Solved

Prevent Anti Virus

Posted on 2010-08-31
33
339 Views
Last Modified: 2012-05-10
I am working on a friend's Window's XP service pack 3 computer. I am trying to clean it of suspected viruses. When I attempt to run an antivirus program or a virus cleaner I recieved messages that the program virus data could not be updated or the program encountered a problem. I have unsuccessfully tried to run Stinger, MS Malicious Software, Security Essentials, Avast and RemoveIT Pro v4--SE. I have attached examples of the messages I recieve. I have also tried all of the above in Safe Mode with the same result. Now, rarely, as in the case of running Malicious Software Removal, it did run for 26 minutes and before it finished ... the computer shut down and rebooted. It shuts down and reboots frequently for no obvious reason.
Gene-Error-Messages-Etc.doc
0
Comment
Question by:Dave_Molinaro
  • 17
  • 8
  • 6
33 Comments
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33573327
Try a bootcd with virus fixes such as AVG or Panda. Try combofix. Try malwarebytes. You have a rootkit that is shutting you down.

Look for proxy servers blocking updates. You might be better off to backup and format/reinstall.
0
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33574969
Do you have an internet connection from browser ?
0
 

Author Comment

by:Dave_Molinaro
ID: 33575388
I have an internet connection with browser.
I am not familiar with bootcd with virus fixes. I know of AVG and Panda. Not familiar with combofix. I did download and install Malwarebytes and it has been running for 6 hrs 45 min; scanned 74,990 files and hasn't detected any infected objects yet.
I do not know how to look for proxy servers.
I have in the past done a format and reinstall. I will ask my friend if she has the XP cd.
0
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33575568
run services.msc
and restart automatic updates and bits
0
 

Author Comment

by:Dave_Molinaro
ID: 33575944
I have restarted auto updates at least three times over the past day or two. I am not familiar with bits.
0
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33575983
Background Intelligent Transfer
0
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33576447
The most likely scenario for a random shutdown is a bad spot on your hard drive. When the scanner gets inside it, your computer freaks. Could have corrupted some system files too. Run a CHKDSK /r and see if your situation improves.
0
 

Author Comment

by:Dave_Molinaro
ID: 33576501
I have the results of the MalwareBytes software program. It ran for about 9 hours and found 6 infected items. See attached for the details please. Do I now need to run any other software?
I checked the Start Menu and it looks like there is some suspicious files there...ctfmon and NvCpl. See attached for details. Thank you.
Gene-Clean-Up-Messages.doc
Start-Up-Menu-with-suspect-files.doc
0
 

Author Comment

by:Dave_Molinaro
ID: 33579211
I ran the chkdsk. Once it finished it just left the screen so I could not read any results. Is no news good news? Is a log kept somewhere? Have you reviewed my most recent attachments? Thank you.
0
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33579714
Go to >
Start > Administrative Tools > Event Viewer

click "Application" on the left

In column "Source" on the right half of the window, look for "Winlogon".
On the same row, "Event" matching 1001 is the que pasa on chkdsk.

Doubleclick that line matching both Winlogon and 1001.

--

also, those problems on malwarebytes don't look severe enough at all. try combofix. (www.combofix.org)
0
 

Author Comment

by:Dave_Molinaro
ID: 33582421
I have attached the ChkDsk log. Everything looks OK there?
I ran ComboFix and have attached the Interrupt message that popped up a total of nine times, once at the very end as ComboFix was preparing its log. This message is identical to the message that popped up when I attempted to run other malware cleaning tools. However, this time application didn't stop running. I would click on Close...the message would go away and ComboFix would continue on. I have also attached the ComboFix log which I am not capable of interpreting.
Chkdsk-Gene.doc
ComboFix-Interrupted-Messages.doc
ComboFix-Log.txt
0
 

Author Comment

by:Dave_Molinaro
ID: 33582620
Update. Just tried to run RemoveIt. It ran for a few minutes and then the computer shut down and rebooted. Attached find the "infections" that RemoveIt found before it was shut down.
Running-RemoveIt-Issues-After-Co.doc
0
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33582994
Looks like you certianly had some file system issues. Has speed improved? Have you done a manufacturer diagnostic on drive? Combofix didnt find anything important. Removeit is false positives.

I say your drive is bad. Try a new one, or a diagnostic.
0
 

Author Comment

by:Dave_Molinaro
ID: 33583112
Thanks for staying with me on this one. I discovered that Avast can do a boot scan which is taking place as I type. There seems to be several "CAB archive is corrupted". I will get you the final results.
What is a manufacturer diagnostic? How do I do it?
0
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33583156
Look inside your case. Look on your hard drive. You will see a manufacturer name. "Seagate" or "western digital"

Go to the respective website and download their diagnostic utility for windows.

Check the drive, if it reboots during that its probably a very bad drive.
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 

Author Comment

by:Dave_Molinaro
ID: 33585479
It's a Maxtor, now Seagate. When I ran the diagnostic, a message came up that read, "Error: Msi launch conditions failed. Installation aborted". The diagnostic would not complete. I tried it twice. Would trying it in Safe Mode make any difference.
0
 

Author Comment

by:Dave_Molinaro
ID: 33590465
Can you poiint to directions on how to download and burn a [Admin Edit] disc? Thank you.
0
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33590653
[Admin Edit] is a pirated software, it seems it violates EE rules (!)
0
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33593063
If you hold the licenses for the software it certainly is not. The hard drive diagnostics are available from maufacturers website and are consentual as long as you own one of their drives.
0
 
LVL 2

Expert Comment

by:jtokarchuk
ID: 33593074
But, as I was not aware that this was a gray area, here's the link for seatools on CD:

http://www.seagate.com/ww/v/index.jsp?locale=en-US&name=seatooldreg&vgnextoid=480bd20cacdec010VgnVCM100000dd04090aRCRD

burn the iso to a CD.
0
 

Author Comment

by:Dave_Molinaro
ID: 33597516
Hi, I will get to the seatools this evening. I hope that they have directions on how to burn an iso. Thank you.
0
 

Author Comment

by:Dave_Molinaro
ID: 33601062
the seatools experience was a good one the HD passed both the Short and Long test....so would I be correct in saying that we have some form of malware that is shuting the computer down...like a rootkit? I am going to see if I can do the [Admin Edit]. There is the Startup item that will not go away and shows on some web sites as a virus...NvCpl.dll, NvStartup. I have taken it out of Startup and the Registry but it keeps coming back.
0
 

Author Comment

by:Dave_Molinaro
ID: 33601702
I ran [Admin Edit]. Super Anti-spyware ID'd Rootkit.unclassified/usbhubB....security.hijack and adware tracking cookie. [Admin Edit] When I rebooted I was told that I didn't have a genuine copy of Windows XP. I went to the MS Update site and it would not work. Please help!!!
I have attached the hijack this log....will you be able to read it or should I resubmit it?
hijackthis.log
0
 
LVL 2

Accepted Solution

by:
jtokarchuk earned 250 total points
ID: 33605422
Sounds to me like something got corrupted by your virus. Have you done an SFC /scannow after the repairs? If nothign else works, you can try this tool from safe mode w/networking :

www.reimage.com

it's more or less an automated XP repair tool. Works on Vista/7 as well.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.1.*

seems odd -- do you have a proxy set?

If your windows is saying you are not genuine, do you have the option to reactivate? try a system restore?
0
 

Author Comment

by:Dave_Molinaro
ID: 33614403
I have been out of cell phone and wireless contact since leaving for trip from which I will not return until this Thursday the 9th. I again have access to my friends computer and address this major problem with you and Expert Exchange. Why after using [Admin Edit] was a perfectly valid copy of XP rendered invalid.
0
 

Author Comment

by:Dave_Molinaro
ID: 33643036
I am running sfc now and am continually asked to insert the XP CD which my friend does not have.
The reimage tool costs $70 which I don't think my friend can afford.
I do not know what a proxy is. My friend wouldn't either.
How do I determine if reactivate is possible?
I have restore points of 9/1 and 9/3.
0
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33643725
Doesn't anyone of your friends have XP CD ? You can try restore point but you asked a question 31/08. Determine which files sfc wants and try to dowlnoad them through internet, taking attention to the pages you're downloading them from.
0
 

Author Comment

by:Dave_Molinaro
ID: 33645468
Thanks for the comeback.
I have a copy of Windows XP Professional that goes with one of my computers. Could I use it while running sfc on my friend's XP Home Edition comjputer? It would be great if I could.
I am not quite sure what "but you asked a question 31/08" means. Can you please clarify for me.
Thanks a  lot.
0
 
LVL 27

Assisted Solution

by:Lukasz Chmielewski
Lukasz Chmielewski earned 250 total points
ID: 33645556
"I have restore points of 9/1 and 9/3."
the question is from 8/31. I don't think you can use XP PRO cd  instead of HOME. You can take a shot though, the system is corrupted either way.
0
 

Author Closing Comment

by:Dave_Molinaro
ID: 33665027
I was able to locate a Windows XP Home Edition and ran sfc /scannow. I did this twice over the past two days. The computer seems to be OK at this point. It is also completely updated.
Although I award the points to one person, a couple other experts helped out along the way.
Thank you all for sticking with me on this sticky issue.
0
 

Author Comment

by:Dave_Molinaro
ID: 33920335
Vee_Mod,
Thanks. I have split the points.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

These are on the increase and getting more common these days. Users who use the Google search engine may complain of having their search redirected to unwanted sites, regardless of what browser is used. This happens when the system is infected with…
When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now