pc problems

[evilfantasy]

It should be in C:\OTMoveIt3

There will be a text file with a bunch of numbers. Probably including todays date.

[Filip.dahlberg]

thanks ye there they are, there were 2, one i think done before reboot the second after, i have added both of them

[attachment deleted by admin]

[evilfantasy]

OK that looks good.

We will do some cleanup and then do an actual antivirus scan to make sure nothing else is hiding.

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

.
.
The above procedure will:

• Delete: ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
----------

1. Double click OTMoveIt3.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt3

----------

Use the ESET Online Antivirus Scanner

This scanner requires Internet Explorer

1. Check the box next to YES, I accept the Terms of Use.
2. Click Start
3. When asked, allow the activex control to install
4. Click Start
5. Make sure that the option Remove found threats and the option Scan unwanted applications is check marked.
6. Click Scan
7. Wait for the scan to finish
8. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
9. Add the C:\Program Files\EsetOnlineScanner\log.txt log into your next reply.

[Filip.dahlberg]

scan complete, nothing found...

[attachment deleted by admin]

[evilfantasy]

Looks like we got all of the malware.

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[Filip.dahlberg]

when running the  secunia scan i get 3 items: Adobe Reader 7.x, Adobe Flash Player 9.x and     Mozilla Firefox 2.0.x

i download the update, and use the update which works fine for adobe flash and mozila, however the adobe reader complains that the software doesnt exist, and the update of the mozila and flash dont seem to work either. After running the updates and installing them and rebooting i do the scan again and the same 3 `insecure` softwares are still there.  Also in  `about` under help in mozila it says i have the 3.0.8 version..


edit: hmm also when trying to update windows, i get problems...it just wont let me :S

also when installing WOT to firefox..i doesnt stay after i restart firefox and im getting firefox crashes again..they had stopped while we were doing the checks and things..

[evilfantasy]

Do this to remove all unstable older versions of Flash.

Download the Flash Player Uninstaller and save it to your desktop.

Run the uninstaller program and then reboot your computer to complete the uninstall.

Download and install the latest version of Flash Player

----------

Download the Firefox installer to your desktop. Don't run it yet.

Uninstall Firefox and then go to C:\Program Files\Mozilla Firefox and delete the Mozilla Firefox folder.

Now install a new the version of Firefox.

----------

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

• Open the folder and run Dial-a-fix.exe
• 2 windows will open. Close the one in the background labeled Restrictive Policies
• Check the box in section 1, Empty temp folders.
  
• Check the box in section 2, Fix Windows Installer.
  
• Check the box in section 3, Fix Windows Update.
  
• Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked
  
• Check all boxes in section 5, labeled Registration Center.
  
• Click Go
  
• OK any error messages if received, but write them down and post them here.
• Restart the computer when done.

.
Now try the Windows Updates.

[Filip.dahlberg]

received the following errors:

Error-2137024891 was encountered while trying to unregister C:/WINDOWS/system32/wuaueng,dll.

An error occurred durign registration of the file C:/WINDOWS/system32/wuaueng.dll(version7.2.6001.788) `the next dialog will contain an error code and possible suggestions

Error 0x80070005: `access denied`. it is suggested that you run `repair permissions` which is found in the toos dialog. windows XP home users will need secedit.exe to peform the repair


(didnt write down all text as it couldnt be copy pasted but wrote down what seemed neccessary)

gonna reboot and then try windows update

edit: tried windows update didnt work.

also the secunia scan only gives me:    Adobe Reader 7.x as an insecure software

[evilfantasy]

In the Secunia results under the Adobe Reader results there should be a file path that indicates which file is being flagged as out of date or insecure. You can manually delete the file and it should stop saying that Adobe is insecure.

Open Dial-a-fix and click the hammer icon.
Select Repair Permissions and click Go

If at any time you are prompted for the XP CD, insert it
Make note of any error messages and post them here
Reboot when complete and let me know if there's any change with Windows Updates.

[Filip.dahlberg]

arr, xp-cd is gonna be a problem atm, i recently moved and the cd is in a box some where..will have to look for it. is it possible without it?

[evilfantasy]

It may not ask for the CD.

[Filip.dahlberg]

ok it didnt ask for the cd, it didnt give any error codes, tho avast `denied`a bunch of things to fast for me to catch and write down..

windows update does the same thing gives me the Felnummer: 0x80070002 error code.

[evilfantasy]

Try the suggestions here please. http://support.microsoft.com/kb/910336

Any error codes you can get will help. Also locating the Windows XP CD is a good idea if it's possible.

[Filip.dahlberg]

ive been attempting the sugestions there and it fails from the start, the Automatic update service is allready stopped and it wont start because it claims the file is missing and so the rest doesnt work either..

[evilfantasy]

* Download the following tool: RootRepeal - Rootkit Detector
* Direct download link is here: RootRepeal.rar
* If you don't already have a program to open a .RAR compressed file you can download 7-Zip which is a free compression tool.
* Extract the program file to a new folder such as C:RootRepeal
* Run the program RootRepeal.exe and go to the REPORT tab and click on the Scan button
* Select ALL of the checkboxes and then click OK and it will start scanning your system.
* If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
* When done, click on Save Report
* Save it to the same location where you ran it from, such as C:RootRepeal
* Save it as your_name_rootrepeal.txt - where your_name is your forum name
* This makes it more easy to track who the log belongs to.
* Then open that log and select all and copy/paste it back on your next reply please.
* Close RootRepeal.