[Jordan H]

The windows update site still doesn't work. I ran the SFC with no problems. but when I go to windows update it says

[Error number: 0x80096001] The website has encountered a problem and cannot display the page you are trying to view

[Advertisements]

Hey Jordan

Thanks for the reply - please can you include the requested 'uninstall list' in your next post?

I need you to try the steps outlined in this Microsoft Support Article. Please read the instructions carefully and follow each step - after each step, see if your problem persists (i.e. you still cannot install programs (e.g. Spy Sweeper) and still cannot access certain websites). As the article explains, there could be several reasons for the problems you are getting. The 'Resolution' section explains how to action each step.

Good Luck

Please reply with the uninstall list and let me know how it went with the above instructions.

[infaddict]

Hey Jordan

Thanks for the reply - please can you include the requested 'uninstall list' in your next post?

I need you to try the steps outlined in this Microsoft Support Article. Please read the instructions carefully and follow each step - after each step, see if your problem persists (i.e. you still cannot install programs (e.g. Spy Sweeper) and still cannot access certain websites). As the article explains, there could be several reasons for the problems you are getting. The 'Resolution' section explains how to action each step.

Good Luck

Please reply with the uninstall list and let me know how it went with the above instructions.

[Jordan H]

I've done all of the steps in that article except for importing the certificates. I can't b/c there's no other computer for me to get them from.

I tried to use my HP safe reformat, but aparently whatever files it uses to reformat are all corrupted, b/c now i get this spyware popup I had early on. (which I fortunately know how to remove)

my uninstall log is as follows

Adobe Acrobat 5.0
ArcSoft ShowBiz
ArcSoft Software Suite
ATI Display Driver
Atomic Pop
Betty Bad
Blasterball Wild
Dark Orbit
Detto IntelliMover Demo
DivX
DivX Player
Easy Internet Sign-up
Efficient Networks SpeedStream DSL
Freedom Security && Privacy Suite
GemMaster 2
Google Toolbar for Internet Explorer
HijackThis 1.99.1
hp center
hp deskjet 930c series
HP DLA
HP Instant Support
HP Memories Disc
HP Photo Printing Software
HP RecordNow
Inactive HP Printer Drivers (Remove only)
Intel(R) 845G Chipset Graphics Driver Software
InterVideo WinDVD
IrfanView (remove only)
KBD
Kublox
Lernout & Hauspie TruVoice American English TTS Engine
LiveReg (Symantec Corporation)
LiveUpdate 1.7 (Symantec Corporation)
MarketBrowser
Microsoft Money 2002
Microsoft Money 2002 System Pack
Microsoft Works 6.0
Microsoft Works and Money 2002 Setup Launcher
MUSICMATCH Jukebox
Norton AntiVirus 2002
NVIDIA Windows 2000/XP Display Drivers
PC-Doctor for Windows
PigPen
PS2
Python 1.5 combined Win32 extensions
Python 1.5.2 (final)
Quicken Financial Center
SabreWing 2
Sonic Foundry Super Duper Music Looper XPress
SoundMAX
Space Rocks
Speedway
Tcl 8.0.5 for Windows
VERITAS StorageGuard
Virtual Warfare
Windows XP Hotfix (SP1) [See Q308387 for more information]
Windows XP Hotfix (SP1) [See Q308676 for more information]
Windows XP Hotfix (SP1) [See Q308677 for more information]
Windows XP Hotfix (SP1) [See Q309521 for more information]
Windows XP Hotfix (SP1) [See Q309691 for more information]
Windows XP Hotfix (SP1) [See Q311842 for more information]
Windows XP Hotfix (SP1) [See Q311889 for more information]
Windows XP Hotfix (SP1) [See Q312370 for more information]
Windows XP Hotfix (SP1) [See Q315000 for more information]
Windows XP Hotfix (SP1) [See Q315403 for more information]
WinRAR archiver
WordPerfect Office 2002 Try Before You Buy
WordPerfect Office 2002 Try Before You Buy
Zoom Player (remove only)

I suppose I should also inform you that I can't use any administrative tools directly. (IE: Computer management.) However, I can reach them by adding them as a snap-in with MMC.

Edited by Jordan H, 05 December 2005 - 09:21 PM.

[infaddict]

Hi Jordan

I've done all of the steps in that article except for importing the certificates. I can't b/c there's no other computer for me to get them from.

Ok good... did you check the state of your problems after each step? What were the results? Are you still having the same problems when installing programs (e.g. Spy Sweeper) and when using Internet Explorer on some sites?

I tried to use my HP safe reformat, but aparently whatever files it uses to reformat are all corrupted, b/c now i get this spyware popup I had early on. (which I fortunately know how to remove)

Ok, when did you use HP safe reformat? . Have you done this recently or are you referring to the safe reformat in your original post? If you have performed another safe reformat then you have wiped out all the changes we have made since your original post .

I suppose I should also inform you that I can't use any administrative tools directly. (IE: Computer management.) However, I can reach them by adding them as a snap-in with MMC.

Ok, so when you used the Event Viewer in a previous post, you did access it directly or my using the MMC?

In a previous post, gerryf asked you if you were an administrator or a normal user? Please can you let me know what level of account access you use on this computer? Also, is this a normal home PC or a networked PC with access controlled by administrators of the network?

Finally, how old is this HP computer? Are you using the original HP recovery CD supplied with the computer?

Edited by infaddict, 06 December 2005 - 06:42 AM.

[Jordan H]

I checked after I completed each of the other steps and the same problems persisted. (I can't install certain programs, I still can't visit what seems to only be secure websites.)

Um, I kinda did it again recently. >.<. Sorry. But after I did it I went through each of the steps we covered in this post again, and none of the issues you told me to previously removed were still lingering in my computer. However, I think that my doing the "safe reformat" is what got me into this whole mess. B/C I checked my Owner\application data folder, b/c I had surfed the internet and found a fix that involved that folder, and when I checked the folder it said access denied, and when I checked it's properties it said it was 0 Kb. I compared it with the same folder for other users (IE: Administrator) and I tried to copy the folder from Administrator into owner, but the system wouldn't allow me to.

I had to use MMC and add Eventviewer as a snap-in in order to access it.

And I am an Owner account (which I believe is also administrator, even though there are two different user folders for the two in documents and settings). My computer is a normal home PC.

My computer is, oh say, 4-5 years old (that's how long I've had it at least). It's an HP Pavillion 742c model.

[infaddict]

Hi Jordan,

Um, I kinda did it again recently. >.<. Sorry.

In future, please don't do anything drastic like a safe recovery, otherwise it is a big waste of our time - I have spent hours analysing your HJT logs, startuplists and other logs... they will have all changed now

I just want to look at one problem you are having first... the fact you cannot access certain secure sites. I need you to re-register some files again (this was part of the MS Support Article).

Click Start > Run, and then copy and paste each of the following lines, one by one, into the textbox, clicking OK after each one. After you click OK on each command, you MUST get a message similar to "DllRegisterServer ... succeeded" or another message which gives you an error.

regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 cryptdlg.dll


If you receive any error messages (e.g. file missing etc.) then you MUST give me full information about the errors.

After you have run all of the commands above, please restart your computer and re-try accessing secure web-sites. Also please provide a fresh HijackThis log.

Let me know how you get on

[Jordan H]

I've registered those dlls, unregistered and then reregistered them, and for each time I register it says regsvr32 has registered *dllfile* successfully. However, I'm still unable to access secure websites.

As for my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:28:39 PM, on 12/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\S3apphk.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\AutoStarterR.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [DSL Monitor] C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: customize__IE.lnk = C:\hp\REGION\customizeIe.wsf
O4 - Global Startup: MsnFixer.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133881502874
O17 - HKLM\System\CCS\Services\Tcpip\..\{59932E25-0A45-476C-A76E-D87F76C7CF68}: NameServer = 206.141.192.60 206.141.193.55
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

And before you say "you don't have zone alarm enabled" it was sucking up all of my computer resources (taking up all of the CPU time and Memory, almost to the point where other applications wouldn't run), so I stopped using it. I use the internet connection firewall option under my internet connection's properties.

20/20 hindsight
I found this at hp.com for my 742c. " Fix for Recovery Issue with XP Service Pack 1 " Maybe that's why all this mess has happened after I tried to do the safe recovery.

Edited by Jordan H, 07 December 2005 - 09:00 PM.

[infaddict]

Hi Jordan

Thanks for the reply.

Your PC is very very sick and I'm afraid to say it may not be possible to resurrect it without doing a clean install (i.e. re-format and re-install windows) . Note that I do not say this lightly and have only reached this conclusion after exploring every avenue and consulting with my fellow experts on your issues.

Also it is not clear if your major problems (i.e. cannot install most programs, cannot visit many websites) are malware related or are due to other system problems with Windows. Some of your symptoms point to root-kit viruses, but you cannot run rootkitrevealer or other programs that could help us identify if a root-kit was present. Sadly, malware can be very very destructive to a computer system .

I think we have 2 options that will provide the easiest and most sensible solution to your problem :

1) Perform a Windows XP repair installation. You need a Windows XP CD to do this. This repairs any corrupt or missing system files and resets system settings. This may get your system running better again, but if viruses or rootkits are present, they would still be present after doing this. You should not lose any documents or data, but I strongly advise these are backed up prior to doing this. If we get your system into a more usable state, we could then investigate if anything bad is left on your system.

2) Perform a clean install of Windows after formatting your Hard Disk. Your PC may have a HP partition that allows you to restore back to the factory original state (this way you don't need an XP CD). If not then you can format manually and reload Windows from CD. There are instructions on the HP website should we choose to go down this route. This method will ensure any malware is wiped clean from your system. Of course, with this option you will need to backup any important data or documents before you do anything.

Your top priority should be backing up any data and documents that you consider important. Are you able to write CD's using your system? If not, do you have a USB pen drive or similar that you could use to transfer documents to another clean computer?

Please let me know your thoughts on the above and how you wish to proceed. Also let me know if you have a Windows XP CD (and product key) and what other system/recovery CD's you have.

Cheers

[Jordan H]

I guess I'm going to have to go with option number two. However I don't have any Windows XP reinstallation CDs. All I have is the "HP Recovery Drive". Which I'm hoping hasn't also become corrupted. I've already tried the first option with the recovery drive to no avail. So all that's left is to reformat. I'll try to fit what I can onto my 2nd hard drive before reformatting, and I'll see if I can download Nero and burn some other info to DVD-Rs.

[infaddict]

Hey Jordan

All I have is the "HP Recovery Drive". Which I'm hoping hasn't also become corrupted

The recovery information is usually on a separate hidden partition of your hard drive. This partition is not visible to Windows, so I believe it should be clean and not infected.

I'll try to fit what I can onto my 2nd hard drive before reformatting, and I'll see if I can download Nero and burn some other info to DVD-Rs.

. Always bear in mind that any file you save from your infected PC could be infected. Therefore be careful what you do with them until you are able to run a good virus scan on them (preferably more than one virus scan). I would recommend backing up to CD-R or DVD-R, as you could then take them to another clean machine and easily run some online virus scans of the disks.

You will need to read and research how to do the actual restore installation for your PC. I found lots of useful information on your system at the HP webpage for the 742c. This includes user manuals if you don't already have these. This document explains how to do a System Recovery from Windows XP.


I wish you all the luck in the world Jordan. Let me know how you get on and post back with any questions... I am mostly a malware person but if I can help answer your questions, then of course I will

When you get sorted or when you have finished with this topic, please let me know so I can close it and keep the forum tidy.

[Jordan H]

Everything worked out pretty well, I only put my documents (which I scanned prior to doing so) on my second hard drive, disconnected it, and then reformatted using the HP full Recovery. And everything works like new, I was getting the messenger spam for a while, but I just deactivated it in services and now my computer works like new. Thanks for your help, and feel free to close this topic.

[infaddict]

Since your issues have been addressed and you are ready to travel the net again, I will just give you a few ideas on how to stay safe out there. Best of all these programs are all readily available on the net for free

To reduce the potential for spyware infection in the future, I strongly recommend installing SpywareBlaster and SpyWareGuard.

SpywareBlaster and SpywareGuard are by JavaCool and both are free programs. SpywareBlaster will prevent spyware from being installed and consumes no system resources. SpywareGuard offers realtime protection from spyware installation attempts.

More info and download is available at:

Spyware Blaster Spyware Guard

Might I suggest the following Free Spyware programs for added security, you can download them at the following links. These programs work great for detection:

Ad-aware SE--Adaware Tutorial

Spybot S&D--Spybot Tutorial

Antiviruses play an important role in keeping your computer safe and worry free while using the net. *NOTE* Only one antivirus must be allowed to run on your computer, as having two or more running can and will cause conflicts.

AVG Avast

Firewalls are also a must in any good prevention :

Zone Alarm Sygate Kerio

There are different browsers available on the net, other than Internet Explorer, we believe!! these are better for security purposes :

Firefox Opera

You must stay on top of your updates at all times, for the above mentioned applications.

It is vitally important to stay on top of your critical updates provided by microsoft.

This can be accessed by going to Windows Updates and following the prompts.

To add to the performance of your computer, i suggest a weekly maintenance program. Run this tool. Ccleaner

Lastly a second opinion on the Antivirus that you have chosen. I suggest running these online virus scans periodically, just to make sure that the av is doing a proper job, of keeping you safe :

Rav Online Scan Housecall Online Scan Panda Activescan

Housecall Java Online Scan<---For those who use Firefox, or opera.

And finally a little How did I get infected in the first place ? (by Mr. Tony Klein)

Good luck and safe surfing

Edited by infaddict, 11 December 2005 - 10:57 AM.

[infaddict]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.