Having trouble just keeping my computer going [Solved]
Posted 17 May 2012 - 08:27 PM
Posted 18 May 2012 - 07:05 PM
I'm not sure why the command in Setp 3 wouldn't work for you. It works fine for me. But we don't need it anyway because the Farbar scan revealed the problem. System Restore has been set to Disable in the registry. The malware probably did that. What puzzles me is why OTL didn't catch it. Oh well, that's why we have more than one tool to look for things.
We are ready to wrap this puppy up, believe it or not. We're gonna fix System Restore and clear all of the old restore points just in case there is some more malware hiding there.
Then we're gonna update your out of date programs, clean up the tools we've used and I'm gonna give you a few suggestions that can help make your system more secure.
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the Protection tab
Remove the tick from "Start with Windows"
Reboot and start with number 1. below to run the OTL fix.
1. Please copy all of the text in the code box below. To do this, highlight everything
inside the code box , right click and click Copy.
:Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR"=DWORD:0 :COMMANDS [EMPTYTEMP] [CLEARALLRESTOREPOINTS]
Warning: This fix is relevant for this system and no other. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
2. Please re-open on your desktop.
3. Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).
Be sure to post the OTL fixes log in your next reply
Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older versions of Java components and update:
- Please download JavaRa to your desktop from one of the links below:
- Unzip JavaRa to its own folder on the desktop.
- Double click the JavaRa.exe file to run it, pick the language of your choice and click Select.
- Then click Remove Older Versions.
- Accept any prompts.
- Open JavaRa.exe again and select Search For Updates.
- Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
- Download and install the latest Java Runtime Environment (JRE) version for your computer.
- The latest Java version is JRE SE 7u4
Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy.
- Go to Start > Control Panel > Add/Remove Programs
- Remove ALL instances of Adobe Reader
- Re-boot your computer as required.
- Once ALL versions of Adobe Reader have been uninstalled, download the latest version of Adobe Reader from Here.
- Click the box next to Yes, install McAfee Security Scan Plus-optional to remove the check mark.
- Click the Download Now button to download Adobe Reader and follow the directions.
If the updates went OK we can continue. It they didn't, or some other problem surfaced, STOP and let me know.
If everything went OK:
Very Good Job! Here is the best part of the process! The mullygrubs are gone! That's a technical term for your log(s) appear to be clean! If you have no further issues with your computer, please proceed with the housekeeping procedures outlined below.
The first thing we need to do is to remove all the tools that we have used. This is so that should you ever be re-infected, you will download updated versions.
1. Please re-open on your desktop.
- Be sure all other programs are closed as this step will require a reboot.
- Click on
- You will be prompted to reboot your system. Please do so.
1. Please click Start > Control Panel > Add/Remove Programs
2. In the list of programs installed, locate the following program(s):
ESET online Scanner
3. Click on each program to highlight it and click Change/Remove.
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.
Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)
1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) in red (if present):
2. Close Windows Explorer.
Delete files from the Desktop
Please delete the following files from the desktop (if present):
Delete any other .bat, .log, .reg, .txt, and any other files created during this process, and left on the desktop and empty the Recycle Bin.
Below, I have included a number of recommendations for how to protect your computer against future malware infections.
:Keep Windows Updated:-Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically.
XP Users: You must use Internet Explorer to Update Windows.
1. Click Start> All Programs, in the programs window that comes up, look for Windows Update toward the top of the list and click it.
:Turn On Automatic Updates:
1. Click Start, click Run, type sysdm.cpl, and then press ENTER.
2. Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them
: Keep Java Updated :
- Click the Start button
- Click Control Panel
- Double Click Java - Looks like a coffee cup. You may have to switch to Classical View on the upper left of the Control Panel to see it.
- Click the Update tab
- Click Update Now
- Allow any updates to be downloaded and installed
: Keep Adobe Reader Updated :
- Open Adobe Reader
- Click Help on the menu at the top
- Click Check for Updates
- Allow any updates to be downloaded and installed
:Make your Internet Explorer more secure:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to "Prompt"
6. Change the Download unsigned ActiveX controls to "Disable"
7. Change the Initialize and script ActiveX controls not marked as safe to "Disable"
8. Change the Installation of desktop items to "Prompt"
9. Change the Launching programs and files in an IFRAME to "Prompt"
10. When all these settings have been made, click on the OK button.
11. If it prompts you as to whether or not you want to save the settings, click the Yes button.
12. Next press the Apply button and then the OK to exit the Internet Properties page.
Using an alternative web browser can help protect your PC from infections which exploit security holes within Internet Explorer. They can also be quicker to load pages and offer more tools and features such as Firefox's huge addon list.
Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has a great built-in pop up blocker. If you are interested, Click Here To Download Firefox
If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- WebOfTrust - a safe surfing tool for your browser. Traffic-light rating symbols show which websites you can trust when you search, shop and surf on the Web.
- McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
:Install the MVPs Hosts File:
- MVPS Hosts file-replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
Preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running a full scan at least once a month. Run Quick Scans at least once a week. Download the Free versions. And update the definitions before running scans.
- Malwarebytes-Free Version- a powerful tool to search for and eliminate malware found on your computer.
- SUPERAntiSpyware Free Edition-another scanning tool to find and eliminate malware.
- SpywareBlaster-to help prevent spyware from installing in the first place. A tutorial can be found here.
- SpywareGuard-to catch and block spyware before it can execute. A tutorial can be found here.
- WinPatrol - will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. Help file and tutorial can be found here.
It's a good idea to clear out all your temp files every now and again. This will help your computer from bogging down and slowing. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.
========TEMP File Cleaners========
- TFC by OldTimer-A very powerful cleaning program for 32 and 64 bit OS. Note: You may have this already as part of the fixes you have run.
- CleanUP-Click the Download CleanUP! link. There is also a Learn how to use CleanUP! link on this page.
- Keep a backup of your important files.-Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
- ERUNT-(Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
:Keep Installed Programs Up to Date:
Secunia Software Inspector-It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.
Finally, please read How did I Get Infected in the First Place(by Mr. Tony Klein and dvk01)
I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.
I Will Keep This Open For About Four Days, If Anything Comes Up - Just Come Back And Let Me Know
Posted 22 May 2012 - 02:20 AM
Posted 23 May 2012 - 06:42 AM
Posted 25 May 2012 - 05:28 AM
All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\\"DisableSR"|DWORD:0 /E : value set successfully!
========== COMMANDS ==========
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Temp folder emptied: 6187 bytes
->Temporary Internet Files folder emptied: 919872 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 48702586 bytes
->Google Chrome cache emptied: 228917474 bytes
->Flash cache emptied: 1320 bytes
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 619521 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16823 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 1825 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 266.00 mb
Restore point Set: OTL Restore Point
OTL by OldTimer - Version 126.96.36.199 log created on 05252012_065323
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Posted 30 May 2012 - 02:25 AM
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users