[70delboy]

Dell desktop, Windows 7 Home, IE 8, AV Sophos
For a couple of weeks I have noticed that most .pdf files fail to open with an error 57 message. Not all pdfs though. Some which were previously on the desktop still open fine, but any pdf attachment in email for example, always fails.
Eventually I thought I should do something about it. I suspected an update to an earlier version of Reader might be to blame so I decided to uninstall it and then reinstall. Used Control Panel to uninstall and it appeared to work correctly (desktop icon removed). When I went on to reinstall I found that the download from Adobe did not work, by which I mean the download Run/Save box showed, then the file permission box asked to allow the file to be loaded, then nothing. Tried again after halting the AV scan without success.

Read a few 'help' files on various boards (including Adobe) and attempted a fix or two. However most solutions required some diagnosic software to be downloaded and as I quickly found no downloads worked!

At this point I used Restore to roll back to a earlier time but within the 60 day period the original pdf problem still exists.

The computer otherwise seems to work normally, although I have noticed it occasionally 'seizes up', for a minute or two before resuming from where it stopped. The AV is up to date and scans regularly. MS updates are installed when available, athough there have not been any for some time.

I have run out of ideas so any assistance would be much appreciated.

Thanks

[Advertisements]

Hi

I'm not sure... can you download files?

Please download Event Viewer Tool by Vino Rosso (VEW) and save the file on the Desktop
- Execute the VEW tool and check the following options:

• Select Log to Query
  * Application
  * System
• Select type to list
  * Error
  * Information
• Number or date of events: 20

- Press Run
Post the log in your reply.


Lets check some Windows services...

Download Farbar Service Scanner
- Run FSS
- Check all the options
- click Scan

Post the generated log on your reply.

[SleepyDude]

Hi

I'm not sure... can you download files?

Please download Event Viewer Tool by Vino Rosso (VEW) and save the file on the Desktop
- Execute the VEW tool and check the following options:

• Select Log to Query
  * Application
  * System
• Select type to list
  * Error
  * Information
• Number or date of events: 20

- Press Run
Post the log in your reply.


Lets check some Windows services...

Download Farbar Service Scanner
- Run FSS
- Check all the options
- click Scan

Post the generated log on your reply.

[70delboy]

font="Arial"][/font]

Hi... thanks for your response.

Sorry to be negative but one of my major problems is that currently I cannot download any file!

I realise this severely limits diagnostics, but a thought...would it be possible to download the file on my laptop and transfer it to the desktop with a USB memory stick? Is that a possibility?

delboy

[SleepyDude]

font="Arial"][/font]

Hi... thanks for your response.

Sorry to be negative but one of my major problems is that currently I cannot download any file!

I realise this severely limits diagnostics, but a thought...would it be possible to download the file on my laptop and transfer it to the desktop with a USB memory stick? Is that a possibility?

delboy

Hi,

Not a problem. Yes you can use a USB flash drive but before doing that let me ask some questions.
Don't use the USB yet because there is a chance of your computer is infected and we don't want to infect both computer if it's the case.

- Can you tell me exactly what happens when you try do download the files?
- Which browser are you using to download? Do you have the download problem with all the browsers?

[70delboy]

Hello again
Point taken, using usb stick would not be a good idea at this stage.

To answer your questions.

No.1 If for example I wanted to download CCleaner, I would go to Piriform's website
and click the START DOWNLOAD button. This brings up the File Download Security Warning box showing the filename and asking Run or Save. Also showing is the Getting File Information box which shows the download progress bar for when I press Run or Save. After pressing Run the file shows it has downloaded and a yellow bar appears at the top of the browser screen saying IE has blocked the download site for Security reasons and click for options. If I select download file then the same two boxes appear again asking if I want to Run or Save the download. And that's as far as I get. No AV warning about changes to the hard drive etc and no sign of the file.
Running the same process on the laptop installs the program normally.

No.2 I am using IE 8. It's the only browser I have installed as I never have needed an alternative.

Is that enough detail for you?
Thanks
delboy

[SleepyDude]

Is that enough detail for you?

Yes. Thank you.


I would like you to create a file that we will use to do some registry modifications to see if it fix the problem

• Run Notepad, click Start Menu > All Programs > Accessories > Notepad
• Copy & Paste all the lines of text from the next box to the Notepad Window
  

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments]
  "ScanWithAntiVirus"=dword:00000001
  

• save the file on Notepad to the Desktop by clicking File > Save As
• name the file as RegistryFix.reg and change the box Save as type to All Files (*.*)
• execute the Registry changes by Double-click the RegistryFix.reg file you have on the Desktop
• next click Yes on the prompt "Are you sure you want to continue?" adding RegistryFix.reg to the Registry
• if everything work as expected you will see a windows with this: "The keys and values contained in ..\RegistryFix.reg have been successfully added to the registry."
• Try to download with IE again and let me know the result.

[70delboy]

Hi
Did what you said in your reply.
Ran the registry fix file from the Desktop, said Yes to the prompt and it came back with the Registry Editor message:-

Cannot import: C:\Users\Del\Desktop\RegistryFix.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor.

What next?
delboy

[SleepyDude]

Hi
Did what you said in your reply.
Ran the registry fix file from the Desktop, said Yes to the prompt and it came back with the Registry Editor message:-

Cannot import: C:\Users\Del\Desktop\RegistryFix.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor.

What next?
delboy

Hi,

Did you copy all the lines including Windows Registry Editor Version 5.00 to the Notepad window?

[70delboy]

Hi... blame the typist. I repeated your instructions and this time the reg update was successful.
Then tried the download of CCleaner again and it also was successful...hooray.

What did the registry mod do? Has it resolved my problem? Should I now run your original diagnostics or is it unnecessary?

Can I go on with removing Adobe Reader and reinstalling?

Thanks so far
delboy

[SleepyDude]

Hi... blame the typist. I repeated your instructions and this time the reg update was successful.
Then tried the download of CCleaner again and it also was successful...hooray.

Good. We use a work around I have seen this problem normally associated with AVG...

What did the registry mod do? Has it resolved my problem? Should I now run your original diagnostics or is it unnecessary?

The registry change instructed IE to not check the downloaded files, until the problem is resolved please check for virus all the files you download.
Yes, you should execute the diagnostic steps so I can check how is your system and maybe there is some clues about the download problem and the no new Windows Updates.

Can I go on with removing Adobe Reader and reinstalling?

Yes. Install the most recent version by visiting the Adobe Reader page, make sure you uncheck the box offering any extra programs like the McAfee Security Scan Plus.

Please execute also the following test:

• Download CatchOutput.zip
• Extract the zip file to the desktop and run the CatchOutput program inside
• on the text box copy & paste the command:
  

  dir "%systemdrive%\*" /S /A:L

  the Command Line (black window) will open for a moment (don't close it).
• the Command Line window will close by itself and Notepad will open with the result, please post the log on your reply.

[70delboy]

Hello again
Results of diagnostics
VEW Says if cannot locate C:\VEW.txt file so it can't save the results

FSS file attached

Catch Output file attached

I will try to uninstalling and reinstalling Adobe Reader next.

delboy

Attached Files

•  FSS.txt   5.43KB   210 downloads
•  CatchOutput.txt   250.72KB   203 downloads

[SleepyDude]

Hi,

The result of the command dir "%systemdrive%\*" /S /A:L show clearly that your computer is infected with the ZeroAccess Trojan!

Also the FSS log show that lots of windows services are damaged something very usual on this type of infection...

You should disconnect the computer from the internet and stop using it until the machine is cleaned.

Start a new thread on the Malware Removal section of the forum to get specific help on Malware removing. Before you post please read Malware and Spyware Cleaning Guide starting from step 2.

Please include a link to this thread so the helper that pick your case can know what has been done.

[70delboy]

Hi Thanks for your advice and assistance.
I have started a new thread and am already dealing with na new helper.

Thanks again
delboy

[SleepyDude]

Hi Thanks for your advice and assistance.
I have started a new thread and am already dealing with na new helper.

Thanks again
delboy

Thanks, you are in good hands.