Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

trojan win32genericBT,downloader3.10443,startpage.1505,winlock3251


  • Please log in to reply

#61
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP
As far as Office is concerned I think that's a lost cause. If you look at your uninstall list it doesn't even show up:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07295ABF-1245-415A-BE06-863271753443}" = ShowBiz
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = RecordNow Update Manager
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{1EEE2A9F-6471-42fa-8923-E8879168CE26}" = HP Photo and Imaging 1.1 - Photosmart Cameras
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Productivity Pack
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{385DD1DD-65AA-408D-8E70-74601C2DB7E6}" = Ad-Aware
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47D4AF7B-EDE6-4ADB-8D2F-0BDA25C7321F}" = HP Digital Imaging Album Printing 1.0
"{60E971B7-51A0-48CA-8687-C6B8F094A409}" = Simple Backup for My Pictures
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6CAEFA23-0C08-4899-A661-29D69228AF6D}" = HP Memories Disc
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{8214CC02-6271-4DC8-B8DD-779933450264}" = RecordNow
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver Software
"{8D5D99B8-DFA2-4018-ADE9-A6B83E655C65}" =
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{B43357AA-3A6D-4D94-B56E-43C44D09E548}" = Microsoft .NET Framework (English) v1.0.3705
"{BC0EE7F1-32DE-4EE2-BE10-AE15DB394E84}" = PigPen
"{BDE90251-93EB-4F6A-89D8-086E2D91DC56}" = Coloreal
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{EEF397AC-DAEF-4C04-90A9-5B2BD31875DC}" = Simple Installer - Multilanguage Version
"{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"ArcSoft Software Suite" = ArcSoft Picture Software
"avast" = avast! Free Antivirus
"DivX Setup" = DivX Setup
"HijackThis" = HijackThis 2.0.2
"hp instant support" = HP Instant Support
"HPTOOLKIT" = toolkit
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"Inactive HP Printer Drivers (Remove only)" = Inactive HP Printer Drivers (Remove only)
"InstallShield_{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"LiveUpdate" = LiveUpdate 1.80 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework Full v1.0.3705 (1033)" = Microsoft .NET Framework (English) v1.0.3705
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"S3Display" = S3Display
"S3Gamma2" = S3Gamma2
"S3Info2" = S3Info2
"S3Overlay" = S3Overlay
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"VLC media player" = VLC media player 0.9.8a
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"WordPerfect Productivity Pack" = WordPerfect Productivity Pack
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome


So whatever you did before you came here has killed it dead.

(If you haven't already you should uninstall:
Adobe Acrobat 5.0 super obsolete and dangerous to have.)

It will not hurt my feelings at all if you go over to the XP forum:
http://www.geekstogo...p-2000-2003-nt/
and post there. You can point them at this thread so they can see I think you are malware free.
  • 0

Advertisements


#62
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Thanks for the quick reply and the referral to the XP forum. I didn't know about that forum. But, I have a couple of questions before I move on to another person.

1) As for MS Office, I know it seems to have been wiped clean, but I still have the icons in their C Drive folder. When I click them, it opens, but then closes after giving me the mesg. So it seems that some resemblance of the program still exists. Is this a false assumption?

2) Is it possible to copy the version I have on my laptop to my desktop? Laptop has windows vista with word 2007. I had word 2003 (I think) and XP.

3) As for the blue screen error message, it all started 1 or 2 days after you had me change the registery key from 0 to 1. Could that be the culprit? i changed it back to 0, but am still getting the screen. Btw, I get the screen only when I shut down the computer. The computer goes into normal shut down mode, closing everything, and going to the normal blue screen with windows logo that says "shutting down" and then right at the moment it would shut down (or restart as has been the case recently for this machine), it gives me the error message. So any thoughts along the lines of the registery change causing the problem?

4) Last question. As for the shut down/restart/stand by not-highlighted problem, it all started a few days after dl SP3. Could this be the culprit? I have many system restore points, so I'm thinking maybe this is the best way to correct the shut down and error screen problem, but I want to avoid this route because I have installed some updates and programs since installing SP3. Anyhow, would this be a solution?

Thanks again for all your time and help. Eric
  • 0

#63
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP

1) As for MS Office, I know it seems to have been wiped clean, but I still have the icons in their C Drive folder. When I click them, it opens, but then closes after giving me the mesg. So it seems that some resemblance of the program still exists. Is this a false assumption?


There may be some folders left but it appears the essential files are gone.

2) Is it possible to copy the version I have on my laptop to my desktop? Laptop has windows vista with word 2007. I had word 2003 (I think) and XP.



It's not likely you can copy an installed program to a different computer. You can however, as I said before, install Open Office which gives you pretty much the same thing as Office 2003. http://download.openoffice.org/

3) As for the blue screen error message, it all started 1 or 2 days after you had me change the registry key from 0 to 1. Could that be the culprit? i changed it back to 0, but am still getting the screen.



Don't see how it could cause the bluescreen since you put it back like it was. If you remember you said you got several Windows updates installed at the same time. One of them may be incompatible with your old keyboard driver. Remember we also told windows to stop on a blue screen and not reboot when we started troubleshooting the restart instead of shutdown problem. Apparently you were getting a blue screen and didn't know it before and now you do so they were right that the automatic reboot on a crash was part of the problem. Since you don't believe me when I tell you you have a bad keyboard driver there is not much I can do for you.

Btw, I get the screen only when I shut down the computer. The computer goes into normal shut down mode, closing everything, and going to the normal blue screen with windows logo that says "shutting down" and then right at the moment it would shut down (or restart as has been the case recently for this machine), it gives me the error message. So any thoughts along the lines of the registery change causing the problem?


We can look to see if you really put it back the way it was:

Copy the next line:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /s > \junk.txt

Start, All Programs, Command Prompt
then right click and select Paste or Edit then Paste. The copied line should appear. Hit Enter.

notepad \junk.txt

Compare to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
AutoRestartShell REG_DWORD 0x1
DefaultDomainName REG_SZ YOUR-RVLNHR6V8D
DefaultUserName REG_SZ Owner
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0

4) Last question. As for the shut down/restart/stand by not-highlighted problem, it all started a few days after dl SP3. Could this be the culprit? I have many system restore points, so I'm thinking maybe this is the best way to correct the shut down and error screen problem, but I want to avoid this route because I have installed some updates and programs since installing SP3. Anyhow, would this be a solution?


it all started a few days after dl SP3


If it didn't happen right after installing XP SP3 then it is unlikely to be the culprit. I would be more inclined to look at some of the updates that came later.
To back out of SP3 requires uninstalling SP3 then running System Restore to get back to a known state. The XP techs probably have more experience in this area than I do.
  • 0

#64
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Ron,
This is Eric. I don't know if you still check this thread or will get signaled that I have added another comment, but if you do, could you please let me know that you got this? I wanted to mention 2 things:
1) You were dead right about the logitech driver. Congrats. After all these months, I just solved the last major problem and it turned out to be a bad mouse driver. I can't believe something that simple reeked so much havoc on my machine for so long. So, my computer is finally back up to 100% and working practically better now than before the crash. A big thanks to you.

2) I have 2 other small problems with some video clips on an external drive that won't play and nobody on this forum will help me. Could you?

Thanks and congrats again at successfully restoring an older machine with a lot of problems. Eric
  • 0

#65
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP
Got your post OK.

Where did you get the video clips that won't play (download, own camera, dvd or what?) and what are you trying to use to play them? What extension do they have?

Have you tried with VLC? It will usually open anything. http://www.videolan.org/vlc/
  • 0

#66
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Hey Ron. Good to hear back from you.

I have a simple tech external drive, 500G. I recently saved some WMP video clips, from the same web site, directly onto this external drive in ONE folder over the course of about 10 days. There are about 100 clips. The clips saved the first few days will open with no problem, but the clips saved the later few days get the following error:

"Windows Media Player cannot access the file. The file might be in use, you might not have access to the computer where the file is stored".

All other clips stored on this drive in any folder play with no problem. I also cannot copy or delete or rename any of the clips that won't open. I have VLC player and Media Classic Player, but neither will open the files that won't already open in WMP.

I have searched online for a solution, but have only found that maybe I need to change some sound settings in control panel, disabling enhancements, which I have not found as an option on my version of XP. I have also found information about security tabs and sharing, but have not changed anything yet nor does that seem to get at the real problem. I also found some comments about having to "take control of the drive". I don't understand this either, especially since I've already stored videos on this drive, in this folder and they play with no problem.

So, I'm really coming up empty here. My inet research suggests there could be something wrong with the HDD, not the player. However, I cannot find any definitive solution to this problem. Do you know anything about this? Thanks again for your time.


Edited by luminix, 17 January 2012 - 12:00 PM.

  • 0

#67
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP
If you can't access the file to copy or rename it then you probably have a bad spot on the hard drive.

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check,
Reboot.
The disk check will run and will probably take an hour or more to finish.
  • 0

#68
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Ron,
I ran the error-checking, but instead of giving me the mesg you mentioned, it ran completely and finished. I did not see any report. I then rebooted with the ext. HDD connected and it did NOT go to disk scan. It booted normally. Later in the day, I did another reboot and again, no disk scan.

I went into the HDD and the affected video clips still did not open and I still got the same error message.

just FYI (maybe this will help?) - all the affected dl clips are saved in the same folder. There are about 100 clips. The first 30 or so clips that were dl play fine. The problem is with the last 70 (chronologically speaking that is). Only they get the error mesg. Also, the folder they are in is the second to last folder I ever created on this HDD. The "last" folder I created is currently empty and was created minutes after I received the first error messages. So, practically, all the affected video clips are located in the last folder created on the drive and 30% of those clips in this folder open fine but the last 70% have a problem.

This is the exact copy and paste of the error mesg: "Windows Media Player cannot access the file. The file might be in use, you might not have access to the computer where the file is stored, or your proxy settings might not be correct."

Another idea? Thanks. Eric

PS - logging off now
  • 0

#69
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP
Can you copy one of the files to your desktop? If you have one which is not too long can you zip it up and attach it? If neither works in regular mode try Safe Mode with Networking
(Reboot and when you see the maker's logo, hear a beep or it talks about F8, start tapping the F8 key slowly. Keep tapping until the Safe Mode Menu appears and choose Safe Mode with Networking. Login with your usual login.)

Get Process Explorer

http://live.sysinter...com/procexp.exe

Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator). Click once or twice on the CPU column header to sort things by CPU usage with the big hitters at the top. File, Save As, Save. Open the file Procexp.txt on your desktop and copy and paste the text to a reply.
  • 0

#70
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Ron,
Once again, you got it. I fixed not only the problem i wrote you about, but another, similar, problem that I also had. The issue was in the security settings of the folders that I had to fix in safe mode. I have no idea what went wrong, but I figured out myself how to change the permissions to give myself access to those files. Thanks to you, I tried in Safe mode as you suggested and finally found the problem after some work. Once I learned how to make the changes, it was quite easy. In fact, you've turned me onto an important feature of windows that i never knew about before. this feature will also be able to help me with another issue I've had for many years, but never knew how to fix it.
So, I really think that's it. If you glance back at the original list I had in August, everything has been fixed except for MS office (I still wonder if I can't somehow activate the program using some .dat /.bat files (or similar) that I have on my laptop. I'll check into it). Anyhow, I got realplayer installed finally and at the moment, the machine is really working great - maybe better than before the crash. Again thanks so much for all your help. It's so nice to know there are people like you who give up their time to help others who've they've never met all as a volunteer. If I can recommend or commend all your help to some"place" or "one", I'd be really happy to do it.
Thanks again, Eric
  • 0

Advertisements


#71
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Ron,
How are you? I have another question. Do you anything about a "tinakey"? I can't find anything good about it on the inet.

The other day, in the middle of a 2hr skype all, my computer shut down suddenly, giving me the blue screen similar to before. You correctly told me then that it was because of a bad mouse or keyboard driver. So, I went make into device manager, and sure enough, there is a yellow warning sign next to "tinakey", but it doesnt tell me what program is using it and I can't find any info as to what it is for.

I have had no other problems with the compu except for the one occurrence mentioned above. Any light you can shed on this would be again appreciated. Hope all is well. Thanks. Eric
  • 0

#72
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP
tinakey.sys appears to be a virus:

http://f.virscan.org/TINAKEY.SYS.html

In Device Manager, right click on it and Uninstall. Reboot. Does it come back?
  • 0

#73
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Thanks for the reply. Clicking on your link didnt give me anything. Just a bunch of weird characters. What was it supposed to be?

Ill try the uninstall and reboot now. Is it possible to get a virus in hardware devices? I thought everything in device manager referred to hardware items. Maybe I'm just showing my ignorance here.

Will post back. Thanks. Eric
  • 0

#74
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,776 posts
  • MVP
The link is not working for me any more either.

Viruses often install fake drivers which can be seen in Device Manager. It's actually a place we always look for viruses tho we have tools like Combofix, OTL and DDS that do the looking for us.
  • 0

#75
luminix

luminix

    Member

  • Topic Starter
  • Member
  • PipPip
  • 84 posts
Thanks for the explanation. I had no idea.

Well i uninstalled it and it didnt come back after reboot. Anything else I should do? Should I monitor Dev mang every week for a month?

Just fyi, I run Kaspersky (auto updated) which is supposed to be quite good at catching viruses. Any idea how Kasp missed this one?

Thanks again for the help. Eric
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP