I can't change the homepage for IE7; it keeps redirecting to www.msn.com Recently installed IE7 on XP Pro SP2 laptop which was cleaned from 120 plus spywares, malwares, adwares, trojans, and virus'. Cleaned with numerous tools. Tools used: Norton Antivirus removal, Norton Antivirus, AVG Antivirus, AVG Spware Removal, Webroot Spyware Removal, Registry Mechanic, MRUBlaster, and pick and delete through folders and registry. Owner didn't have original OS disks, or App disks. Cannot stop the IE page homepage from being www.msn.com. First in Inet Options I change to www.google.com or anything else, and it redirects to www.msn.com with the following link: http://go.microsoft.com/fw
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
:) That would be really weird if it was a spyware problem. Why would spyware change your homepage to http://www.msn.com? Or maybe it's really advanced and it says it's MSN but it's really a redirection. Anyway, you could try setting the homepage manually through regedit:
HKEY_CURRENT_USER\Software
Change the "Start Page" value to what you want.
Also, if regedit acts weird, you can also try Tuneup Utilities(http://tuneup.sw
Either Norton or Spysweeper is blocking the change. My money is on Spysweeper. Disable Spysweeper and you will notice that the change takes. Then go into Spysweeper and go through the options until you find home page protection and you will see where you can have it allow you to change the page when you need to.
Sometimes homepage are locked by security programs like Norton Zone alarm, SpySweeper, Spybot S&D, Windows Live.
If you're that one of your programs are not locking the homepage then it's definitely malware that's causing it.
As for Purityscan.
1. Please go to your Add/Remove programs and uninstall any apps by OIN
Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
Cowabanga by OIN
or anything similar with Oin in it
If you do not see any icon for "OIN" or "(program) by OIN" in Add/Remove Programs, please download their stand-alone uninstaller.
http://www.outerinfo.com/O
2. Can we also look at your hijackthis log?
http://danborg.org/spy/hjt
Open Hijackthis, click "Do a system scan and save a logfile" don't fix anything yet.
Then upload the log to any hosting sites,
or go to the below link and login using your Experts-Exchange username and password.
http://www.ee-stuff.com
Click on "Expert Area" tab
type or paste the link to your Question
"Browse" your pc to the location of your Hijackthis log and click "Upload"
Copy the resulting "url" and post it back here.
OR: either this site:
http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here:
If you have trouble uploading the log elsewhere, then just paste it here.
3. Here's also a very good scanner:
http://www.superantispywar
Thank you for all your suggestions. I am trying multiple solutions. I will keep you posted.
1. I do not have hijackthis yet; couldn't easily find--will though
2. HKEY_LOCAL_MACHINE\SOFTWAR
3. I have not tried (http://tuneup.swmirror.co
4. Yes, he does use a firewall; however, tried stopping -- no avail
5. C:\WINDOWS\system32\driver
6. Neither Norton or Spysweeper was blocking the change -- no avail
7. Will not use http://www.outerinfo.com/O
8. Still have not gotten hijackthis; plan to upload the edited (protect user) log for review.
9. Running http://www.superantispywar
I have approx 20 pages of writeup to do. This was a very unusual box. I will post the write up here. Here is what I have so far:
February 9, 2007
User complaint: Cannot view web. Laptop connects, but unable to view. Numerous errors pop up.
____________________
Checked SSL, TLS settings - good
_____________
Used Cingular Communications Manager – Showed full bars/full connection
____________________
ipconfig –all – showed no connection media, IP 0.0.0.0
____________________
Errors upon bootup:
NT On – Access Scanner Service
szAppName: szAppVer: 0.0.0.0 szModName:Kernel32.dll
szModVer:5.1.2600.1106 offset 00013887
Symantec Email Proxy
TCP/IP is disabled. Disable email scanning in your Symantec product options or install TCP/IP 1003,3
http://www.symantec.com/te
_________________________
Microsoft Visual C++ Runtime Library
Runtime Error!
Program C:\PROGRA~1\Symantec\LIVEU
.....more to follow :o)
Dell Inspirion 5100
Pentium 4
CPU 2.8 GHz
512MB RAM
__________________________
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 2/9/2007
Time: 6:08:39 PM
User: S-1-5-21-204266967-2096854
Computer: HOSTNAME
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.
For more information, see Help and Support Center at http://go.microsoft.com/fw
__________________________
Event Type: Error
Event Source: SENS
Event Category: None
Event ID: 0
Date: 2/9/2007
Time: 7:36:53 PM
User: N/A
Computer: HOSTNAME
Description:
The description for Event ID ( 0 ) in Source ( SENS ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Event System Win32 Error: No service is operating at the destination network endpoint on the remote system.
, ServiceStart(): SensInitialize() failed.
__________________________
Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5051
Date: 2/9/2007
Time: 7:43:56 PM
User: NT AUTHORITY\SYSTEM
Computer: DRTOM
Description:
The description for Event ID ( 5051 ) in Source ( McLogEvent ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: c:\PROGRA~1\mcafee.com\vso
Build Sep 8 2001 15:13:39 / 8.52
Object being scanned = \Device\HarddiskVolume2\Do
__________________________
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/9/2007
Time: 7:44:00 PM
User: N/A
Computer: HOSTNAME
Description:
Faulting application , version 0.0.0.0, faulting module KERNEL32.DLL, version 5.1.2600.1106, fault address 0x00013887.
For more information, see Help and Support Center at http://go.microsoft.com/fw
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 20 30 2e ure 0.
0018: 30 2e 30 2e 30 20 69 6e 0.0.0 in
0020: 20 4b 45 52 4e 45 4c 33 KERNEL3
0028: 32 2e 44 4c 4c 20 35 2e 2.DLL 5.
0030: 31 2e 32 36 30 30 2e 31 1.2600.1
0038: 31 30 36 20 61 74 20 6f 106 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 33 38 38 37 013887
__________________________
http://www.outerinfo.com/O
Malware experts in the most reputable antispyware forums are using it. I know it comes from the company that installs it in the first place but it works when manual removal doesn't.
It's up to you.
It's understandable for the uninstaller to be flagged by your antivirus.
just to prove to you that it doesn't come with mediaticket, I downloaded it and run it, of course my Kaspersky alerts me of it being adware purityscan which of course understandable. So I disable Kaspersky, I can assure you it didn't install mediatickets or anything nasty in my pc.
Smitfraudfix that removes smitfraud infection are flags by McAfee and some antivirus as a virus itself. Just like merijn's hijackthis was flag as a virus.
It's common for antiviruses to flag something as nasty, but it is understandable that the OIN uninstaller will be flagged.
Anyway, it's your decision, if you don't trust my advice that's fair enough.
rpggamergirl. Now how can you possibly say that I don't trust your advice, I'm happy to have your advice and I've been using the tools you provided for the last 4 hours. No doubt you know what you are talking about! As for Purityscan -- its definately part of the promblem: both Yazzle and Cowabanga. Just had to pick what to use first. You can look at the hijack log in that you provided me an excellent link. And I certainly thank you for http://www.superantispywar
February 9, 2007
Ok, guys and gals. This has become an obsession and I need to get rid of this box! I have this one final thing to fix and the output of hijackthis is at the bottom of this post. I have run the latest http://www.superantispywar
_______________________
Tools used:
WinsockxpFix.exe
Norton_Removal_Tool
20070215-033-x86 NAV defs forced
Norton SystemWorks 2006
avg75free_441a944.exe
avgas-setup-7.5.0.50
CheckIt
cports.zip from nirsoft.net
xp_exe_fix.zip
Helix fprot antivirus
IE7-WindowsXP-x86-enu.exe
Webroot SpySweeper
mrublastersetup.exe
regscanner from nirsoft.net
spywareblastersetup351.exe
myuninst.zip
Registry Mechanic
SuperAntiSpyware.exe
alternativ hijackthis
__________________________
Found throughout:
Trojan LuckBar888
Adware Softomate
Adware Click Spring
Adware Drive Clean
Trojan Dropper.Dollar
PurityScan
Webhancer
SaveNow
Not-A-Virus
Adware New Dot Net
Trojan Downloader
Trojan Dropper.Small
Adware Why PPC
Tracking Cookie Clickbank
Tracking Cookie TribalFusion
Tracking Cookie Findwhat
Adware Media Ticket
Adware Command
Adware Maxfiles
__________________________
User liked viewing porn sites
User did not keep service packs and hot fixes up to date
User accepted that Norton Antivirus had stopped working
User had no firewall
User had no Anti Spyware
_________________________-
Best guess: user viewed particular porn site
Picked up Webhancer
Opened vulnerabilities for Adwares
Opened port for MyDoom2
Opened vulnerabilities for Dropper.Dollar
Opened port for MyDoom3
Disabled / corrupted Anti-virus portion of Norton SystemWorks
Norton corrupted TCP/IP Stack
Made numerous copies of self in GoBack
Opened port for Dropper.Small
Lost connectivity December 14, 2006
__________________________
Here's the history:
User complaint: Cannot view web. Laptop connects, but unable to view. Numerous errors pop up.
____________________
Checked SSL, TLS settings - good
_____________
Used Cingular Communications Manager – Showed full bars/full connection
____________________
ipconfig –all – showed no connection media, IP 0.0.0.0
____________________
Check Network Connections
Connected. Cingular Accelerated Connected. Full Bars.
ping google.com
Windows Sockets interface, error code 0 returned
_______________________
WINDOWS
IP Configuration
IP Routing Enabled: No
WINS Proxy Enabled: No
Ethernet Adapter Wireless Network Connection: 2
Sierra Wireless 3G Adapter
DHCP Enabled: Yes
Autoconfiguration Enabled: Yes
Subnet Mask 0.0.0.0
IP Address 0.0.0.0
Default Gateway
DHCP Server 0.0.0.0
ipconfig /all
no media connected
__________________________
Errors upon bootup:
NT On – Access Scanner Service
szAppName: szAppVer: 0.0.0.0 szModName:Kernel32.dll
szModVer:5.1.2600.1106 offset 00013887
Symantec Email Proxy
TCP/IP is not disabled. Disable email scanning in your Symantec product options or install TCP/IP 1003,3
http://www.symantec.com/te
________________________
Microsoft Visual C++ Runtime Library
Runtime Error!
Program C:\PROGRA~1\Symantec\LIVEU
__________________________
Program:C:\Program Files\Common Files\Symantec Shared\ccApp.exe
__________________________
ConfigWiz
Another instance of the Wizard is running
__________________________
Services running AIM at startup
__________________________
Checked Logs --- Significant:
Dell Inspirion 5100
Pentium 4
CPU 2.8 GHz
512MB RAM
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524Date: 2/9/2007
Time: 6:08:39 PM
User: S-1-5-21-204266967-2096854
Computer: HOSTNAME
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.
For more information, see Help and Support Center at http://go.microsoft.com/fw
__________________________
Event Type: Error
Event Source: SENS
Event Category: None
Event ID: 0
Date: 2/9/2007
Time: 7:36:53 PM
User: N/A
Computer: HOSTNAME
Description:
The description for Event ID ( 0 ) in Source ( SENS ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may
be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Event System Win32 Error: No service is operating at the destination
network endpoint on the remote system.
, ServiceStart(): SensInitialize() failed.
__________________________
Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5051
Date: 2/9/2007
Time: 7:43:56 PM
User: NT AUTHORITY\SYSTEM
Computer: HOSTNAME
Description:
The description for Event ID ( 5051 ) in Source ( McLogEvent ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer.
You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: c:\PROGRA~1\mcafee.com\vso
(0x328), 0x7ffe0304,
Build Sep 8 2001 15:13:39 / 8.52
Object being scanned = \Device\HarddiskVolume2\Do
__________________________
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/9/2007
Time: 7:44:00 PM
User: N/A
Computer: HOSTNAME
Description:
Faulting application , version 0.0.0.0, faulting module KERNEL32.DLL, version 5.1.2600.1106, fault address 0x00013887.
For more information, see Help and Support Center at http://go.microsoft.com/fw
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 20 30 2e ure 0.
0018: 30 2e 30 2e 30 20 69 6e 0.0.0 in
0020: 20 4b 45 52 4e 45 4c 33 KERNEL3
0028: 32 2e 44 4c 4c 20 35 2e 2.DLL 5.
0030: 31 2e 32 36 30 30 2e 31 1.2600.1
0038: 31 30 36 20 61 74 20 6f 106 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 33 38 38 37 013887
__________________________
Installed People PC ISP
ipconfig /all
no connection media
uninstalled People PC ISP
__________________________
googled errors:
Followed SENS error
joined Experts Exchange
Found answer with -- Windows XP Home Can't Get an IP Address_WinsockxpFix.exe
_______________________
GOT CONNECTION
__________________________
Multiple popups
Freezes
Stalls
Overheating
_____________________
Application Errors:
June 2006 System Volume Information \ eatalog.wci is corrupt
July 2006 Classes registry file corrupt
July 2006 msvcrt.dll - bpgame.exe - McAfee
Aug 2006 Outlook MOF
__________________________
Other logs: Logs saved (Windows format):
__________________________
BootTime with hard connect 3 min
__________________________
Specs of the system:
Display Adapter Mobility Radeon 7500
Conexant D480 MDC V.92 Modem
Sierra Wireless AirCard 3G Modem
Standard Modem
Multifunction adapters
- Sierra Wireless AirCard 3G
adapter parent
Network Adapters
- 1394 Net adapter
- Broadcom 440x 10/100 Integrated Controller
- Sierra Wireless Adapter
PCMCIA adapters
- Texas Instruments PCI -4510 cardbus controller
IRQ:
11 – Sierra Wireless 3G Adapter
11 – Sierra Wireless Air Card 3G Modem
10 – Conexant D480 MDC V.92 Modem
__________________________
Add and Remove
Programs:
Tried to remove:
888Bar
error while uninstall: New Starter Uninstall: Completed
Could not load C:\Program Files\Common Files\ {3CA20FSF-OAE5-1033-0428-0
Completed
Adobe Downloader Manager 2.0 (Remove Only)
1/13/2005
Adobe Reader 7.05
1/13/2005
AIM 6.0
12/15/2006
AOL Instant Messenger
11/12/2006
AOL Toolbar 2.0
Cingular Communication Manager
Publisher: Cingular
Version: 5.2.19.0
Cust Supp 1-800-331-0500
Cowabanga by OIN
12/11/2006
Dataware
DAO
Dell Support
2/11/206
Direct X Media Runtime 5.1
HP Document Viewer
Live Update 2.7 / Symantec Corp
1/29/2007
Version 2.7.39.0
McAfee Security Center
6/1/2003
McAfee Virus Scanner Online
6/1/2003
Microsoft Encarta
Microsoft Money 2003
6/1/2003
Microsoft Money 2003 System Pack
6/1/2003
Microsoft PowerPoint Viewer 97
6/11/2003
Microsoft Streets and Trips 2002
6/1/2003
Microsoft Works Setup Launcher
6/1/2003
Microsoft Works 7.0
6/1/2003
Microsoft Works 7.0 Suite Addin
6/1/2003
__________________________
exported Reg C:\Windows\System32\9FEB07
__________________________
created Windows Restore Point – appeared to be effective.
xxxxxxxxxxxxxxxxxxxxxxxxxx
***OIN Installations EULA, AVG Antispyware scan report and Hijackthis log removed by rpggamergirl PE***
xxxxxxxxxxxxxxxxxxxxxxxxxx
3 hours trying to use Norton SystemWorks
continuous shutdowns
__________________________
Started Install XP SP2 from CD
2 failures -- over heat
__________________________
cooled with upside down compressed air
__________________________
Installed XP SP2
__________________________
Posted this at Experts Exchange
I would like to install Symantec Norton SystemWorks 2006 (don't have original software). I have partially removed a corrupt version of 2006.
I'm working on a Windows XP Pro Dell laptop. I had the problem where I couldn't connect on all medias. I used experts-exchange suggested http://www.snapfiles.com/g
FANTASTICALLY! So I not longer had the 'TCP/IP is not disabled. Disable email scanning in your Symantec product options or install TCP/IP 1003, 3
http://www.symantec.com/te
I initially thought my problem was tied to a corrupt Symantec Norton SystemWorks 2006. There were all kinds of problems and would not remove completely. I got desparate and tried to hack Symantec and Norton
out of the registry (backed up) and pick through the directory. But I get the same problems. I am trying to reistall the app. I tried Symantecs' 'NortonRemoval Tool'. The problem seems to be the Goback. But even
though the GoBack.rxc is missing, I did get a success restore out of it after a bluescreen scare (use of Webroot Spysweeper (removing 77 instances; latest being 'webhancer' -- a proposed adware that changes reg
and runs in memory). (may be the initial problem -- December 14, 2006)
Upon bootup, I get Norton 2006 Corrupt - A necessary file could not be loaded: NAVPro 1002, 1 --- which is the same problem as 18 hours ago.
http://www.symantec.com/te
__________________________
Deleted Temporary Inet files
Deleted Trash
Disk Defrag
Removed McAfee -- long process
Removed Symantec Utilities - again
__________________
Posted again:
This is my first time using this. I guess I need to ask now what? I have a concern. The kernel is in my best guess still unstable. I do not wish to remove the GoBack since it really was able to recover the box nicely.
I would just like to be able to install the Utilities and the Antivirus, if possible. Since webhancer, I suspect the laptop as being a bot. Let's discuss further....I think may be dealing with ADS (alternate data streams)
http://www.microsoft.com/t
to install but to install on 0 (zero) K. I need to return this box to the user as soon as possible.
_________________
I'm going to try to boot to a linux antivirus and removal tool -- Helix and clean in this fashion. I will keep you updated. However, I'd like to hear your direction.
_______________
This didn't work. Mounted drives but saw 0 files. Received WARNING: Hard link count is wrong for /: This may be a bug in your filesystem driver. I have downloaded the free version of AVG Anti-Spyware. So far
Adwares/Malwares found quarantined and/or deleted. Next I'll run there AV. Still waiting on hearing your approach.
____________________
SAFE MODE
________________
msconfig
repeats
___________
pic through files -- Program Files\Common Files and registry
LiveUpdate
CheckIt
Norton
Symantec
___________
Finally Norton Removal Tool and remove Norton
________________
Installed / ran CheckIt
_______________
System Passes All
_______________
4 attempts to install Norton SystemWorks
CPU maxed ---- overheat
________________________-
ALL USER DATA BACKED UP TO REMOVABLE MEDIA
_________________________
Installed on its side with fan blowing behind
block of ice to cool to push into intake of laptop
Norton Installed
___________________
There's another 10 pages, but you get the idea:
willing to answer any questions.
________________
webhancer
purityscan
savenow
targetsaver
go.com
zango
findwhat
2o7net
Thank you.
>>>> We recommend that you print out a copy of these terms for future reference. Installation and use of the Company's Software is voluntary, and you may terminate this EULA at any time by uninstalling the Company's Software (including the Company's advertising-supported software) using the Microsoft Windows Add/Remove Programs function on your computer or running our uninstaller at http://www.outerinfo.com/O
You were not downloading the uninstaller by that looks. You were actually downloading OIN programs itself, that is worst! You might've gone to their website instead of clicking the standalone OIN Uninstaller link.
When I downloaded the OIN Uninstaller, I wasn't presented with any EULA, all it asks was for me to input those 4 letters to make sure that I'm human and not a machine. And then it says that application will be uninstalled and that's it.
You need to just click on this link --> http://www.outerinfo.com/O
it's a direct download, save it to your desktop and run it.
Those in the system restore can be easily remove by fluching system restore points.
NewDotNet would have been the one that cuts off the internet connection, it is well known for that.
You can fix thewse entries in hijackthis:
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - {4EB4958B-096F-0A97-4801-0
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-2
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2
O4 - HKCU\..\Run: [Eeulttco] C:\Program Files\Common Files\?ssembly\??oolsv.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-0
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-3
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1
I would uninstall Viewpoints Manager as well.
this file below if still present delete it.
C:\Program Files\Common Files\ {3CA20FSF-OAE5-1033-0428-0
I would also suggest downloading and running combofix or maybe run a rootkit scanner, with all those nasties, I won't be surprised if rootkit is in there as well.
Download this file - combofix.exe
http://download.bleepingco
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
I would also suggest to scan for rootkits:
1. Download (Download the GUI) version of BlackLight, and save it to your desktop.
https://europe.f-secure.co
Doubleclick blbeta.exe, accept the agreement, click scan > next.
You'll see a list of all the items it found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (where xxxxxxx represents numbers). The application finds both bad files and legitimate ones such as "wbemtest.exe", so don't choose the rename option yet! Copy and paste the log it generated in your next reply.
2. Rootkit Revealer:
http://www.sysinternals.co
Unzip it to it own folder or to your desktop.
Run RootkitRevealer.exe and scan your system. When the scan is complete click on File, Save, and save the log file. Post the log here.
In order to minimize RKR log being polluted with legit data run RootkitRevealer on an idle system.
Yes SudburyComputer,
I agree, but I can't stop now--I'm learning far too much. I'm not getting any money for this box; it was just a really good way to get back into a sideline business -- and back into geeking after 10 years. The user doesn't seem to have any of the original software either, so it would kind of be a hassel to use mine, activate, download, etc, etc, etc, this is much more fun.
rpggamergirl,
You know your stuff!!!! LOTTA ROOT KIT!!! Wish I could give you 5,000 points!! I believe this to be a kernel-mode rootkit; hence the former found KERNEL32.DLL corruption; and the unavailability with HELIX to view
drive partions. Mounted drives but saw 0 files. Received WARNING: Hard link count is wrong for /: This may be a bug in your filesystem driver.
HERE IS THE ANSWER FOR THE REDIRECT: HKEY_LOCAL_MACHINE\SOFTWAR
Data Mismatch between Windows AP and raw hive data .....It appears to be the last piece (and the most cryptic...no pun intended--well maybe).
Now if I could just get the binary key; or learn how to import one from another computer.....with it being a crypto key, could I just copy it? I wonder.....
If not: It's OK the msn is a ligitimate site. I loaded Opera: Version 9.10 Build 8679 Platform Win32 System Windows XP Java Sun Java Runtime Environment version 1.5
XHTML+Voice Plug-in not loaded for the main browser to ensure that http://go.microsoft.com/fw
Thank you, thank you....this is one of the cleanest-fastest-boxes that I have ever used.
I used the OIN uninstaller http://www.outerinfo.com/O
I uninstalled Viewpoints Manager Add/Remove
I used https://europe.f-secure.co
I applied all the reg fixes you stated.
Again manually edited HKEY_LOCAL_MACHINE\SOFTWAR
changed back
I removed C:\Program Files\Common Files\ {3CA20FSF-OAE5-1033-0428-0
Sad news: combofix has been desupported by the author
>>The tool, ComboFix has been temporarily withdrawn. The author discovered a rootkit infection that will intefere with ComboFix's running. This will cause Combofix to be UNSAFE FOR USE on your machine.
Even if you manage to find a mirror for the tool, PLEASE DO NOT RUN THIS TOOL Apologies for any inconvenience caused <<
xxxxxxxxxxxxxxxxxxxxxxxxxx
***Rootkit Revealer's and Hijackthis' logs removed by rpggamergirl, PE***
xxxxxxxxxxxxxxxxxxxxxxxxxx
DONE. THANK YOU.
Sorry about the combofix, yeah it is now withdrawn because if this rootkit -->qwertybot.exe
IF present in the system ,it will caused combofix to malfunction,(deletes all the files in the systemdrive, terrible outcome)
According to sUBs(author), the rootkit involved is relatively easy to disinfect. Reboot to safe mode & HJT fix the O4 entry below:
HKLM\..\Run - [qwertybot.exe] - C:\Windows\system32\qwerty
Delete files:
C:\Windows\system32\qwerty
C:\Windows\system32\comdlg
But, even if the "qwertybot.exe" is not present, some other rootkits that comes along might do the same thing, so the author withdrawn the tool. The file in the link now is just a dummy file.
RKR log, well those in the System volume information is easy to remove by turning off System Restore and rebooting.
Those in Norton's protected bin, if I were you I would turn it off or empty it to recover the lost space. Norton's bin do take up a lot of space, everything goes in there, even the files from the windows recycle bin goes in there, it's the destination of all deleted files.
HKEY_LOCAL_MACHINE\SOFTWAR
Hijackthis log looks good, you can fix these entries below, these are just registry clutters:
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
Now that this question is closed, we can delete the logs so people don't have to scroll much.
Is the pc okay now?
Thanks for the points!
rpggamergirl,
Yes, please delete the logs. I tried to sanitize but I missed. I was loosing sleep over that last night/this morning. I would request you keep the first part of my stuff only:
i.e., Tools used:
WinsockxpFix.exe
Norton_Removal_Tool
20070215-033-x86 NAV defs forced
Norton SystemWorks 2006
avg75free_441a944.exe
avgas-setup-7.5.0.50
CheckIt
cports.zip from nirsoft.net
xp_exe_fix.zip
Helix fprot antivirus
IE7-WindowsXP-x86-enu.exe
Webroot SpySweeper
mrublastersetup.exe
regscanner from nirsoft.net
spywareblastersetup351.exe
myuninst.zip
Registry Mechanic
SuperAntiSpyware.exe
alternativ hijackthis
__________________________
Found throughout:
Trojan LuckBar888
Adware Softomate
Adware Click Spring
Adware Drive Clean
Trojan Dropper.Dollar
PurityScan
Webhancer
SaveNow
Not-A-Virus
Adware New Dot Net
Trojan Downloader
Trojan Dropper.Small
Adware Why PPC
Tracking Cookie Clickbank
Tracking Cookie TribalFusion
Tracking Cookie Findwhat
Adware Media Ticket
Adware Command
Adware Maxfiles
__________________________
User liked viewing porn sites
User did not keep service packs and hot fixes up to date
User accepted that Norton Antivirus had stopped working
User had no firewall
User had no Anti Spyware
__________________________
and the last comment prior to this, if I can pick and choose what stays and goes.
__________________________
I don't know the site policy, I'm new to this. Again thanks, and I will put the last pieces provided in place.
configreg,
It's okay, there is no site policy on posting Hijackthis logs. But it is recommended that logs are uploaded to any hosting sites and only post the link here, or at EE-stuff.com because some logs can be quite lengthy.
I only removed the OIN Installations EULA, AVG Antispyware scan report, 2 Hijackthis logs, Rootkit Revealer's log, and left everything else intact.
In the Hijackthis zone, we don't delete hijackthis logs, well I don't anyway, :)
http://www.experts-exchang
Thanks!
Business Accounts
Answer for Membership
by: Bartender_1Posted on 2007-02-19 at 21:18:09ID: 18568516
Have you tried running Hijackthis from http://hijackthis.de ?
Download the software, run and save a log file, then you can load the log file into the website and analyze it. It will tell you what is not good on your system, or at least directions to look in.
Or you can post it here and we'll analyze it and tell you what you want to clean.
Hope this helps!
:o)
Bartender_1