Unable to install Superantivirus during "read this before..."

[evilfantasy]

1. Click Start, click Run, type msconfig, and then click OK.

The System Configuration Utility dialog box appears.

2. Click the General tab, click Normal Startup - load all device drivers and services, and then click OK.

3. When you are prompted, click Restart to restart the computer.

Any changes?

[evilfantasy]

There is no malware showing. You are going to have to find an XP CD to try a Repair Install. Do you have one or someone you can borrow it from?

Go to add/remove programs and uninstall:

ErrorSmart
MarketResearch
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar

----------

Delete the following from your Desktop (If they exist)
ISeeYouXP.exe
ISeeYouXP.txt
ISeeYouXP.lnk (Shortcut for ISeeYouXP.bat)

----------

Download OTCleanIt.exe and save it to your Desktop.

• Double-click OTCleanIt.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it yourself.

[pineapplejeani]

I have to go to work now. I think I can get a windows cd from my husbands friend. BUT I have tried to remove programs while in safe mode before (during this process) and I get an error message: ** correction the following error message only occurs with ErrorSmart.  I was able to remove all viewpoints but I dont see MarketResearch

"The Windows Installer Service could not be accessed.  This can occur if you are running Windows in safe mode, or if the Windows Installer is not currently installed.  Contact your support personnel for assistance"

(I just tried again to be sure)

Installing new Windows is the only option now right?

[evilfantasy]

No a Repair install can be tried first.

[pineapplejeani]

I have a desktop with icons!

Welcome to avast! screen is present. Press OK?

[evilfantasy]

And how did this come about?

[pineapplejeani]

I followed the most recent directions:
I removed all viewpoints from add/remove programs
ErrorSmart gave me the error I mentioned
I deleted all ISeeYouXPs you told me to from the desktop
I downloaded and ran OTCleanIt following all the directions
I rebooted when prompted then came to the desktop screen with the avast! window.

I clicked OK.  The avast! screen disappeared but nothing else happened.

Currently, I am able to maneuver the cursor but am not able to click anything. Nor does CTRL ALT DEL work.

[evilfantasy]

So you are back to the Repair install method. If that won't work then a reinstall is all thats left.

[pineapplejeani]

What about the original win32: patched-cr[trj] I spoke about in the following files:

c:\windows\system32\explorer.exe
c:\windows\system32\lsass.exe
c:\windows\system32\services.exe
c:\windows\system32\svchost.exe
c:\windows\system32\winlogon.exe.

[evilfantasy]

Those files have been fixed by Dr Web.

[pineapplejeani]

I'm back

I had some difficulty with the repair install.  I borrowed a Windows XP CD from work but could not figure out how to get to the proper boot screen.  I modified the Bios to select the cd-rom drive first, but it proceeded to go to the desktop/no icon/cursor screen.  In my attempt to proceed I discovered a "Last Known Good Configuration" process--which I performed.

I (slowly) got the desktop icons back and was able to access programs and CTRL/ALT/DEL etc.  I was able to get online as well.    I ran SpyBot - no threats were detected.  I ran CCleaner.  I also started to add/remove programs that I couldn't while in safe mode.  In order to completely remove some of the programs I removed I needed to restart.  When I restarted I couldn't get online. 

Then I decided to start the "read this before..." process in order over again.  I shut down SpyBot and TeaTimer.  I downloaded ResetTeaTimer.zip and ran that.  I ran avast and it found the same win32: patched-cr[trj] in the same files I mentioned before.  It asked me to stop and run a boot time scan--I chose no and quit.  (If you remember that's what happened to cause me to lose the desktop icons before)

Then I ran Superantispyware. It found a few threats.  When the machine restarted I got an error message: Windows - No Disk  Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c.  Then it asks Cancel/Try Again/Continue.  Not sure how to proceed.  Is this because of the Bios I tried to change?

[evilfantasy]

Look here for the error http://www.consumingexperience.com/2007/11/windows-no-disk-exception-processing.html

[pineapplejeani]

Thanks. Renaming the drives worked.

Attached are the logs to check my system.  I'm still not able to get online with that machine.  I'm on my laptop.

**Update  I realized that my router has a timer setting to it and this computer was blocked after a certain time.  I removed the block and IE is so far working fine now

[Saving space - attachment deleted by admin]

[evilfantasy]

Everything lokks OK now.

Download the Norton Removal Tool (SymNRT) to your Desktop.

Once downloaded please close ALL open browsers, also save any work because this may require a restart.

• Go to your desktop and double click on the removal tool and then click Setup.
  
• Once open Click Next
  
• Accept the license agreement and click Next
  
• Type in the letters/numbers that you see into the text box then click Next.
  
• Then click Next and the tool will start running.
  
• Once finished restart the PC and run the tool again to ensure everything has been removed.
• Delete Nortonremoval tool from your Desktop.

[pineapplejeani]

OK I ran that twice like you said.  Seemed fine.

OK Some loose ends to tie up:

I was concerned that avast kept finding this win32:patched-ck [trj] trojan even after all we've gone through, so I uninstalled  the whole program. Restarted and reinstalled again.  When I restarted again, it asked to run a boot time scan--I chose no for now.  Then a flash screen came  up asking for registration, click OK.  When I clicked ok the pc froze.  I restarted.  It froze again after clicking ok.  I restarted in Safe mode and removed avast all together.  I re-ran Dr. Web (which is what you said already removed the trojan) and it came up clear! 

So, I would like to know what antivirus scanner is recommended- one that is going to update itself so she isn't left unprotected again.  I use avast on my own computers but I don't like how it just reacted with mom's.

This next thing is a VERY MINOR problem, but I'd like to get rid of it so my mom doesn't get herself into trouble entering something she shouldn't    When I load windows now, after the black "setup" screen another screen comes on asking me to select Windows XP Professional or Window XP Home edition.  Pro is highlighted and there is a countdown timer that says something like "the highlighted item will be selected in XX seconds or press enter".  How can I bypass that?

How can I re-enable SpyBot Tea timer?

What programs should we run routinely to keep the computer safe. I personally run SpyBot, Ad-Aware, Advanced WindowsCare and avast!  Are they sufficient?

Thanks again for your help.