[emeraldnzl]

Oh, we have lots of options yet.

First though lets clear out your temp files just in case there is something in there blocking things.

Go to Start > Run and type in %temp% click Ok. To delete all in one go you can use hold down Ctrl and press A. Then press Delete. There will most probably be one or two that won't delete. That's Ok just leave those ones and move on to delete the rest.

Although I think it unlikely you could try to see if MBAM will run.

Next

Uninstall ZoneLabs ZoneAlarm and all its components. Then reboot.

Try running Malwarebytes after that.

If that works come back and post the log. If not follow the actions below.

Now while you say you don't have AVG* anymore it is showing up in your logs as live so I am still of the opinion that something is going on there.

Hopefully removing ZoneAlarm does the trick but if not. Please go to Add or Remove Programs in your Control Panel and see if AVG or Grisoft shows up anywhere and if so uninstall it. We will replace it with another good AV.

Again see if Malwarebytes will work after that.

[Advertisements]

Since it seems my registry is bad (i cant open my exe. files)
What do you think of this: "http://support.microsoft.com/kb/555067 ". The only thing is, after it's done it says that changes to the computer are not reversible, and that scared me from following thru with it.

Oop's I just seen what you last wrote and I'll try that.

Edited by GordonW, 04 February 2009 - 04:28 PM.

[GordonW]

Since it seems my registry is bad (i cant open my exe. files)
What do you think of this: "http://support.microsoft.com/kb/555067 ". The only thing is, after it's done it says that changes to the computer are not reversible, and that scared me from following thru with it.

Oop's I just seen what you last wrote and I'll try that.

Edited by GordonW, 04 February 2009 - 04:28 PM.

[GordonW]

Cleared the Temp. files and Uninstalled ZoneAlarm, tried MBAM and still no luck.

AVG wont let me delete it. Below is what it says when I try:

Installer initialization failed due to following error:
Error: @AvgErrorCode_0x0253 %FILE% = "C:\Program Files\AVG\AVG8"
@AvgErrorCode_0x0020

It wont let me Install/Reinstall it either. Files are missing because I tried to uninstall earlier in 2008.

Edited by GordonW, 04 February 2009 - 06:26 PM.

[emeraldnzl]

What do you think of this: "http://support.microsoft.com/kb/555067

Yes I am aware of this.

There are three possibilities as I see it:

1. Malware is causing this. We have tried a couple of things that would have either got around that problem or fixed it. There are a lot more things we can try here but we also have the other possibilites and my plan has been to elimate the most likely at each step.

2. You may have conflict going on with some security programs. This one has been high on my list because ZoneAlarm is known to cause problems on some computers and AVG8 also has some issues. You tell me that AVG8 has been removed and yet I see it still active in your logs. Has to be one to investigate early on.

3 You may have corrupt system files. There are a range of ways to deal with this. Most of them, at least, in the beginning carry little if any risk.

So my thinking is that you should try the removal of ZoneAlarm and see if AVG8 is showing up in Add or Remove programs. It is easier to remove it that way if we can. If it is not there you could run a search Start > Search (the one with the magnifying glass) for AVG and Grisoft and delete everything you find. This may not deal with registry entries which removing via uninstall should do but it may remove enough to free up your computer.

After that, as I say we have a whole list of options. Unfortunately at this point I see no way of doing this any way but by elimation which as you probably know can take a long time.

[emeraldnzl]

I see our posts crossed.

Next on the list is to go to the link below and download Microsoft Malicious Tool remover.

http://www.microsoft...ve/default.mspx

After you have installed an run that come back and tell me if there has been a change.

[GordonW]

Hey Emerald, I deleted ZoneAlarm and what I could of AVG\Grisoft,

but, the program that you want me to open now, well, something isn't right, surprise, what should the
program be opened with (file?)?
Right now it's set to Firefox and that's not opening it.
At the pop-up it asks - "open with" or "save file".
On "open with" it's set at Firefox, what should that be set at?

[emeraldnzl]

It should just be a matter of doing the following:

1. Click the Download button on this page to start the download.
2. Do one of the following:
* To start the installation immediately, click Run.
* To save the download to your computer for installation at a later time, click Save.
* To cancel the installation, click Cancel.

I take it that when you click run it is trying to use Firefox to open the exe. in which case I think you have corrupt system files.

Lets try this then:

Please run System File Checker, to make sure your protected files are not corrupt.

The scan will automatically replace any corrupt files that it finds.

Click Start
Select Run
At the prompt type sfc /scannow Please note that there is a single space between sfc and /scannow.

Typing this will start the program, and a box should appear telling you how much longer the process should take.

Sometimes the scan will prompt you for your Windows XP disc upon starting the scan. if this happens please make sure that you can view protected files:
My Computer
Tools
Folder Options
View
"Uncheck" Hide protected operating system files.

Then rerun the scan. If this still asks you to put in your windows XP CD, and you do not have the CD (If you bought it preinstalled) post back for more tips, otherwise enter Windows CD.

Once the scan is complete:

Check your Windows Updates! After using the File Protection Service, you might need to reapply some updates.

Please reboot, and let me know if anything has changed.

Also, please rehide the protected files:
My Computer
Tools
Folder Options
View
"Check" Hide protected operating system files.

[GordonW]

Yeah, when I click run it's trying to use Firefox.
Tried to run System File Checker both ways, but it does want a CD.
When you go to open and run something, what does your comp. use? Just curious, with all this going on it's a good possibility I changed it.

[emeraldnzl]

Well I am not a tech guy but my understanding is that an exe file is a progam and should just run when you click run unless it's incompatible say because you have a 64 bit machine.

I take it you do not have access a Windows CD for that machine?

Here is another solution that might work. Go to the link below and download exefix XP.com.

http://windowsxp.mvps.org/exefile.htm

Double click to run it.

[GordonW]

Same invalid notice, but my nephew has the Windows CD and he's looking for it. He lives close by and I'll
try that and let you know if that worked.

[emeraldnzl]

Okay, I am thinking now that the best aproach for your machine is a Repair Installation.

You do need the CD for this, hence my earlier question.

Please go to Windows Repair to learn how to undertake Windows Repair Install.

You will not lose data on your computer using this process.

It is a way to repair your operating system.

You will lose your Windows Updates and your drivers will revert to the original version but you can catch up on these.

[GordonW]

Did the windows repair and things are still the same. Someone had the idea of maybe
reformatting the computer, which doesn't sound like fun.

[emeraldnzl]

Well reformating is an option.

You will lose all your data.

I will see if any of my colleagues have any ideas.

Won't be back today though.

[emeraldnzl]

Oh actually I have just thought of one thing we might try.

Another different approach altogether. Its a way of getting around the exe thing.

Do you have access to another infection free computer to download to. If you do please follow the instructions below:

This is a version of Dr Web CureIt which is named launch.exe. Download it to a clean machine and save to a removable device like a flash drive or similar or alternatively burn to a CD. Then transfer to the infected computer.

Important - you must rename the Dr Web CureIt from launch.exe to launch.com before you save it to the infected machine. You can do this by right clicking on the folder and selecting rename.

Another thing: You will see when you read the Dr Web site preamble that this utility automatically reads your operation system. You will most likely be presented with an adapted interface so you will have to "wing it" (adapt my instructions) to fit the situation.

Download Dr.Web CureIt to the desktop:

• Doubleclick the launch.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.

Post the results of the Dr Web scan back here.

[emeraldnzl]

Hello again GordonW,

I must be having some sort of epiphany. I have just remembered that you were able to run that comand to get rid of the temp files.

Please delete your version of ComboFix, including the folders C:\Qoobox and C:\Combofix, and download a new version of Combofix.

Please download ComboFix from one of these locations:

NOTE: If you are guest watching this topic. ComboFix is a very powerful tool. The disclaimer clearly states that you should not use it without supervision. There is good reason for this as ComboFix can, and sometimes does, run into conflict on a computer and render it unusable.

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  Run ComboFix using these instructions:
  
  Click the Windows 'Start' button > Select 'Run' - then copy/paste the following bolded text into the run box & click OK.
  
  "%userprofile%\desktop\combofix.exe" /killall
  
  When finished, it will produce a log for you. Post that log in your next reply.

edited to correct formatting

Edited by emeraldnzl, 05 February 2009 - 12:04 AM.