[Dakeyras]

Hi.

System repair disc could not be created

The write failed because the drive returned error information that could not be recovered from
0xC0AA0301

That is a pity(not a major cause for concern I will further add) though unfortunately that is something I will be unable to assist with as primarily I only provide Anti-Malware support....because this is most likely either a hardware and or driver issue for example and not malware related per-say...

So my best suggestion would be when I give the all clear create a new topic in this part of the forum:-

Hardware, Components and Peripherals

And the IT Techs here in GTG will be able to sort that problem for you. By all means when doing so provide a link back to this topic and mention I advised you seek further assistance if you so wish.

This is the topic url you can copy when doing so:-

http://www.geekstogo.com/forum/topic/323664-this-program-cannot-display-this-page/

Note: To reiterate do not create the new topic until I give the all clear in this one as having more than one person assisting on with the same machine simultaneously is counter productive.

Next:

OK we will merely take a different approach to what I had planed as follows...

Alternate Startup Repair:

• Restart your computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Now select the operating system you want to repair, and then click Next.
• Click on/select your user account and click on Next.
• Select the option Repair your computer
• At the the System Recovery Options screen click Windows 7 to highlight then Next>
• You should now see the Searching for Problems...
• Note: If given the option to Perform a System Restore, do not select and cancel the option. If advised Send information about this problem (recommended), select Don't send.
• If problems found let Startup Repair complete and follow the prompts. Restart your computer if not prompted to do so once the procedure is complete.

Hard-Drive Maintenance/Repair:

• Please download TFC to your desktop,
• Right-click TFC.exe and select Run as Administrator to run the program.
• Click the Start button in the bottom left of the TFC graphical user interface.
• If prompted, click "Yes" to reboot.

Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes , and may only take a few seconds. Only if needed will you be prompted to reboot.

Next:-

• Click on Start(Window 7 Orb).
• Click on All Programs >> Accessories
• Right click on Command Prompt and select Run as Administrator.
• Click on Continue at the UAC prompt.
• At the Command Prompt C:\Windows\System32> type in the following exactly:
• CD C:\
• Then depress the Enter/Return key, then type in the following exactly:
• Now type in DEFRAG C: -F
• A Analysis report will be displayed and then Windows will start the Defragmentation run automatically.
• This may take some time, when completed the Command Prompt C:\ > will appear.
• Now type in CHKDSK C: /R and hit the Enter/Return key.
• When prompted with:

CHKDSK cannot run because the volume is in use by another process
Would you like to schedule this volume to be checked next time the system
restarts (Y/N)

• Hit the Y key then at the Command Prompt C:\ >
• Type in EXIT and and hit the Enter/Return key.
• Now Reboot(Restart) your computer.

Note: Upon Reboot(Restart) the CHKDSK(check-disk) will start and carry out the repairs required.

You should see a screen like this just after the Post(power on self test) screen:



Note: Do not touch either the keyboard or Mouse, otherwise the Check-Disk will be canceled and you computer will continue to boot-up as normal.

Next:

Let myself know when completed the above and if any problems encountered.

[Advertisements]

i'll try again tomorrow but while doing the Defrag -F I've been at it for 4 hours nothing is happening. I rebooted and had to close computer to go to bed, am I doing something wrong or should it take that long?

[love2teach956]

i'll try again tomorrow but while doing the Defrag -F I've been at it for 4 hours nothing is happening. I rebooted and had to close computer to go to bed, am I doing something wrong or should it take that long?

[Dakeyras]

Hi.

Your machines hard-drive is quite badly fragmented:-

Total Fragmentation on Drive C: 50% Defragment your hard drive soon!

So it will take some time to complete, you will just have to be patient I'm afraid. In the event more than say ten hours have elapsed and no discernible difference merely halt the procedure again and inform myself please.

[love2teach956]

well, tried again this morning and it went real quick! got thru all the disc check, etc, rebooted and so far all seems well.

[Dakeyras]

Hi.

well, tried again this morning and it went real quick! got thru all the disc check, etc, rebooted and so far all seems well.

Good, lets update some software as follows shall we...

Download and install FileHippo Update Checker from here.

Once installed >> Click on Start(Windows 7 Orb) >> All Programs >> Update Checker >> a browser window will open after the scan is complete.

Download any updates detected to the desktop >> uninstall anything that requires updating via Programs and Features in the Control Panel.

Re-install the updated software...then delete the installers from your desktop.

Note: When I give the all clear my advice would be to consider keeping FileHippo Update Checker installed. Then periodically use it to check for any updates as having certain software outdated is a potential for malware to gain a foothold and exploit a system etc.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan...
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then right click on it and select Run as Administrator to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is Not checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files (x86)/ESET/ESET Online Scanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

When completed the above, please post back the following in the order asked for:

• How is your computer performing now, any further symptoms and or problems encountered?
• Eset Log.

[love2teach956]

I guess this is the log? All seems to be ok with my computer, nothing working weird.

ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=0

[Dakeyras]

Hi.

I guess this is the log? All seems to be ok with my computer, nothing working weird.

OK, we will try a different scan as follows and check all services are now running as should etc.

Panda Online Scan:

Use Internet Explorer for the below please...

Windows 7 users: You will need to to right-click on the IE in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Now please go here to run Panda's ActiveScan

• Once you are on the Panda site, click the Scan your PC now button
• A new window will open...select the option Quick scan then click on the Scan Now button <-- Allow all the UAC(User Access Control prompts)
• Allow the ActiveX control to be installed. It will start downloading the files it requires for the scan. Note: This may take a couple of minutes
• Run the ActiveX control, if requested. The screen will then show the scanning progress - the scan will take a while to finish. Please be patient.
• When the scan has finished, click on Export To
• Save the file as Activescan.txt to your Desktop
• Close the Activescan window then go to your Desktop
• Double-click on Activescan.txt and it will open in Notepad
• In Notepad, click Edit > Select all, then Edit > Copy
• Reply to this thread and click Ctrl+V to paste the log in your reply

Re-scan with FSS:

Delete FSS.txt if it is still on the desktop, then empty the Recycle Bin.

• Right-click FSS.exe and select Run as Administrator to start the program.
• Select all available options.
• Then click on the Scan tab.
• When the scan is complete, it will produce a log named FSS.txt.
• Post the contents in your next reply.

[love2teach956]

Here's the FSS text:

Farbar Service Scanner Version: 07-11-2012
Ran by Maria (administrator) on 03-12-2012 at 21:23:44
Running from "C:\Users\Maria\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2012-11-13 19:43] - [2012-10-03 09:56] - 1914248 ____A (Microsoft Corporation) 37608401DFDB388CAF66917F6B2D6FB0

C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

Here's the activescan log:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2012-12-03 21:21:33
PROTECTIONS: 1
MALWARE: 13
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
McAfee Anti-Virus and Anti-Spyware Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\cjf1xs8c.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\low\32gvyka6.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\1pcxhgxe.txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\1lo2z14t.txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\j688avb0.txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\jvbhm49k.txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\yaqlqaub.txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\46vq80yt.txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\h9gztxq4.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\6n7rl02r.txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\low\mictof4o.txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\e3lwuvp4.txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\i1p100l9.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\7dts39yz.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\pmvbie7i.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\ud8e6bym.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\b5dht60v.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\low\g7mak254.txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\xu2oxm1h.txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\292vi3v2.txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\53l50fsd.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\jf66ppjo.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\u25pstsy.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\users\maria\appdata\roaming\microsoft\windows\cookies\r7w8fesk.txt
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
;===================================================================================================================================================================================

[Dakeyras]

Hi.

Just one more task to complete as follows...

Reset Windows 7 Firewall:

Click on Start(Windows 7 Orb) >> Control Panel >> Windows Firewall

Now click click on Restore Defaults >> At the UAC prompt click on Yes >> Restore Defaults >> Yes.

Then click on Turn Windows Firewall on or Off and under the option Home or work (private) network location settings >> and select Turn off Windows Firewall (not recommended) >> OK.

Carry out the same procedure as the above for Turn Windows Firewall on or Off and under the option Public network location settings >> and select Turn off Windows Firewall (not recommended) >> OK.

Note: No need for it to be on after the reset because the presently installed McAfee Internet Security has a firewall component.

Next:

Let myself know when completed the above and if any further issues remaining. If not we will removal all tools used during the malware removal process and I will provide some advice about online safety etc.

[love2teach956]

ok so under Control Panel, there was no option for Firewall, Restore Defaults. I tried to attach Word doc with screen shots of where I went but states I'm not allowed to upload that type of file. I wanted you to see where I went before I change settings. While on Control Panel, went to Advanced Settings, then scrolled to Windows Firewall Properties, I see Domain and Public and Private profiles. Where is says turn On, is that where you want me to turn Off Firewall? If so, which of the three profiles or all three?

The Home or Work(private networks) in Control Panel could not be changed, I scrolled over it and nothing happened.

[Dakeyras]

Hi.

Not a problem, we will merely use a different methodology as follows...

Download the attached Reset.Bat(see below) to your desktop.

Now right-click on Reset.Bat and select Run as Administrator >> when it has completed its processing it will self delete.

Next:

Let myself know when completed the above and if any further issues remaining. If not we will removal all tools used during the malware removal process and I will provide some advice about online safety etc.

[love2teach956]

Okay, I've done the reset..
All still seems well with computer

[Dakeyras]

Hi.

Okay, I've done the reset..
All still seems well with computer

Good...

Congratulations your computer appears to be malware free!

Now I have some tasks for your good self to carry out as part of a clean up process and some advice about online safety.

Importance of Regular System Maintenance:

I advice you read both of the below listed topics as this will go a long way to keeping your Computer performing well.

Help! My computer is slow!

Also so is this:

What to do if your Computer is running slowly

Clean up with OTL:

• Right-click OTL and select Run as Administrator to start the program.
• Close all other programs apart from OTL as this step will require a reboot.
• On the OTL main screen, depress the CleanUp button.
• Say Yes to the prompt and then allow the program to reboot your computer.

The above process should clean up and remove the vast majority of scanners used and logs created etc.

Any left over merely delete yourself and empty the Recycle Bin.

Reset the System Restore points:

Create a new, clean System Restore point:-

• Right click on Computer and select Properties >> System protection >> Create.
• Give this restore point a descriptive name and click Create.
• When the new restore point is created click on OK >> close the System Properties window.

Note: Do not clear infected/old System Restore points before creating a new System Restore point first!

Flush Old System Restore points:-

• Next click Start(Windows 7 Orb) >> Run (or the Windows key and R together) to bring up the Run box and and copy and paste in:
  

  cleanmgr

• in the box and press OK.
• Select the system drive, C >> OK.
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Click on Clean up system files >> Select the system drive, C >> OK.
• Now click on the More Options tab.
• Under:-

• System Restore and Shadow Copies
• Click on Clean up... >> Delete >> OK >> Delete Files.

Now some advice for on-line safety:

Malwarebyte's Anti-Malware:

This is a excellent application and I advise you keep this installed. Check for updates and run a scan at least once per week.

Other installed security software:

Your presently installed security application, McAfee Internet Security automatically checks for updates and downloads/installs them with every system reboot and or periodically if the machine is left running providing a internet connection is active.

I advise you also run a complete scan with this also at least once per week.

Erunt:

Emergency Recovery Utility NT, I advice you keep this installed as a means to keep a complete backup of your registry and restore it when needed.

Myself I would actually create a new back up once per week as this along with System Restore may prove to be invaluable if something unforeseen occurs!

Keep your system updated:

Microsoft releases patches for Windows and other products regularly:

• Click on Start(Windows 7 Orb) >> All Programs >> Windows Update.
• In the navigation pane, click Check for updates.
• After Windows Update has finished checking for updates, click View available updates.
• Click to select the check box for any found, then click Install.
• When completed Reboot(restart) your computer if not prompted to do so.

Be careful when opening attachments and downloading files:

Never open email attachments, not even if they are from someone you know. If you need to open them, scan them with your antivirus program before opening.
Never open emails from unknown senders.
Beware of emails that warn about viruses that are spreading, especially those from antivirus vendors. These email addresses can be easily spoofed. Check the antivirus vendor websites to be sure.
Be careful of what you download. Only download files from known sources. Also, avoid cracked programs. If you need a particular program that costs too much for you, try finding free alternatives on Sourceforge or Pricelessware.

Stop malicious scripts:

Windows by default allow scripts (which is VBScript and JavaScript) to run and some of these scripts are malicious. Use Noscript by Symantec or Script Defender by AnalogX to handle these scripts.

Avoid Peer to Peer software:

P2P may be a great way to get lots of seemingly freeware, but it is a great way to get infected as well. There's no way to tell if the file being shared is infected. Worse still, some worms spread via P2P networks, infecting you as well. My advice is avoid these types of software applications.

Hosts File:

A Hosts file is like a phone book. You look up someone's name in the phone book before calling him/her. Similarly, your computer will look up the website's IP address before you can view the website.

Hosts file will replace your current Hosts file with another one containing well-known advertisement sites, spyware sites and other bad sites. This new Hosts file will protect you by re-directing these bad sites to 127.0.0.1.

Here are some Hosts files:

• MVPS Hosts File
• hpHosts

Only use one of the above!

Consider installing WinPatrol:

WinPatrol alerts you about possible system hijacks, malware attacks and critical changes made to your computer without your permission.

Download it from here.

You can find information about how WinPatrol works here.

Next:

This is a very helpful/useful set of advice from Microsoft: Microsoft Safety & Security Center

Any questions? Feel free to ask, if not stay safe!

[Dakeyras]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.