[Ihatemalwaretoo]

Hi Ron,

Please see attached screen shot.

The bottom group that relate to OTL I am guessing I can Delete, same with the first item? Shall I also delete the System Volume Information?

The computer seems to be acting normally the only odd thing is that ever since this infection the battery seems to now being by-passed and I nee to have the mains power lead plugged in all the time to keep PC on, there is also no battery icon that is usually displayed in the bottom right hand side of the screen, if there anyway of restoring this so that the battery can be used?

Regards
Steve

Attached Thumbnails

• 

[Advertisements]

Hi Ron,

Please see attached screen shot.

The bottom group that relate to OTL I am guessing I can Delete, same with the first item? Shall I also delete the System Volume Information?

The computer seems to be acting normally the only odd thing is that ever since this infection the battery seems to now being by-passed and I nee to have the mains power lead plugged in all the time to keep PC on, there is also no battery icon that is usually displayed in the bottom right hand side of the screen, if there anyway of restoring this so that the battery can be used?

Regards
Steve

Attached Thumbnails

• 

[Ihatemalwaretoo]

Hi Ron,

Please see attached screen shot.

The bottom group that relate to OTL I am guessing I can Delete, same with the first item? Shall I also delete the System Volume Information?

The computer seems to be acting normally the only odd thing is that ever since this infection the battery seems to now being by-passed and I nee to have the mains power lead plugged in all the time to keep PC on, there is also no battery icon that is usually displayed in the bottom right hand side of the screen, if there anyway of restoring this so that the battery can be used?

Regards
Steve

Attached Thumbnails

• 

[Ihatemalwaretoo]

Hi Ron,

Please see attached screen shot.

The bottom group that relate to OTL I am guessing I can Delete, same with the first item? Shall I also delete the System Volume Information?

The computer seems to be acting normally the only odd thing is that ever since this infection the battery seems to now being by-passed and I nee to have the mains power lead plugged in all the time to keep PC on, there is also no battery icon that is usually displayed in the bottom right hand side of the screen, if there anyway of restoring this so that the battery can be used?

Regards
Steve

Attached Thumbnails

• 

[RKinner]

It didn't find anything except files in Qoobox, OTL and System Restore so it doesn't matter what we do with them. They can all be deleted or we can take care of them in our cleanup which I suppose is the next step.

We need to clean up System Restore. Follow Jim's procedure here:
http://aumha.net/vie...581099691bf108f


You can uninstall or delete any tools we had you download and their logs.
To uninstall combofix, copy the next line:

"%userprofile%\Desktop\george.exe" /Uninstall

Start, Run, cmd, OK then right click, Paste, then hit Enter.

Run OTL again and choose the cleanup tab.

To hide hidden files again:

XP

# Close all programs so that you are at your desktop.
# Double-click on the My Computer icon.
# Select the Tools menu and click Folder Options.
# After the new window appears select the View tab.
# Uncheck the checkbox labeled Display the contents of system folders.
# Under the Hidden files and folders section select the 'Hide protected operating system files (recommended)' option.
# Check the checkbox labeled Hide protected operating system files.
# Press the Apply button and then the OK button and shutdown My Computer.


Nake sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat. Adobe is fond of foisting GetPlus and a McAfee scan on you. You can let them install them and then afterward, go into Control Panel, Add/Remove Software and remove them. It probably doesn't hurt to leave them but I really hate foistware.

Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program. There is an exploit out there now that can use it to get on your PC. For Adobe Reader: Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript. OK Close program. It's the same for Foxit reader except you uncheck Enable Javascript Actions.

I recommend you install the free WinPatrol from http://www.winpatrol.com/download.html

It's a small program that will sit in your systray and warn you if something tries to make changes to your system.

If you use USB drives you might want to install Autorun Eater v2.5.
http://download.cnet...4-10752777.html
Another small program which will stay resident and prevent an infected USB drive from infecting your PC.

If you use Firefox then get the AdBlock Plus Add-on. WOT (Web of Trust) is another you might want to try.

If Firefox is slow loading make sure it only has the current Java add-on. Then download and run Speedy Fox.
http://www.crystalidea.com/speedyfox. It seems to work best if you reboot right after running it. You can run it any time that Firefox seems slow.

Be warned: If you use Limewire, utorrent or any of the other P2P programs you will almost certain be coming back to the Malware Removal forum. If you must use P2P then submit any files you get to http://virustotal.com before you open them.

If you install the MVP Hosts file:
http://www.mvps.org/...p2002/hosts.htm
it will keep you from going to most bad sites. You do not need Spybot's Immunize which does the same thing.

If you have a router, log on to it today and change the default password!

For your battery problem I would go to your PC maker's website and look for the program. Give me your PC make and model and I'll look for you.

Ron

[Ihatemalwaretoo]

Hi Ron,

I have done the above, got slightly unstuck with the HOST file, I unzipped it then click on the .bat file, hit a key as prompted and nothing happened, nothing ran, and if I right click on the file location I can only open not option to run - not sure what I am missing with this section.

Pleas don't laugh when I tell you my PC details, it is a:

Compaq (HP)
Presario V6000

Thanks ever so much for your help.

Kind Regards
Steve

[RKinner]

Did you download and Save:

http://www.mvps.org/...p2002/hosts.zip

Right click on hosts.zip and Extract All?

click on MVPS.bat?

This MVP hosts file is not absolutely necessary so I wouldn't spend a lot of time on it. I doubt that you would see much happening. If you look at the hosts file with notepad:

Copy the next line:

notepad \windows\system32\drivers\etc\hosts

Start, Run, cmd, OK

right click and Paste or Edit then Paste and hit Enter and it should bring up the hosts file. If there are a lot of entries in it then it worked.

Ron

[Ihatemalwaretoo]

Hi Ron,

Thanks for that, there are a lot of entries so must have worked. Thank you.

With regards to the battery not being in use, I have reviewed the HP website and updated the BIOS, however this has made no difference and not sure what other help directories to follow.

The way it is acting as if something has been remove that even enables the computer to know that there is even a battery to use.

The help directory that I have referred to is:
http://bizsupport1.a...ectID=c01702473

The make of the PC is a COMPAQ V6133EU, would greatly appreciated it if you could directory to maybe an drivers that need to be installed to enable the battery to be recognized again.

Thanks ever so much,
Steve

[RKinner]

I looked at this page:
http://h10025.www1.h...ct=3263091#N210

I would try in this order:

Chipset:
http://h10025.www1.h...263091&sw_lang=

Power:
http://h10025.www1.h...263091&sw_lang=

Help & Support with Battery Test: (From a link off the page you gave)
ftp://ftp.hp.com/pub/softpaq/sp35501-36000/sp35567.exe

Battery Verifier for a recall:
http://www.hp.com/su...teryReplacement

Ron

[Ihatemalwaretoo]

Hi Ron,

Thanks for this, I have downloaded the top two and the third when I tried to download I received the attached error.

On rebooting the PC I am now getting a power cable icon appearing in the bottom RHS of the screen, however it continually said 25% left in the battery no matter how long you charge it and when you unplug the battery it died. Since I have had the PC a while I have had to replace the original HP battery once, I replaced the latest battery I bought which had been working fine (this was not bought from HP) with the old original HP battery and this has begun to charge from 0% upwards so might have something to do with HP now not allowing this battery to be recognized as not an original HP one, not sure whether that is possible with the recent items we have downloaded.

When I look at My Programs, My Documents and My Favourites, they are all blank, as if nothing stored there, however if I try to save anything or create a folder with the same name I get a prompt saying that that folder already exists, same with Internet favourites, so it would appear that all my documents and favourites and there somehow in the background, is it at all possible to make these and the original programs visible? Basic applications like Microsoft Accessaries/Applications where paint, calculator etc are also no longer selectable from the Start menu is it possible to get these returned along with the likes of Excel, Powerpoint etc, they seem to be installed on my PC as I am able to open .xls and .ppt files received.

Also oddly, since performing the above I can no longer get on the internet, when I click on the Explorer icon I get the The Page Cannot be Displayed message and inserting and extracting the ethernet cable there is no icon appearing in the bottom RHS. I have checked my Network Connections under My Computer and there is a connection under the Broadband section ticked as my default but when I try and connect through it I get the attached error? No I need to re-configure or set-up another connection to get back on-line? (I am able to send this messages via a friends computer who is able to connect to my provider so the fault appears to be with my PC).

Thanks ever so much,
Steve

Attached Thumbnails

• 

[RKinner]

First make sure that your network card is still enabled.

Start, (Settings,) Control Panel, Network Connections. Right-click on the icon that represents how you connect to the Internet: Local Area Connection or Wireless Network Connection and select Enable. If you don't see Enable but instead see Disable then try Disabling it then Enabling it. IF that doesn't help then right click and select Properties. Make sure it says Connect using Nvidia something if it is the Local Area Connection and Broadcom if it's the wireless. Click on the Configure button and under General make sure it says Use THis Device (Enable) then go to Power Management and unclick the option to save power. Go back to the Properties screen and make sure you have Internet Protocol (TCP/IP) then click on it and select Properties. Make sure it says Obtain an IP address automatically. Also Obtain DNS server address automatically.

If that doesn't help:

(Start) Right click on My Computer and select Manage. Select Device Manager. In the right pane find Network Adapters and click on the + in front of it to expand. Right click on each item in the Network Adapter section and Uninstall. Reboot.

Ron

[Ihatemalwaretoo]

Hi Ron,

Thanks for the speedy reply.

After following your 2nd paragraph I spotted that there was an ! under NVIDIA Network Bus Enumerator and so installed the drivers and that seems to have worked. Thanks ever so much for that direction.

On a less positive note, using the old battery has not been fruitful it eventually charged to 100% however on removing the mains it only lasted a few seconds before it drained, like it did before it was replaced so I guess no surprise there. The replacement battery when re-installed just states 25% charged however it never increases in charge and when you remove the power supply the PC dies. Is it possible that anything either through the virus or the upgrades that we have done have meant that the computer is rejecting this battery as it is not from HP, this wasn't happening before however was wondering whether that is possible at all? Is therefore maybe something we need to uninstall, I have a HP printer and that sometimes only recognizes HP cartridges just a thought as the original HP seemed to charge as you would expect all be it not hold its charge?

Any idea with regards to the folders that appear to be recognized by the computer but are not visible to me?

Thanks a lot,
Steve

[RKinner]

Hidden Folders is easy:

2. Enable Show Hidden Files and Folders

If using Windows XP:

* Close all programs so that you are at your desktop.
* Double-click on the My Computer icon.
* Select the Tools menu and click Folder Options.
* After the new window appears select the View tab.
* Put a checkmark in the checkbox labeled Display the contents of system folders.
* Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
* Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
* Remove the checkmark from the checkbox labeled Hide protected operating system files.
* Press the Apply button and then the OK button and exit My Computer.
* Now your computer is configured to show all hidden files.

[Online tutorial: http://www.bleepingc...utorial62.html]



I think for the battery question you might have more luck with the hp forum
http://h30434.www3.h...e/bd-p/Hardware
since I have no clue why it doesn't work.

Try this (which I found on the forum) first:

First of all, shutdown the notebook, unplug the AC Adapter unplugged, remove the battery, and then hold down the Power button for a full minute.

Now, plug in the AC Adapter and start the PC without the battery inserted, start the notebook, open windows Control Panel, open Device Manager, expand the entry for Batteries, right click on and the Microsoft ACPI Compliant Control Method Battery and select Uninstall - do not uninstall anything else here. When the uninstall is complete, shut the PC down, unplug the AC Adapter, re-insert the battery and then start the PC on just the battery. Windows will automatically reinstall the driver - leave Windows running for a few minutes. Shutdown the PC again. Now plug in the AC Adapter ( with the battery still inserted ) and start the notebook to see if this has helped the issue at all.

[Ihatemalwaretoo]

Hi Ron,

Thanks a lot for looking into this for me, given that the old battery is recognized I think it might be a fluke but perhaps the latest battery has just happened to have died at the same time as this infection. So I think it might pay for me to get another battery.

With regards to the "hidden" folders, I might have not used the best possible words, this one is rather odd, rather like not seeing any programs at all under Start, or seeing Microsoft Accessories with paint, calculator etc under it, the computer is recognizing all my older folders, favourites and file names as if I go to say a favourite or file name using a name that I have used in the past (even though My Documents and Favourites is blank) I am unable to as I am advised that the file/folder already exists. This is with the hidden folders already being made visible by checking the right boxes and still I can't see the folders that it is making reference to. So I think this is a bit of a freaky one. Unless you can think of any why to search and see if such files exist I think I can simply save future folders with diff names and although I would like to see the original files/folders and favourites it is certainly not the end of the world. Ever come across something like this before?

Kind Regards
Steve

[RKinner]

I'm still not clear on exactly what the problem is. Can you give me a step by step? and an example of a file or folder that is missing?

Ron

[Ihatemalwaretoo]

Hi Ron,

Apologies for the late reply I have been out of the country recently.

I have attached a .jpg which hopefully makes the problem a little clearer. Before the problem I had a folder called "Company" when I look in My Documents it is completely empty, however when I try and save a folder with the name Company I get the attached message as if the folder already exists. I currently have settings to display all hidden folders so it is as if there is something a little more mischievious going on here.

I also have the same problems with My Programs, no Programs are showing up in the folder too, but I am able to access all the Microsoft office applications like .xls etc When I go to the Start button and look up My Programs I only see as per attached.

Thanks ever so much,
Steve