secunia Software Inspector (http://secunia.com/software_inspector) to check for out of date software.
•Click Start Now
•Check the box next to Enable thorough system inspection.
•Click Start
•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------
Go to Microsoft Windows Update (http://windowsupdate.microsoft.com/) and get all critical updates.
----------
I suggest using WOT - Web of Trust (http://www.mywot.com/). WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer (http://www.bleepingcomputer.com/forums/tutorial49.html) from Spyware and Malware
* If you don't know what ActiveX controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. (http://www.safer-networking.org/en/spybotsd/index.html) Guide: Use Spybot's Immunize Feature (http://www.bleepingcomputer.com/tutorials/tutorial43.html#immunize) to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ (http://www.safer-networking.org/en/faq/index.html)
Check out Keeping Yourself Safe On The Web (http://evilfantasy.wordpress.com/2008/05/20/keeping-yourself-safe-on-the-web/) for tips and free tools to help keep you safe in the future.
Also see Slow Computer? It may not be Malware (http://evilfantasy.wordpress.com/2008/05/24/slow-computer-it-may-not-be-malware/) for free cleaning/maintenance tools to help keep your computer running smooth.
Safe Surfing!
-
First off thank you again for all your help!!! The computer is doing much, much better!! I just have a couple of last questions... when I try to uninstall HJT is tells me that it will remove HiJackThis settings from the registry and exit but that I will have to delete the HiJackThis.exe file manually. Are those files actually the sniper.exe files? And can I just delete them? Or how do I do it manually?
Also, the Windows OneCare Backup is on the P:\ drive (external). It will not let me delete it. This is the message. DO_NOT_DELETE.globalCatalog: Access is denied. Make sure the disk it not full or write protected and that the file is not currently in use. Any ideas on how to be able to delete this file? I would like to get rid of it.
Thanks again!!!
-
when I try to uninstall HJT is tells me that it will remove HiJackThis settings from the registry and exit but that I will have to delete the HiJackThis.exe file manually. Are those files actually the sniper.exe files? And can I just delete them? Or how do I do it manually?
Proceed with the uninstall then go to C:\Program Files, Trend Micro and delete this folder.
Also, the Windows OneCare Backup is on the P:\ drive (external). It will not let me delete it. This is the message. DO_NOT_DELETE.globalCatalog: Access is denied. Make sure the disk it not full or write protected and that the file is not currently in use. Any ideas on how to be able to delete this file? I would like to get rid of it.
You can try deleting it in "Safe Mode" or you can download Unlocker (http://download.cnet.com/Unlocker/3000-2248_4-10493998.html), install it and then delete it again. Unlocker will kick in and you should be able to delete it now.
-
Where do I go to find the Trend Micro folder? If I search, I get over 500 results with C:\Program Files, Trend Micro...
Thanks!!
-
OK, sorry. One more thing... I ran the Secuna scan and got a list of updates needed and did that fine except the Adobe Reader 8.x update gets an error about half way through the install (Error 1402, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OtionalComponants\MSFS)
The bigger thing is I got this list of missing things from Microsoft, but when I open the update window and click on the express or the custom update it checks my computer and then I get an error:
The website has encountered a problem and cannot display the page you are trying to view. The options provided below might help you solve the problem.
The error is 0x80240030 error. And it gives you 2 solutions to try, which I didn't have luck on either of them. Is this a problem with my computer or microsoft and can I fix it? Any suggestions would be great!!!
Thanks!!
-
Where do I go to find the Trend Micro folder? If I search, I get over 500 results with C:\Program Files, Trend Micro...
Do it in Windows Explorer. Start, My Computer, click on the C: drive. Look for Program Files, Trend Micro and delete the folder.
The error is 0x80240030 error. And it gives you 2 solutions to try, which I didn't have luck on either of them. Is this a problem with my computer or microsoft and can I fix it? Any suggestions would be great!!!
Thanks!!
Check this link (http://support.microsoft.com/kb/915170) for that error.
Adobe Reader 8.x update gets an error about half way through the install (Error 1402,
Here's a link (http://kb2.adobe.com/cps/329/329137.html) to help with the above error.