[Canoeingkidd]

would it be possible to purchase windows xp home edition, install that, and rewrite everything so nothing involving this company would be on it?

Reformatting and reinstalling would give you a fresh start if you are comfortable with the idea. You would lose everything on your computer though...

OK. To restore the default welcome screen go to "Start" > "Control Panel" > "User Accounts" > "Change the way users log on or off". Check "Use the Welcome screen" and click "Apply Options".


Run Killbox:

• Double-click KillBox.exe to start KillBox.
• Select the "Delete on Reboot" option.
• Copy all of the following files files at once:
  
  C:\Program Files\nlao
  C:\Program Files\0mipec02
  C:\r.exe
  
  
• In Killbox go to "File" > "Paste from Clipboard."
• Click the drop-down arrow to the right of the "Full Path of File to Delete" box and make sure these files are there together.
• Click the red button with a white X on it.
• At the prompt entitled "Delete on Reboot" select yes.
• At the prompt entitled "Delete next Reboot" select yes.
• Your computer will reboot.

When your computer starts up you should get the welcome screen...what exactly are you having trouble with now?

Edit: added r.exe

Edited by Canoeingkidd, 22 July 2005 - 08:35 PM.

[Advertisements]

thanks for helping with the welcome screen, that works now too

but here's the problem...

C:\Program Files\nlao - won't delete
C:\Program Files\0mipec02 - won't delete
C:\r.exe - doesn't exist

[kagome54x]

thanks for helping with the welcome screen, that works now too

but here's the problem...

C:\Program Files\nlao - won't delete
C:\Program Files\0mipec02 - won't delete
C:\r.exe - doesn't exist

[Canoeingkidd]

Post a new HijackThis log...are you using the "Delete on Reboot" option?

[kagome54x]

okay i got rid of those last few things now. oh and with the welcome screen, it doesnt work. it just goes back when i close out.

Logfile of HijackThis v1.99.1
Scan saved at 2:59:11 PM, on 07/23/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Fidelity\Security Configuration\fconfsvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.optonline.net
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.co...a-ob-assets.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.co...a-ob-assets.cab
O16 - DPF: Checkers by pogo - http://game3.pogo.co...s-ob-assets.cab
O16 - DPF: Cribbage by pogo - http://game1.pogo.co...e-ob-assets.cab
O16 - DPF: Dice Derby by pogo - http://game1.pogo.co...g-ob-assets.cab
O16 - DPF: Dominoes by pogo - http://game1.pogo.co...o-ob-assets.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.co...l-ob-assets.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.co...o-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.co...g-ob-assets.cab
O16 - DPF: Payday FreeCell by pogo - http://game5.pogo.co...l-ob-assets.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.co...u-ob-assets.cab
O16 - DPF: Spades by pogo - http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.co...r-ob-assets.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.co...g-ob-assets.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121799624203
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Fidelity Workstation Configuration Service (Fconfsvc) - Fidelity Investments - C:\Program Files\Fidelity\Security Configuration\fconfsvc.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)

[Canoeingkidd]

I don't know whats with the Welcome screen but I'm looking for a possible solution. You seem to be clear of malware though so I'm posting some tips to prevent re-infection. You should update to Service Pack 2...it may even help some of your problems.


You need to prevent re-infection. I strongly recommend you take the following steps because infections are likely to reoccur unless you are protected (I post the same speech for everyone so you may have already taken some of these steps):

• Disable then re-enable System Restore. This will delete your old restore points. Malware could get backed up in System Restore. To do so in Windows XP see this tutorial. To do so in Windows ME see this tutorial. (If you are using a different Operating System skip this step).
  
  
• Keep up-to-date with the latest security patches from Microsoft. This step is VERY important. Please visit http://www.windowsupdate.com in Internet Explorer and if it asks to install software, let it. Start the scan for updates needed for your computer. Install all critical updates. When it prompts you to reboot, do so. Then repeat this process again until there are no more critical updates listed.
  You can also access the Windows Update site at any time by going to "Tools" > "Windows Update" in Internet Explorer. Please check for updates frequently.
  
  
• Install Antivirus software. It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. Two popular programs are AVG and Avast. Both have free versions for home users. Do not have more than one active antivirus at a time.
  
  
• Install a Firewall. Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. Please see Understanding and Using Firewalls. Do not use more than one firewall. If you are using Windows XP SP2 the rather poor Windows Firewall is enabled by default and you will need to disable it before installing another one.
  
  
• Install Ad-aware and Spybot-S&D and scan with them regularly. They will each catch items the other may miss and can clean some of the leftovers off since you have just been cleansed of an infection. Spybot-S&D also has some good prevention features. See these links:
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Stay away from Rogue/Suspect Anti-Spyware Products. "Rogue/Suspect" means that these products are of unknown, questionable, or dubious value as anti-spyware protection. See a list of known Rogue/Suspect Anti-Spyware Products compiled by Eric Howes at http://www.spywarewa...nti-spyware.htm.
  
  
• Install SpywareBlaster. SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. See the link below:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Install IE-SPYADS. This script will place an enormous number of web sites known to be abusive into Internet Explorer's "Restricted Zone". Any site in that list will be unable to run javascripts, java applets, set or read cookies or use ActiveX scripting. You still will be able to visit those sites but they will be very limited in what they can do.
  Download it from HERE. Read the "ReadMe.txt" included with the download for help installing it. You will need to download new versions occasionally and uninstall the old version.
  
  
• Keep these programs updated. If you do not they will not help you very much.
  
  
• Read the doxdesk prevention article at http://www.doxdesk.c...prevention.html for some more tips to prevent infection.

[kagome54x]

a while back i tried installing windows updates. unfortunately, it gives me this message each time:

Network policy settings prevent you from using this website to get updates for your computer.

is there any way i can still get the updates?

[Canoeingkidd]

I think it's a policy that was set on it before you got it.

Go to "Start" > "Run" and type gpedit.msc and click "OK".
Go to "User Configuration" > "Administrative Templates" > "Windows Components" > "Windows Update".
Double-click "Remove access to all Windows Update Features" and change it to "Disabled".

Try Windows Updates again.

[kagome54x]

it's disabled but i still get the same message.

Network policy settings prevent you from using this website to get updates for your computer.

[Canoeingkidd]

I've asked for help in the staff forum...Maybe someone else will have ideas...

[Canoeingkidd]

Please download exportpolicies.zip and unzip it to your desktop.

Run exportpolicies.bat and post the contents of the Notepad window that appears to here. It could be quite long...

[Canoeingkidd]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.