trying to make sure my computer is clean

[willderphil]

I am doing the steps to get rid of virus malware and im on step one where you remove programs and just wondering if some of these things are bad or needed? It's my wife's computer so I am not really sure what this all is so i'm puttin in stuff that sounds legit just to make sure.

Browser address error redirector
conexant ac-link audio
gtw_logo
metaframe presentation server web client for win32
MSXML 4.0 sp2 (KB927978)      (2 others like this with different kb number)
soft data fax modem with smartCP
webIQ Technology Engine

thank you for the help

[willderphil]

ok the reason im doing this is here http://www.computerhope.com/forum/index.php/topic,91400.msg620978.html#msg620978 so anyways i was able to do step 2 on the steps but when i tried to do step 3 when trying to install SUPERAntiSpyware from my flash drive I get this "the windows installer seervice could not be accessed. this can occur if you are running windows in safe mode" (I'm not), "or if the windows installer is not correctly installed. Contact your support personnel for assistance."

[Karnac]

Try rename the programs and run them in safe mode if you can....if there's a problem, make note, and go to the next step.

[willderphil]

ok tried renaming it and trying to install same result except it looked like it was going to go this time instead of saying that right away and in safe mode when tried with a different name got this "the system administrator has set policies to prevent this installation. so i went on with the rest. So I accidentally did a full scan with the malwarebytes but if there was something you guys needed to see in the log of the quick scan I did one afterwards but it didn't pick up anything cause they were all ready gone. and the new version of java said it needed the internet to install so i skipped that but i did clean out the old version and then i did the HJT and have that log for you guys too.  Thank you guys for all the help. I'm going to sleep now that it is early morning check back tommorrow.

[attachment deleted by admin]

[Karnac]

willderphil,

Here is the link for your HJT analysis......

http://www.computerhope.com/cgi-bin/process.pl?o=137213

Follow these directions for cleaning, and let us know how the PC is running.

[harry 48]

91.212.65.122 spywar... , remove this from your hjt log , it would stop you getting into programs

mbam looks good and clean

[willderphil]

ok i did what you guys said but I still have no internet and SAS still wont install and I also cant turn on windows firewall (windows cannot start the windows firewall/internet connection sharing service.) here are the new logs that I did too.

[attachment deleted by admin]

[harry 48]

both logs are clean , can you download sas to a memory stick and run on the pc , and post the log here

[harry 48]

go to add and remove and delete sp3 you will find sp2 works better

if you ran all the security and your anti-virus and it found nothing then its clean

if you have sas in the pc rename the file and try it

[harry 48]

http://majorgeeks.com/downloadget.php?id=4783&file=1&evp=ef9669e4f16e6e75d95abcde8f88163d

try this let it remove what it finds and then reboot , lets know what happens

[Karnac]

willderphil,

Don't remove any servicepacks, there are still issues in HJT, .... evilfantasy will have to assist you.

[harry 48]

willderphil,

Don't remove any servicepacks, there are still issues in HJT, .... evilfantasy will have to assist you.

what are they karnac please

[willderphil]

ok i ran the other thing you guys said and it found quite a few more things to get rid of but i am still having the problems.

[Karnac]

willderphil

Evilfantasy or SuperDave will have to assist you from here on.....you may need specialized tools if you're still having problems.

[CBMatt]

Just so you guys know, you are only making this more difficult.  Especially you, Harry.  When someone is having infection issues, you do NOT tell them to uninstall a service pack!  In fact, there's no reason to even do so with a clean computer.  SP3 is much more secure than SP2 and telling someone to install it for no reason whatsoever is idiotic.  And you are NOT qualified to tell someone to remove HijackThis entries!  You have no idea what you are doing.  Certain things need to be removed in certain ways and if you don't do it properly, you can make the problem much worse.  If you want to help, feel free to instruct people on how to run scans and post logs.  Once they've done that, your job is done.  Next time you want to do this, get some training.  If we're lucky, you may have not caused damage in Phil's computer.

You also need to read this: http://www.computerhope.com/forum/index.php/topic,69848.0.html

Just so you know, when a topic has multiple threads, we normally don't open it because we assume the person has been helped because of the large amount of traffic coming through here.  Making all of these unhelpful posts and then telling a person to wait for one of us is only hurting their chances of getting help.  The only reason I even looked at this thread is because I saw that one of you had posted, which meant that something probably wasn't right.







Now...
willderphil, I apologize for the unqualified "help" that you have received here.  Harry's "advice" is very confusing and unprofessional at best, so it's difficult to know what the current state of your problem is, but I hope we can still help you out.  To get started, I would like to see a ComboFix log.

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.