Unable to install Superantivirus during "read this before..."

[pineapplejeani]

Hello all,
I'm so grateful I found this forum. A little background: I'm trying to help my mom's computer.  According to her it's been acting up for a "while"--that could mean months??  I finally got her to bring it to me so I could run some spyware and antivirus programs for her (getting her to do it is useless--she says she's been doing it but her last update was in 2006!)

It's a Dell Intel Celeron 2.53GHz w 256RAM running Windows XP pro w/ SP3

She was running some program called ErrorSmart which was giving her error messages.  She says whenever she did what it asked her to do it wouldn't correct anything.  I'm not familiar with that program so i just clicked cancel when it tried to run at start-up.

I downloaded the new version of Spybot Search and Destroy (waited for restart to run)
I downloaded the  new version of Ad-Aware (waited for restart to run)
I downloaded and ran Advanced Windows Care V2 Personal.  I "fixed selected problems" then,

I downloaded and ran Avast antivirus which required a start-up.  During the start-up scan it detected multiple viruses, Trojans and malware.  I deleted what I could but there were several copies of win32: patched-cr[trj] that could not be moved/deleted so I ignored.  They are (still) in the following files:
c:\windows\system32\explorer.exe
c:\windows\system32\lsass.exe
c:\windows\system32\services.exe
c:\windows\system32\svchost.exe
c:\windows\system32\winlogon.exe. 
Once it completed I attempted to restart the computer to run more spyware programs...

However windows wouldn't load all the way.  I got the desktop wallpaper and cursor but no start bar and no desktop icons.  I figured out how to start in safe mode so I ran Spybot in safe mode fixed checked items but some items were unable to be fixed:
MyWay.MyWebSearch 6 entries PUPS
FunWebProducts 5 entried PUPS
It asked to run on next system restart which I agreed to.  Again windows wouldn't load all the way so I had to go back to safe mode with networking.

That's when I found your site and started following your directions.  I had already run the Avast, I had already Add/Deleted programs I knew I could.  I downloaded and ran CCleaner.  I was at the next step "Download SUPER antispyware Free Edition" Which I did download but it will not install.  It gives me this error message: The system administrator has set policies to prevent this installation.

So I'm stuck!  Is there hope for this computer?

Thanks in advance,
Jeani

[evilfantasy]

The instructions say:

If for some reason you cannot perform one of the steps, move on to the next step and make note of what happened when posting your logs.

Keep going and post what logs you can.

[pineapplejeani]

Sorry I got as far as "* Important: Work the steps in order.
* If you don't understand a step stop and ask!"  Please forgive my newbie-ness  .

So to pick up where I left off...
I installed and ran Malwarebytes' Anti-Malware (log attached)

The next step Update Java gave me the same error message as with the Superantivirus

The next step says "Please run HijackThis only after the above steps have been completed" So please advise.


[Saving space - attachment deleted by admin]

[evilfantasy]

Need the HJT log now.

[pineapplejeani]

Done...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:56 PM, on 9/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://verizon.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053f9267-dc04-4294-a72c-58f732d338c0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {A057A204-BACC-4D26-C8D9-34E8C3A73BC6} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Google Toolbar Notifier BHO - {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Program Files\IncrediMail\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Search - ?p=ZNxdm824YYUS
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: HP Clipbook - {58ecb495-38f0-49cb-a538-10282abf65e7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Verizon Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: HP Smart Select - {700259d7-1666-479a-93b1-3250410481e8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Mythic%20Mahjong/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinner.com/games/v49/blockwerx/blockwerx.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135355642853
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1210195772159
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Mystery%20P.I.%20-%20The%20Lottery%20Ticket/Images/armhelper.ocx
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O21 - SSODL: mOBMVPuFu - {54D7CE66-FE7D-64CC-4E68-1BAC7401EA05} - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 9091 bytes

[evilfantasy]

Can you get a log from Normal Mode?

[pineapplejeani]

Unfortunately, no. I just tried again and all I get is the desktop wallpaper with a movable cursor but no icons and no start bar etc.

CTRL ALT DELETE doesn't work here either

[evilfantasy]

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
- O2 - BHO: (no name) - {A057A204-BACC-4D26-C8D9-34E8C3A73BC6} - (no file)
- O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
- O8 - Extra context menu item: &Search - ?p=ZNxdm824YYUS
- O21 - SSODL: mOBMVPuFu - {54D7CE66-FE7D-64CC-4E68-1BAC7401EA05} - (no file)

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Download SDFix by AndyManchesta and save it to your desktop.

When using this tool, you must use the Administrator's account or an account with Administrative rights

• Double click SDFix.exe and it will extract the files to %systemdrive%
  
• (this is the drive that contains the Windows Directory, typically C:\SDFix).
  
• DO NOT use it just yet.

Reboot your computer in Safe Mode using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.

• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
  
• When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  
• Copy and paste the contents of the results file Report.txt in your next reply along with a new HijackThis log.

.
----------

Try to get into Normal mode now and let me know if it works.

[pineapplejeani]

I get the blue DOS screen but I can't type Y 

[evilfantasy]

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

[pineapplejeani]

Ran program.  It restarted machine and I have a desktop with a DOS screen.  The DOS screen reads:

Active code page: 1252
Active code page: 1252
Please wait...

It doesn't seem to be doing anything to wait for...

[evilfantasy]

Restart the computer and see if it goes away.

This computer is in bad shape. Do you have an XP CD?

[pineapplejeani]

After I restarted in safe mode again I re-ran the combo fix and came up with a log. 

[Saving space - attachment deleted by admin]

[evilfantasy]

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

Driver::
sysrest.sys

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b085189-d1c1-11dc-ada4-001320c6e1fc}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f72f8fc2-739d-11da-a4a3-806d6172696f}]

3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

[pineapplejeani]

Still need to restart in safe mode

[Saving space - attachment deleted by admin]

[evilfantasy]

I'm not sure whats going on to be honest. Do you have an XP CD?

Download DrWeb CureIt & save it to your desktop.

Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start.
  
• An Express Scan of your PC notice will appear.
  
• Under Start the Express Scan Now Click OK to start.
  • This is a short scan that will scan the files currently running in memory.
  • If or when something is found, click the Yes button when it asks you if you want to cure it.
• Once the short scan has finished, Click Options > Change settings
  
• Choose the Scan tab and UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button.
  
• Then click the Green Arrow Start Scanning button on the right and the scan will start.
  • Click Yes to all if it asks if you want to cure/move any file(s).
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.

• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

[/COLOR]

• After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
  
• Copy and paste that log in the next reply

[pineapplejeani]

I don't currently have the xp cd.  I'd have to ask my mom if she has one but it's 2am here so I can't ask her now .

Should I follow the latest directions even without the cd?

[evilfantasy]

Yes run Dr Web and see if it finds anything else. Once we stop finding malware we can try to figure out why the other functions aren't working. Until the malware is completely gone though there is no use in trying to fix everything else since it may be the malware causing it...

[pineapplejeani]

Thanks for helping me so late into last night (this morning)    Here is the log from Dr Web:


explorer.exe;c:\windows;Trojan.Starter.384;Cured.;
lsass.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
services.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
svchost.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
winlogon.exe;c:\windows\system32;Trojan.Starter.384;Cured.;
ComboFix.exe\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Administrator\Desktop\ComboFix.exe;Program.PsExec.171;;
ComboFix.exe;C:\Documents and Settings\Administrator\Desktop;Archive contains infected objects;Moved.;
SDFix.exe\SDFix\apps\Process.exe;C:\Documents and Settings\Administrator\Desktop\SDFix.exe;Tool.Prockill;;
SDFix.exe;C:\Documents and Settings\Administrator\Desktop;Archive contains infected objects;Moved.;
slgclientservicesredists.exe\data002;C:\My Games\Cake Mania\slgclientservicesredists.exe;Adware.SpywareStorm;;
slgclientservicesredists.exe;C:\My Games\Cake Mania;Archive contains infected objects;Moved.;
F5D3D31D-6F72-4DF2-A411-8B4A24;C:\Program Files\Microsoft AntiSpyware\Quarantine\C05937E8-82D5-4157-A2AD-04A2C3;Adware.nCase;;
Process.exe;C:\SDFix\apps;Tool.Prockill;;
A0013247.dll;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013248.scr;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013249.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.MWS;;
A0013250.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.DownLoader.7028;Deleted.;
A0013258.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013260.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013261.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013262.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Isbar.438;Deleted.;
A0013263.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013264.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013265.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013266.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013267.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.DownLoader.7028;Deleted.;
A0013268.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Funweb;;
A0013269.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013270.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013271.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.MWS;;
A0013272.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013273.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013274.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013275.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013276.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.MWS;;
A0013277.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0013280.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013281.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013282.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0013283.SCR;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Msearch;;
A0015336.DLL;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Adware.Websearch;;
A0018404.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Program.PsExec.170;;
A0019495.EXE;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Program.PsExec.170;;
A0019529.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019530.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019531.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019532.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019533.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Trojan.Starter.384;Cured.;
A0019534.exe\32788R22FWJFW\psexec.cfexe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53\A0019534.exe;Program.PsExec.171;;
A0019534.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Archive contains infected objects;Moved.;
A0019535.exe\SDFix\apps\Process.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53\A0019535.exe;Tool.Prockill;;
A0019535.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Archive contains infected objects;Moved.;
A0019536.exe\data002;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53\A0019536.exe;Adware.SpywareStorm;;
A0019536.exe;C:\System Volume Information\_restore{DCF0417D-1C7C-46DE-A1E1-0C214949EB62}\RP53;Archive contains infected objects;Moved.;

[evilfantasy]

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

• Open the folder and run Dial-a-fix.exe
• 2 windows will open. Close the one in the background labeled Restrictive Policies
• Check the box in section 1, Empty temp folders.
• Check the box in section 2, Fix Windows Installer.
• Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked
• Check all boxes in Section 5, labeled Registration Center.
• Click Go
• OK any error messages if received, but write them down and post them here.
• Restart the computer when done.

.
----------

Download to your desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.

----------

Any luck with Normal mode now?

[pineapplejeani]

dial-a-fix website not working.  I tried from my laptop just to see if it was this machine or not.

[evilfantasy]

Try here http://www.majorgeeks.com/download4899.html

[pineapplejeani]

Should I continue with what I can?  See red below.

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

• Open the folder and run Dial-a-fix.exe
• 2 windows will open. Close the one in the background labeled Restrictive PoliciesDidn't see it
  
• Check the box in section 1, Empty temp folders.OK
  
• Check the box in section 2, Fix Windows Installer.Uncheckable
  
• Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checkedThey're not but I can check the Fix SSL/... box which checks the rest
  
• Check all boxes in Section 5, labeled Registration Center.
• Click Go
• OK any error messages if received, but write them down and post them here.
• Restart the computer when done.

.
----------

Download to your desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.

----------

Any luck with Normal mode now?

[evilfantasy]

Did you get Dial-a-fix from MajorGeeks?

[pineapplejeani]

yes

[evilfantasy]

How about FixPolicies and getting into Normal mode?

[pineapplejeani]

Wallpaper and cursor   

[evilfantasy]

Download to your desktop ISeeYouXP.exe by ShadowPuterDude
Next double-click on ISeeYouXP.exe on your Desktop.
 
ISeeYouXP.exe will self-extract ISeeYouXP to C:\ISeeYouXP and place a .bat file on your Desktop.

Double-click ISeeYouXP.bat to run the script.

Once complete a log will be saved to the Desktop named ISeeYouXP.txt.
           
Post the following logs in your next reply:
ISeeYouXP.txt

If the ISeeYouXP .bat file does not extract to the Desktop. Double-click My Computer on the Desktop and navigate to the ISeeYouXP folder located in the C: drive. Double-click the ISeeYouXP.bat file to run the program.

Upload the file to Savefile.com
There is no need to Register
Select Browse and locate the file.
Fill in the Title and Description and security code then click Upload
Copy the download link next to Your link to the file: and post the link back here.

[pineapplejeani]

Upload the file to Savefile.com  Which file?

Attached  is the ISeeYouXP log

[Saving space - attachment deleted by admin]

[evilfantasy]

Sometimes ISeeYouXP.txt is too large for the forums and needs to be uploaded at SaveFile..

[evilfantasy]

1. Click Start, click Run, type msconfig, and then click OK.

The System Configuration Utility dialog box appears.

2. Click the General tab, click Normal Startup - load all device drivers and services, and then click OK.

3. When you are prompted, click Restart to restart the computer.

Any changes?

[evilfantasy]

There is no malware showing. You are going to have to find an XP CD to try a Repair Install. Do you have one or someone you can borrow it from?

Go to add/remove programs and uninstall:

ErrorSmart
MarketResearch
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar

----------

Delete the following from your Desktop (If they exist)
ISeeYouXP.exe
ISeeYouXP.txt
ISeeYouXP.lnk (Shortcut for ISeeYouXP.bat)

----------

Download OTCleanIt.exe and save it to your Desktop.

• Double-click OTCleanIt.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it yourself.

[pineapplejeani]

I have to go to work now. I think I can get a windows cd from my husbands friend. BUT I have tried to remove programs while in safe mode before (during this process) and I get an error message: ** correction the following error message only occurs with ErrorSmart.  I was able to remove all viewpoints but I dont see MarketResearch

"The Windows Installer Service could not be accessed.  This can occur if you are running Windows in safe mode, or if the Windows Installer is not currently installed.  Contact your support personnel for assistance"

(I just tried again to be sure)

Installing new Windows is the only option now right?

[evilfantasy]

No a Repair install can be tried first.

[pineapplejeani]

I have a desktop with icons!

Welcome to avast! screen is present. Press OK?

[evilfantasy]

And how did this come about?

[pineapplejeani]

I followed the most recent directions:
I removed all viewpoints from add/remove programs
ErrorSmart gave me the error I mentioned
I deleted all ISeeYouXPs you told me to from the desktop
I downloaded and ran OTCleanIt following all the directions
I rebooted when prompted then came to the desktop screen with the avast! window.

I clicked OK.  The avast! screen disappeared but nothing else happened.

Currently, I am able to maneuver the cursor but am not able to click anything. Nor does CTRL ALT DEL work.

[evilfantasy]

So you are back to the Repair install method. If that won't work then a reinstall is all thats left.

[pineapplejeani]

What about the original win32: patched-cr[trj] I spoke about in the following files:

c:\windows\system32\explorer.exe
c:\windows\system32\lsass.exe
c:\windows\system32\services.exe
c:\windows\system32\svchost.exe
c:\windows\system32\winlogon.exe.

[evilfantasy]

Those files have been fixed by Dr Web.

[pineapplejeani]

I'm back

I had some difficulty with the repair install.  I borrowed a Windows XP CD from work but could not figure out how to get to the proper boot screen.  I modified the Bios to select the cd-rom drive first, but it proceeded to go to the desktop/no icon/cursor screen.  In my attempt to proceed I discovered a "Last Known Good Configuration" process--which I performed.

I (slowly) got the desktop icons back and was able to access programs and CTRL/ALT/DEL etc.  I was able to get online as well.    I ran SpyBot - no threats were detected.  I ran CCleaner.  I also started to add/remove programs that I couldn't while in safe mode.  In order to completely remove some of the programs I removed I needed to restart.  When I restarted I couldn't get online. 

Then I decided to start the "read this before..." process in order over again.  I shut down SpyBot and TeaTimer.  I downloaded ResetTeaTimer.zip and ran that.  I ran avast and it found the same win32: patched-cr[trj] in the same files I mentioned before.  It asked me to stop and run a boot time scan--I chose no and quit.  (If you remember that's what happened to cause me to lose the desktop icons before)

Then I ran Superantispyware. It found a few threats.  When the machine restarted I got an error message: Windows - No Disk  Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c.  Then it asks Cancel/Try Again/Continue.  Not sure how to proceed.  Is this because of the Bios I tried to change?

[evilfantasy]

Look here for the error http://www.consumingexperience.com/2007/11/windows-no-disk-exception-processing.html

[pineapplejeani]

Thanks. Renaming the drives worked.

Attached are the logs to check my system.  I'm still not able to get online with that machine.  I'm on my laptop.

**Update  I realized that my router has a timer setting to it and this computer was blocked after a certain time.  I removed the block and IE is so far working fine now

[Saving space - attachment deleted by admin]

[evilfantasy]

Everything lokks OK now.

Download the Norton Removal Tool (SymNRT) to your Desktop.

Once downloaded please close ALL open browsers, also save any work because this may require a restart.

• Go to your desktop and double click on the removal tool and then click Setup.
  
• Once open Click Next
  
• Accept the license agreement and click Next
  
• Type in the letters/numbers that you see into the text box then click Next.
  
• Then click Next and the tool will start running.
  
• Once finished restart the PC and run the tool again to ensure everything has been removed.
• Delete Nortonremoval tool from your Desktop.

[pineapplejeani]

OK I ran that twice like you said.  Seemed fine.

OK Some loose ends to tie up:

I was concerned that avast kept finding this win32:patched-ck [trj] trojan even after all we've gone through, so I uninstalled  the whole program. Restarted and reinstalled again.  When I restarted again, it asked to run a boot time scan--I chose no for now.  Then a flash screen came  up asking for registration, click OK.  When I clicked ok the pc froze.  I restarted.  It froze again after clicking ok.  I restarted in Safe mode and removed avast all together.  I re-ran Dr. Web (which is what you said already removed the trojan) and it came up clear! 

So, I would like to know what antivirus scanner is recommended- one that is going to update itself so she isn't left unprotected again.  I use avast on my own computers but I don't like how it just reacted with mom's.

This next thing is a VERY MINOR problem, but I'd like to get rid of it so my mom doesn't get herself into trouble entering something she shouldn't    When I load windows now, after the black "setup" screen another screen comes on asking me to select Windows XP Professional or Window XP Home edition.  Pro is highlighted and there is a countdown timer that says something like "the highlighted item will be selected in XX seconds or press enter".  How can I bypass that?

How can I re-enable SpyBot Tea timer?

What programs should we run routinely to keep the computer safe. I personally run SpyBot, Ad-Aware, Advanced WindowsCare and avast!  Are they sufficient?

Thanks again for your help.

[evilfantasy]

For Tea Timer go here and do the steps in reverse. http://www.computerhope.com/forum/index.php/topic,63105.0.html

Try Avira AntiVir Personal

When I load windows now, after the black "setup" screen another screen comes on asking me to select Windows XP Professional or Window XP Home edition.  Pro is highlighted and there is a countdown timer that says something like "the highlighted item will be selected in XX seconds or press enter".  How can I bypass that?

Make a post in the Windows forum asking this question.

What programs should we run routinely to keep the computer safe. I personally run SpyBot, Ad-Aware, Advanced WindowsCare and avast!  Are they sufficient?

Yes.

Learn more about how to protect yourself while on the Internet from the following link. So how did I get infected in the first place? by Tony Klien.