[wannabe1]

Can you post me a new HiJackThis log?

[Advertisements]

Edited at the request of wannabe1

Edited by Keith, 28 April 2006 - 04:46 PM.

[leanneqld]

Edited at the request of wannabe1

Edited by Keith, 28 April 2006 - 04:46 PM.

[wannabe1]

Before we go any further, you need to get a log posted in Malware. I can't even run my analyzer on the HJT log without pulling alerts from my AV application. Hits on a Bloodhound trojan. Get it cleaned up so we can work on it.

[leanneqld]

hi, I'm back. I got the thumbs up from the malware people
Also I have installed a wirless card to the problem pc so it is now online

Now that i have taken out the video card, everytime I log on there's a search for new software to install for the new hardware.
The cd-rom drive as gone from d: drive to E: drive(not a problenm though is it?)

[wannabe1]

You can probably reinstall the video card now it should work fine. Devices, particularly Network cards and Video cards can cause a lot of problems during installs and inplace upgrades.

Looks like OwNt got rid of a lot of junk! That last log wouldn't even load in my analyzer....

Bring me up to speed...Are there any major issues now? The cd drive letter is no biggie..we can change it if you need to, but we'll need to look at the Drive asignments in Windows Management before we do that.

Tell me how it's running and what you percieve as problematic.

[leanneqld]

HI, from the malware posts...
"Second, it looks like your google toolbar and norton antivirus installation are damaged, you may wish to re-install both after we are finished."
I would like to remove all of Nortons and put AVG on there as I'm not sure if they want to renew nortons.
Can you help with this or back to malware as i have heard nortons isn't straightforward to remove.

Next, having used the repair option over and over and moving files and all our previous work, is it ok now to start uninstalling all the useless programs that were installed?

Also, i want to remove all the extra user accounts and just leave 1, if i remove the others does that get rid of all their files/folders or do i have to manually do that?

and lastly, the only forseeable problem is reinstalling the graphics card...but i will give it a go and see what happens.

[wannabe1]

Norton is a pig in "oh so many ways"...Try to remove it from Add or Remove Programs. Remove the main application first. Then remove Live Update...then Live Reg. After all this machine has been through, It's going to shred when it uninstalls, so run SymNRT and then SYMMSICLEANUP to finish it off.

You should remove the Google toolbar, too. You should be able to do that from Add or Remove Programs, as Well. (Use Firefox...it has the Google Toolbar features built in.)

Yes, you can remove the applications we've used that you don't think you'll need again. You know where to find them should they be required again.

When you remove the unwanted user accounts, you will be given the option to delete each user's files...XP does a pretty good job of doing that on it's own. Just make sure the remaining account has full Admin permissions.

Reinstalling the video card shouldn't be too bad. I would suggest going to the manufacturer's website and downloading the most recent drivers for it first...that might eliminate any headaches if it comes on looking all "goofy"

When you've done all this, run Disk Cleanup and Disk Defragmenter from System tools to tidy up the drive.

You should be good to go after all this... ...Have your friend be a little more careful what they download and where they download from. Most of this issue was caused by the malware infection. It was the worst I have seen in quite a while.

If you have any problems or questions...come back to this thread. I will be subscribed to it for 14 days of inactivity. After that, either start a new topic or PM me that you have posted to this one.

Well Done! This was a tough one...you did great!

wannabe1

[leanneqld]

I think "we" did great......now let the fun begin

Cannot remove nortons from add/remove , "uninstallation has failed"The uninstallation encountered an error and was unable to remove the application.

Nortons internet security.......again cannot remove via add/remove..."to remove NIS or reset your password click ok, then click the programs change button"i did that and then i got this message
"a norton internet security account with supervisor access must be logged in to uninstall this product. If NS is not running, click the start menu, select and log in"

Next..tried to remove MSN Music vis add/remove.."error: could not locate the inf file c:\windows INF\msninstal.inf

Unable to remove google toolbar via add/remove...i click on that and nothing happens at all

and a couple of other things listed in add/remove i can't get rid of

[wannabe1]

Run SymNRT on the Norton applications and follow up with the SYMMSICLEANUP...that should do away with the Norton.

Reinstall the Google toolbar and then uninstall it...

Many of the entries in Add or Remove Programs are probably just a registry entry for the program that is not really there. We faily well hacked this machine to pieces with all the stuff we did to it. When we replaced the registry hive, we effectively removed many of the applications referred to. To remove the entry in Add or Remove, do the following.

Open Registry Editor and expand HKEY_LOCAL_MACHINE, then SOFTWARE, then Microsoft, then Windows, then CurrentVersion, and finally Uninstall

Under this key will be a bunch of numeric keys. Click on them one at a time and look in the right pane for the entry "Display Name"...if the value for Display Name is one of the programs you want to remove from Add or Remove Programs, delete the numeric key in the left pane.

Let me know how you do with this....

[leanneqld]

ggrrrr....from the NRT.....
"manual application removal"
the following programs were found. these must be removed through add/remove programs before Norton RT can proceed
"Norton internet security or personal firewall 2003 or earlier"

so I tried to launch NIS from the shorcut on the desktop and get a norton ANTIVIRUS internal program error message followed by the windows installer popping up and preparing to install which it can't of course
so, how do i get rid of NIS?????

[wannabe1]

Sorry...didn't realize you had the early version on there...

Run RNav2003 on it.

[leanneqld]

not your fault, they had too much crap on there.....but it looks like its nortons INTERNET SECURITY thats 2003 and NAV is 2004....RNAV2003 wouldn't work

i have to somewhow get rid of NIS 2003 before i can get rid of NAV2004

[wannabe1]

Must be really shredded. Run RnisUPG.exe and see if that will pull the pieces out.

[leanneqld]

BINGO, hip hip hooray....that worked....now i tried to run symNRT but it said instances of live update and reg were running and i had to end that first...how do i do that..i ctri-alt-del and looked at the processes..found a navapsvc.exe but wasn't sure whether to end that or not

[wannabe1]

Click Start, then Run, type services.msc, and click "Ok".

Look in the list for LiveUpdate and LiveReg...double click on each and choose "Stop". Look for any other Norton or Symantec entries and stop them, as well.

Edited by wannabe1, 29 April 2006 - 07:26 PM.