[CompCav]

Yes and please do the following steps to check for any individual malware components:


Step 1.

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application. Please do not accept the trial right now. We just want to run it on demand.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Step 2.

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Vista / 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on:

If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the following instructions work with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow Add-On/Active X to install.
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Step 3.

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Step 4.

Please post:


mbam log
eset log
security check log

Please give me an update on how your computer is doing!

[Advertisements]

I did everything you asked but I messed up one thing, I accepted the Malwarebytes trial version. Sorry.

Here are the 3 logs.

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.30.01

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Chris' laptop :: CHRISLAPTOP [administrator]

4/29/2012 8:58:53 PM
mbam-log-2012-04-29 (20-58-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 196576
Time elapsed: 6 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK


Results of screen317's Security Check version 0.99.32
Windows 7 x86 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java™ 6 Update 21
Java version out of date!
Adobe Reader X (10.1.3)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

[helpme1962]

I did everything you asked but I messed up one thing, I accepted the Malwarebytes trial version. Sorry.

Here are the 3 logs.

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.30.01

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Chris' laptop :: CHRISLAPTOP [administrator]

4/29/2012 8:58:53 PM
mbam-log-2012-04-29 (20-58-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 196576
Time elapsed: 6 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK


Results of screen317's Security Check version 0.99.32
Windows 7 x86 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java™ 6 Update 21
Java version out of date!
Adobe Reader X (10.1.3)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

[helpme1962]

OH, I fogot to update you as well, everything seems to be working well except of course the unvalidated windows.

[CompCav]

We need to update Java.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

[helpme1962]

IM not getting very good results. After removing the old version, a pop up says it can not find the logfile, do I want to create a new one. I answer yes but a blank notepad opens. Then when Im looking for the laterst version of java and I choose search their website, and ie page opens but does not connect to anything. I the get the internet exporer can not find the webpage message.

Please advise.

[CompCav]

Upgrade Java : (32 bits)

• Download the latest version of Java SE Runtime Environment (JRE) JRE 7 Update 4 .
• Under the JAVA Platform Standard Edition, click the "Download JRE" button to the right.
• Accept License Agreement.[/b]".
• Click on the link to download Windows Offline Installation 32 bit ( jre-7u4-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista or Win 7 users, right click on the jre-7u4-windows-i586.exe and select "Run as an Administrator.")

[CompCav]

Also when you do Windows validation it may have to replace some files:

Tampered File: %systemroot%\system32\wat\watadminsvc.exe
Tampered File: %systemroot%\system32\wat\watweb.dll
Tampered File: %systemroot%\system32\wat\npwatweb.dll
Tampered File: %systemroot%\system32\wat\watux.exe
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
Tampered File: %systemroot%\system32\drivers\spldr.sys

If the validation does not take by just inputting your key you may need to call Microsoft at the number that comes up or 1-866-530-6364 for Windows 7.

Regards,

CompCav

[helpme1962]

Everything worked will. Windows is now validated. FYI, the windows product key for Dell laptops is under the battery. If you remove the battery, its in plain sight. Windows validated without a hitch. I didn't appear to replace any files that I could see. Java is downloaded as well. Whatever I had must have disabled java updated. My desktop is still black, perhaps my display settings were reset.

[helpme1962]

Well, I thought everthing was good. I got a pop up stating I am not running genuine windows 7 and do I want to resolve online? I said yes, it went through a validation scan and in about a minute, it brought me to a page to either purchase a genuine copy or to troubleshoot. I went to the troublesshoot tab and my option was to reinstall windows 7 if I have the disk and product key. I don't know why its asking me this since I already validated with my product key. There must be some files missing or moved. In order to reintall windows 7, its telling me I need to back everything up and I will loose my programs, files, etc.

I really was trying to avoid this.

[CompCav]

Windows is now validated.

Great!

My desktop is still black, perhaps my display settings were reset.

This should be easy to fix just right click in an open space on the screen and select Personalize
You can select any of the themes that show and then close the window and you are done.

Regards,

CompCav

[helpme1962]

Did you see my next post about windows validation pop up?

[CompCav]

Yes hold on and I will post!

[CompCav]

If you have a Windows 7 SP1 disk we can try to clean up the "tampered" files.

If you do not have the disk then call Microsoft at the number listed in post #112


To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt[*]Select Command Prompt
[*]Type sfc /scannow and press ENTER
[*]Once it completes, reboot and reenter the key if it still does not stay valid call Microsoft.
[/list]

[helpme1962]

I have the resinatallation dvd Windows 7 professional, 32-bit that came with this laptop. Is this what you mean? I also created a Dell OS Restore disk as requested by dell when I took delivery of this machine.

I want to open this subject with you as well since it appears we may be headed down this path.

1) I have a seagate 1.5tb external hard drive that was hooked to this laptop up until Friday when I took this laptop home to troubleshoot it with you.
2) I did not hook it back up this morning when I got in the office for fear I might have a virus backed up on it and I didn't want to transferr it back onto this laptop. Is that possible?
3) I imagine most of my stuff is backed up into the various history folders on this external hard drive but I dont know how to reinstall all that stuff back onto my laptop, would you be able to help me with that if it comes to it?
4) Should I hook that external hard drive back up now so It saves what we have done already?

Please advise,

Chris

[CompCav]

I have the resinatallation dvd Windows 7 professional, 32-bit

Does it say SP1 on the package, if not do not use it call Microsoft.

2) I did not hook it back up this morning when I got in the office for fear I might have a virus backed up on it and I didn't want to transferr it back onto this laptop. Is that possible?

Possible and even probable. Please do not reconnect it until you have cleared up the windows validation issue.

3) I imagine most of my stuff is backed up into the various history folders on this external hard drive but I dont know how to reinstall all that stuff back onto my laptop, would you be able to help me with that if it comes to it?

Depending on the complexity I can help, if not you can get help in our Applications or Windows 7 forums.

4) Should I hook that external hard drive back up now so It saves what we have done already?

We need to resolve windows validation first.