Link to home
Start Free TrialLog in
Avatar of rhonda_roo
rhonda_roo

asked on

Lots of problems - hijackthis log - viruses, errors, etc

I am trying to help my sister & brother-in-law with their laptop computer. If this isn't posted where it needs to be, let me know where I need to post it.

To begin with here is the link to the Hijackthis log

http://www.hijackthis.de/logfiles/f48d29759d67b690693f004933d3ff5c.html

I have a printout of hijackthis log tutorial and I deleted a few that I was sure could be deleted. I see more that I think could be deleted, but decided I better ask an expert before doing anything else. ;-)    

I am going to try to list everything that I can think of now and maybe someone can help me through each thing as needed. I am putting this at 500 points and will add more if things get lined out completely. Below is part of the information using Belarc.

Operating System System Model Windows XP Home Edition Service Pack 2 (build 2600) Hewlett-Packard Pavilion ze5200 KF.F.05
System Serial Number: TW30432218 Processor a Main Circuit Board b 2.40 gigahertz Intel Pentium 4
8 kilobyte primary memory cache
512 kilobyte secondary memory cache Board: Hewlett-Packard 0850 NS570 Version PQ1A91
BIOS: Phoenix Technologies Ltd. KF.F.05 12/17/2002 Drives Memory Modules c,d 40.00 Gigabytes Usable Hard Drive Capacity
28.23 Gigabytes Hard Drive Free Space

TOSHIBA DVD-ROM SD-R2312 [CD-ROM drive]
3.5" format removeable media [Floppy drive]

IC25N040ATCS04-0 [Hard drive] (40.01 GB) -- drive 0, s/n CSH409DLCNKBNB, rev CA4OA71A, SMART Status: Healthy 448 Megabytes Installed Memory

Slot 'J400' has 256 MB
Slot 'J401' has 256 MB Local Drive Volumes
Logins Network Drives CHIEFSLAPTOP\Owner
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
 
Besides the spyware, there were 23 viruses on this computer that could not be repaired so we quarantine, then deleted. Most of them were trojans. I still have the log of what they were, if needed. My brother-in-law backed up what he needed and said just erase it all and start over. But.. there are a few problems with that.

* The laptop was used while he was in the service and has been exposed to a lot of sand.The floppy doesn't work.. it makes a sound when you try to do anything with the floppy. It wants to format, then says that it couldn't be completed. How would we check for sand inside? Can I just remove the floppy drive and see inside? Is it really complicated? I am comfortable opening a desktop case, but a little nervous with a laptop.

* There is an error that comes up everytime you try to open a folder. The error is... Error! Explorer    You click ok and it opens the folder. It does this when double clicking "My computer" and any file after that.

* I plan to check for windows updates while waiting for someone that is willing to help me.

* The system configuration - We need some help with what should be in start-up. What should it be on? Normal, selective? Is there a list that I can find out what is needed and what isn't? There are A LOT of things in there!!

* I have added and updated Spyware Blaster, ad-aware, AVG & zone alarm (zonealarm not up-dated - explained below). There are a few things on zone alarm that I checked for it to always remember "no"... Because I wasn't sure what they were. He had a corporate nortons on here, but it was detected that spyware or something was in those files too, so we uninstalled that. He is retired now and they have nortons home edition that they are going to put on here once everything is straightened out.

* One thing that I notice is the search toolbar on the left, sometimes shows the "page cannot be displayed". It wasn't doing that before. But they don't want to toolbar anyway. It keeps coming back.

* When trying to update zonealarm, for instance, it brings up a new browser when I click to start the download, but nothing ever comes up in that browser. It is a real small browser that pops up. I have left it alone for awhile, but nothing ever happens. So, zonealarm has NOT been updated.

Right now, that is all of the things I can think of. I want to get this posted, but there may be more questions later...and more points, of course. Any takers? TIA
ASKER CERTIFIED SOLUTION
Avatar of Shane Russell
Shane Russell
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
BTW you can use the dvd rom drive to boot up from and set it up in the bios to make the dvd rom drive the first bootable device, I forgot to mention that, hence you will not need the floppy disk provided you have the xp cd because that should be bootable, if not there is bart pe bootable cd which you can create / make and have been PAQ's with regards to that and I can post that if you would like so you can see :)
Here is a URL to give you a rough idea of how to change out items on a laptop :

http://www.comp-buyer.co.uk/buyer/features/61395/how-to-upgrade-your-laptop/page4.html

FYI - There is a Next Page Link at the bottom and there are about 10 pages or so and if you click on that it will show you how to do different things.


I'm voting for the format and reinstall.

The system is so messed up and infected that you will be around it for days and never be sure it's totally clean and healthy.

But, anyway, and if you want to troubleshoot it:

Download Spy Sweeper fully functional trial version:
http://www.webroot.com/downloads/?WRSID=5b56b845bf373998de626a632b241140
Install, UPDATE and run.
You may need to reboot and run twice.

Download Ad-Aware SE from here:
http://lavasoft.element5.com/support/download/
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once (“in use”).

Also excellent is SpyBot Search & Destroy available here:
http://www.safer-networking.org/index.php?page=download
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once (“in use”).
You should also apply the "immunize" function, since it blocks roughly 1900 known 'bad' runs/apis/apps.

Even if Ad-Aware and SpyBot S&D are similar, they do clean different things. You should have both of them and use REGULARLY.

You can also install “preventive” software that will help you control these nasties:

SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html
Avoids malicious Active X installs.
Advantage: no system resources used!!!
Currently protects against 3350+ items.
Just download, install and UPDATE.

All of them extremely useful but you must keep them UPDATED.

Zee

Also, have you tried an online virus scanner?

Run at least 2 of them:

Panda ActiveScan
http://www.pandasoftware.com/activescan 

Bitdefender
http://www.bitdefender.com/scan/Msie/index.php 

McAfee FreeScan
http://us.mcafee.com/root/mfs/default.asp 

Symantec Security Check
http://security.symantec.com/sscv6/ 

Pc-Cillin (Trend Micro Housecall)
http://housecall.antivirus.com/housecall/start_pcc.asp 

PcPitstop
http://pcpitstop.com/antivirus/default.asp 

RAV
http://www.ravantivirus.com/scan/ 

Zee

Also quite interesting:

To Home Users: Do you want free security programs that really works?
http://msmvps.com/donna/archive/2004/12/06/22450.aspx

Zee
Avatar of rhonda_roo
rhonda_roo

ASKER

I just checked in here from my computer (not the laptop) but I will try some of the advise above later this evening..

Several months ago I had added spyware blaster, ad-aware & spybot to their laptop. I use them on mine along with zonealarm & AVG and I think they are all awesome!

I do have AVG on the laptop which is how I quarantine and deleted those infected files. I tried to do an online scan before posting... I ran into problems. (the browser that pops up and nothing happens)

blue - I was almost ready to do a format & restore but was worried because the floppy doesn't work. In the end, I may end up doing that using gecko's suggestion on making the dvd rom drive boot first. I am wanting to try a few other things first.

I will post back later in the evening after I have had a chance to try out some of the suggestions. I really like the link you posted about the security programs. I am going to pass that on in my family group. I am always telling them they need to get some spyware prevention.


rhonda_roo,

Whatever way you go, troubleshoot or reinstall, best of luck!

Zee
Best of luck rhonda_roo !! I just wanted to say with regards to it popping up and doing nothing, I would say that is something to do with zone alarm. Maybe to do with the privacy settings or that you have your firewall settings to high :) could even be that your not giving it a chance to download the files it needs to run the scan ? Because sometimes it asks if you want to do it or not and you have to click on yes. Might be worth re setting internet explorer just so that it asks you. The only other thing apart from that, that I can think of as to why IE is not asking you would be with regards to your security settings within internet explorer are set too high !

The reason I did not say about using the floppy disk as boot up was because I was not sure if it worked or not because you had said :

" * The laptop was used while he was in the service and has been exposed to a lot of sand.The floppy doesn't work.. it makes a sound when you try to do anything with the floppy. It wants to format, then says that it couldn't be completed. How would we check for sand inside? Can I just remove the floppy drive and see inside? Is it really complicated? I am comfortable opening a desktop case, but a little nervous with a laptop. "

With regards to that , If you would like to use a floppy disk drive to boot up from and the one you have now does not work, see if someone you know has a one you can use or you can purchase a new one, shouldnt be too expensive considering, however laptop items are different so I wont really comment on there.

FYI - www.bootdisk.com has a bunch of bootable disks on there that are worth taking a look at ;) Also If you search around on google you can find out how to make a bootable cd. I think Nero has an option for making a bootable disk but If you get stuck on any of that, post here and myself and other experts will most likely reply to you if you get stuck on that or something else for that matter :)

kind regards

Gecko
I don't think I can add much on the excellent advice already given, but I'd like to throw in my opinion that you should not focus too much on the FDD here. A modern HP will have no problems booting off a CD or even a DVD for restore purposes. Since I was recently in a similar situation, though on a lesser scale, I can only recommend using "fdisk and format" on this unit. Even if you succeed in cleaning out all uninvited visitors, you will never be quite sure about hidden damage. It simply isn't worth the effort and time needed. Spend the energy on a decent backup on anything important that needs to be saved. Do a virus scan on all documents and other files in the backup! Remove partition(s), make new, format and reinstall the O/S.

As for future problems, I can recommend the use of the Mozilla browsers and e-mail clients (Mozilla suite, or Thunderbird and Firefox) as these programs do not help spyware embed itself in your system. I think that may be a better approach than inastalling a number of spyware-protection programs that will take computing power and add to the average load.

Just a few thoughts.
/RID
I dis agree rid with regards to fdisk:

you need to read the un documented things that fdisk can do, since he has xp I would recomend he use fixmbr or some command like that which comes with the windows xp cd. I will try and find some sites with regards to this and I know there are some PAQ's because I have read them. Not sure if I will have any luck finding them.

Please give me some time to find these sites to explain how to do fixmbr.

Thanks

Kind regards

Gecko
No problem. I'm not really and XP XPert. I just remember doing a new install over a corrupt one for a friend and ended up with basically all the bad things still there because the install saved all the old settings and stuff from internet temp files, favourites and other places where badware can hide. At least do a format :)
/RID
I used to use fdisk a lot and the only reason I am disagreeing with you is because I did it on a compaq twice in a row because I had a few hard drives and the fdisk killed the hard drives and If using fixmbr works without having any problems then I would much prefer to suggest that.

I mean dont get me wrong I have an IBM and a maxtor hard drive and I have used fdisk with them a lot and it works fine so I am not ignoring fdisk altogether, just I dont want to suggest an option that may mess up someone elses hardware.

Especially when it is to do with there hard drive with all of there data :)

Might just be me and my bad experience as to why I suggest it but I prefer to be safer then sorry :) lol
I think the site I was trying to get went down, not sure though.

Here is another site I found with regards to re installing windows xp, formatting and fdisking with guides and it even has a site with regards to warnings about fdisk , I think.

http://kadaitcha.cx/format.html

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/bootcons_fixmbr.mspx

http://www.ntfs.com/mbr-damaged.htm

Look at those sites :)

If I can get a hold of that other site explaining about not using fdisk then I will post it here but as of yet have had no luck, SORRY !
I just found out that if you go to this site :

http://kadaitcha.cx

which is simmiliar to the one I posted they have microsoft how to knowlegde base and a bunch of other useful stuff :) FYI :) Not sure if that helps you out with any of this but might be useful to know later on :)

Also

www.webhazard.com
Checking back in and reading the new replies. I am talking to my sis & brother-in-law about the replies. I didn't get a chance to take the floppy out yet, hopefully this weekend. I am sure there is sand in there. He got most of it out of the keyboard.

I hadn't even thought about the IE security settings or zone alarm. (I guess I had a brain fart) lol

I am going to try to read up on the fdisk pro's and cons and the other info listed. I have formatted and restored my own computer. I get a little more scared when it is someone elses computer. I have bootdisk.com bookmarked because I had read about it on here before and used it. I don't know if they will use Firefox or not. I think I had suggested it to them before.. they don't like change. I like mozilla, but I have to use IE for my family group on MSN.

Thanks again for the replies.. I will be back in a few days with an update.  Rhonda
np, LOL @ brain fart on zone alarm or IE security settings lol :)
I'm ba-a-ack. LOL  I have a couple of questions. First, I tried to remove the floppy. I couldn't get it. I took 4 screws out on the bottom and there is a little black flap that pulls out just below where the floppy is inserted. I pulled it out and I didn't want to pull too hard, afraid I would break it. So... I need some help. It is a hp pavilion ze5200. I done a google search "remove floppy hp pavilion ze 5200" and didn't see anything useful. Can you give me anything else to try? Or a way that I can see inside to see if there is sand in there. I used the canned air in every hole I seen, but still have problems.

Next questions I have... Does formatting the drive get rid of all viruses? I have heard that it does.. and I have heard that it don't. If it doesn't. Can you walk me through what I need to do? My sister gave me a CD today for his laptop. It is the "hp notebook Operating System CD Microsoft Windows XP Home SP1". Is this all I would need to put the laptop back to original settings after a format or whatever is done to clean out all this crap? I am really leaning more toward erasing everything. He has backed up what was needed and I noticed after I restarted after getting rid of some the of the "crap" that errors were popping up about files not being found.. from the registry. I done regedit and looked in there.. and there is all kinds of things! So.. if I can erase everything and make the computer start fresh.. would you help me if I run into problems? hehehe  From what the scans are showing from AVG it is clean now. I haven't connected back to the net to try an online scan, but will if it needs to be done.

Ok.. I'm done blabbering now. haha
As I mentioned before, the floppy does NOT work. He told me tonight that he sometimes has problems with a DVD playing. He could usually get it to work, but it seems real picky. Is that something common with this type or is it possible there is other reasons.. sand or whatever.

I mentioned in my last message that I had put a couple of spyware preventions on there for him, but I forgot to say "He didn't update them!" I will look for ones that he can have automatically update.. so it will be done. I thought it strange that he had so many virusus because he had Nortons Corporate on his computer. It was updated.. up until a couple of months ago when he quit using it because of so many things going on.


 
Funny.. I said I was gonna quit blabbering and I typed 2 more paragraphs. I guess that is a perfect example of what you men say about us women, huh? ha ha
LMFAO, This should be the comedy hour LOL. Im not gonna say nothing mean, I aint ready to be biatch slapped lol :D
LOL @ My sister gave me a CD today for his laptop

I will go and take a look see to see if I can find something to help you on removing the floppy disk drive, yes formatting does remove everything including any data on the hard drive partition. I would suggest you back up any data that they want to keep before formatting :)

Other then that just use the xp cd to do a re install by setting the dvd rom drive as the first bootable device and reinstall windows xp. Let me get you a website to explain re installing of xp :)
I went here :

http://h20180.www2.hp.com/apps/Lookup?h_lang=en&h_cc=us&cc=us&h_page=hpcom&lang=en&h_client=S-A-R163-1&h_pagetype=s-001&h_query=hp+pavilion+ze5200&submit.x=5&submit.y=10

it gives you a list of notebook pc's, I chose the 2nd one down, not sure if thats the right one :-S

if you go here :

http://h10025.www1.hp.com/ewfrf/wc/product?dlc=en&lc=en&product=455044&lang=en&cc=us&

that gives you a list of things you can try, ie solve a problem, etc. Maybe even give them a call and see if they can walk you through it on the  phone , if your really that stuck and the manual(s) or info on the site is not enough for you :)
download there service manual from there site : it shows you in there how to remove the floppy disk drive :)
You still alive lol :-S Give us an update once you have tinkered with it all :)
Yes, I'm still alive. I wasn't feeling good yesterday and didn't get on here. And just for the record. My sister DID give me the CD for HIS (her hubbys computer. hehe  You thought I messed up. I wasn't trying to be a comedian. I guess I was just in a "goofy" mood. lol

I'm off to check these links now and will hopefully report back some good news and give you some points. And.. you BETTER be nice to me.
I will be  :D *GRINS* as for the comedian part, you made me laugh some what, not sure if that counts lol :)
Ok.. I need some help. I thought I was doing so good. LOL  I formatted and restored. But now the video controller and the modem are listed as a conflict in device manager. When I click on properties it has the manufacturer as uknown. The in device status it says the drivers for this device are not installed. (code 28) When I try to reinstall the drivers and have it install automaticallyit can not find the software. I have a Mainboard (xp support) CD that came with MY computer (not the laptop) that has the PCI modem listed. When I tried to get the modem driver from that it gave a warning about it not being supported by XP. So I stopped. I didn't try to get the video controller from it. I looked on line and I have seen a couple but I am not sure which one I need. I looked in the manual that I saved from the site you gave me for hp, but couldn't find anything that told me what I needed. I'm getting aggravated so I thought I'd ask for help. They wont need the modem. They use broadband, but I wanted it to get online to get the spyware downloads, etc.  I will check back in a little while and see if you have replied.
There is wcpuid and belarc home advisor or something like that. That will tell you what hardware you have and hence will be able to find drivers from there :

www.driverguide.com

sign up for that site , i think you can use

username : Drivers   Password : all


Here is belarc advisor :

http://majorgeeks.com/download1385.html

and wcpuid is :

http://hp.vector.co.jp/authors/VA002374/src/download.html

you dont need to install the language pack if it asks you and download either one they are the same thing :)

If you need help finding drivers dont hesitate to let me know and I will give you a hand :)
I will probably just wait until tomorrow evening to do anything else. I have Belarc on my computer, I will just burn everything to a CD and put it on the laptop. Then I will use your links to see what I can find. Thanks!
your welcome ! :)
blackviper.com has suggestions on what to add or disable on services.
good luck
d_may
Thanks d_may, I have that site listed with many others in my bookmarks!  I really need to sort through them and get rid of some that I don't want/need.

Just wondering.. Is my using firefox causing the page to have to scroll across? Arrrgghhhh  

Gecko - I planned on logging in here to let you know that I have been going crazy and haven't done much of nothing on that laptop.
I got the dreaded bug that has been going around here and feeling like crap! So.. give me a few more days and I will see what I can get done!
Thanks for being patient with me.   Rhonda

>> Is my using firefox causing the page to have to scroll across? Arrrgghhhh  <<

No, it's that extra long link posted by Gecko.
:-)

Zee
LMAO @ the extra long link I posted. If its the one I think your reffering to then it shows her how to remove and add things to the laptop in question. BTW Dont worry about taking your time Rhonda.

If another browser ie Opera or Internet explorer does the same then it is just the way the website is, if another browser opens it without scrolls across then it might be firefox. But I am betting it is just the way the site is made :)

Anyway will hopefully hear from ya soon :) Good luck with getting better and fixing the laptop :D
It's definitely Firefox. I am using IE now and it is normal. lol

BUT... You may already use this, you can add a long URL and it makes it small. I have not used it but have seen where several people do.

http://tinyurl.com/
I have seen that ages ago but dont bother using it, I mean just for the sake of making a URL smaller when they both take you to the same place seems pointless to me.

I mean not like it is going to make the page smaller for firefox or IE or get rid of the scroll bars which you find annoying :P

Only reason I would use that is if I was in a rush and wanted to make a URL that I could remember whilst I was travelling or something like that.
Sorry again for taking longer than I had planned. I'm still sick and my mother is in the hospital (back surgery) so.. here's what I have decided to do. I am going to take the laptop back to my sister & brother-in-law and let them get their broadband set up on it. We will update everything there since it isn't detecting the modem. I am hoping that after we do that everything will be wonderful. ;-)  

As far as points go. I am giving them all to gecko because it was the best information in trying to help me. Blue-zee mentioned several things, but I had already mentioned in my original message >> * I have added and updated Spyware Blaster, ad-aware, AVG & zone alarm (zonealarm not up-dated - explained below).

Thanks a million for all of the help. I'm sure I will be back on EE for more help someday. Sometimes I just come here looking around.. trying to learn. Again, thanks and sorry I took so long.  Rhonda

Your very welcome for the help rhonda roo, I love helping people with computer problems as best as I can. I mean at the end of the day with computers everybody learns something new regardless how good they are. If you have any further problems, feel free to let us know and we will try and help you as best as we can !
Also I just wanted to say the best of luck with you getting better and if it is ok with you , give my regards to your mother and wish her the best with her back surgery !! My dad has had that done when I was a young kid so I have a reasonable idea of what it is like , more or less.

Anyway hopefully see you on EE soon or something :)
I went to your website just a few minutes ago.. LOL at the funny on there. I sent the link to my sister so she can see it. hehehe
LMAO, I am not sure if this is possible, but is there any chance of you sending me an email :) my email is on my profile :)

You will love the rubber ducky song and also if you go to the funny page and my jokes page :) I have pics of me on my site from when I was 20, I am now 22 and look slightly different, some of those pics are from me when I was in australia :D
btw - Let me know what your sister thinks of the site :D Also if you go to that web hazard site and the other one on my profile, they both have a lot of good stuff with regards to help on yours or someone elses computer. web hazard is for diff o/s's and has free downloads and good suggestions with regards to anti virus stuff, the guy who runs that site is a good friend of mine from yahoo chat help 2 :) His nicky is gully :) He very smart with computers !

I also know if you go to google and search for shields up, it has a bunch of useful utils on that site with regards to blocking RPC and other things for security wise and you can even test to see how good your security is with regards to open, hidden and closed ports on your computer :D btw it shows you your ip address on that website, dont be alarmed by that :) Just so you are aware :D
sent you an email