[Dakeyras]

Hi.

keyboard is working, windows is registered (I think- it doesn't come up with an error but upon first booting it pops up in the corner with a message saying improperly registered before it loads the screen that is my normal desk top.). After a few hours and 40 min into a 45 min video, it rebooted itself on me. :/

Acknowledged.

From this point forward I would like for to limit use of the machine and not to make any changes apart from what I advise please. As this may be the only way I may be be able to solve all issues...Failing that you may just have to try and locate the XP Installation Media and perform a reformat and reinstallation of the Windows Operating System.

Though all this going to pretty much moot as Micosoft is withdrawing support for XP this coming April...

Windows XP - The Elephant In The Room

Anyway lets proceed as follows shall we...

Uninstall Software:

Now please go to Start >> Control Panel >> Add/Remove Programs and remove the following (if present):

AntiLogger SDK
AVSDK5
Coupon Printer for Windows
Mozilla Maintenance Service
WhiteSmoke New V.13 Toolbar for IE

To do so, click once on each of the above in turn to highlight and then click on the Remove button.

Note: Take extra care in answering questions posed by any Uninstaller. Some questions may be worded to deceive you into keeping the program.

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

• Please click here and download ERUNT.
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
• Double click on erunt-setup.exe to Install ERUNT by following the prompts.
• Use the default install settings but say no to the portion that asks you to add ERUNT to the Start-Up folder.
• Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
• Choose a location for the backup. Note: the default location is C:\WINDOWS\ERDNT which is acceptable.
• Make sure that at least the first two check boxes are selected.
• Click on OK
• Then click on YES to create the folder.

Note: If it is necessary to restore the registry, open the backup folder and start ERDNT.exe

Custom OTL Script:

Please download OTL and save it to your Desktop.

Alternate downloads are here and here.

Then download the attached fix.txt below to your Desktop:



Note: Both OTL and the Fix file need to be present on the desktop for the below to work correctly.

• Double-click on OTL.exe to start OTL.
• Click on Run Fix
• When prompted with:-

No fix has been provided!

Click Ok to load it from a file or Cancel to cancel

• Click the Ok button and navigate to the file fix.txt which you just saved to the desktop.
• Select fix.txt and click Open. Writing will now appear under the Custom Scan box
• Then click the red Run Fix button.
• Let the program run unhindered.
• If OTL asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.

Note: The log-file can also be located C: >> _OTL >> MovedFiles >> DD/DD/DD TT/TT.txt <-- denotes date/time log created.

Malwarebytes Anti-Malware:

• Launch the application, Check for Updates >> Perform quick scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Next:

When completed the above, please post back the following in the order asked for:

• How is your computer performing now, any further symptoms and or problems encountered?
• OTL Log from the Custom Script.
• Malwarebytes Anti-Malware Log.

[Advertisements]

ok. The first two on your list are not in my add/remove menu. The coupon printer and the white smoke say they can't find it and ask if I want to delete from the menu. I said yes the first time and said no to the white smoke to ask you. The mozilla thing was the only thing I was able to delete.

[Faithsa]

ok. The first two on your list are not in my add/remove menu. The coupon printer and the white smoke say they can't find it and ask if I want to delete from the menu. I said yes the first time and said no to the white smoke to ask you. The mozilla thing was the only thing I was able to delete.

[Dakeyras]

The first two on your list are not in my add/remove menu.

Not a problem, we can address the registry location pertaining later on.

said no to the white smoke to ask you

Fine to delete the entry, if in the event it will not delete we can also that address the registry location pertaining later on also.

[Faithsa]

So. The computer proptly rebooted the moment I finished removing white cloud and cloesd the add/ remove box. Tried to insatall erunt but apparently it's already on my system somewhere? It won't let me opt out of the startup folder.

[Dakeyras]

Hi.

Apart from some minor remnants Erunt should not be present at all after the System Restore point was invoked. Anyway we will merely use something different in due course.

For now I would like for you to run a few checks on the Hard-Drive itself first before we go any further...

Scan with HD-Tune:

Please download the installer for HD-Tune to your desktop from here.

Alternate download is here.

• Double-click on hdtune_255.exe and follow the prompts for a default installation.
• Once the main GUI(graphical user interface) has loaded, click on the Benchmark tab >> Start
• When the test has completed click once on this button in the top-left hand corner of the GUI. This will copy the results to the clipboard.
• Open a notepad file, within the notepad window right click and select Paste.
• Back in the HD-Tune main GUI >> click on the Error Scan tab >> select the option Quick scan >> Start
• Again when this test has completed click once on this button in the top-left hand corner of the GUI. This will copy the results to the clipboard.
• Paste this also in the open notepad file and then save the notepad file to the desktop named hddcheck.txt.
• Post the contents of the aforementioned hddcheck.txt in your next reply please.

[Faithsa]

HD Tune: ST31000340NS Benchmark

Transfer Rate Minimum : 2.7 MB/sec
Transfer Rate Maximum : 110.3 MB/sec
Transfer Rate Average : 67.5 MB/sec
Access Time : 12.9 ms
Burst Rate : 96.5 MB/sec
CPU Usage : 4.1%



HD Tune: ST31000340NS Error Scan

Scanned data : 953488 MB
Damaged Blocks : 0.0 %
Elapsed Time : 0:37

[Dakeyras]

Hi.

The results of the HD-Tune check are not the best, though far from the worst either. Overall that is most likely due to the age of the actual hardware itself. Since it appears to be a Seagate drive we can check this out further if the need later on.

Now first lets backup the registry using a alternative methodology as follows...

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

• Please download the installer for Registry Backup from here or here and save to your desktop.
• Double-click on tweaking.com_registry_backup_setup.exe >> Follow the prompts for a default installation
• Ensure the option Open "Tweaking.com - Registry Backup" When Install Completes is selected >> Next > >> Finish
• Once the GUI(graphical user interface) has appeared/loaded:-

• Click on Backup Now >> once the process is complete, similar to the below will displayed in the GUI:-

• Close Tweaking.com - Registry Backup

Note: There will now be a folder at the root of the Hard-Drive named C:\RegBackup, do not delete this as it is the actual backup just created.

A tutorial for Registry Backup explaining the various features can be viewed here.

Custom OTL Script:

Referring to my prior post:-

Post #61

Follow the instructions from Custom OTL Script onwards please.

[Faithsa]

As of right now, it's been "killing processes" for about 5 min now... I am thinking it's not working properly?

[Dakeyras]

As of right now, it's been "killing processes" for about 5 min now... I am thinking it's not working properly?

It should not take that long; but then again nothing surprises myself were your machine is concerned.

OK if no change in the next few minutes or so, stop OTL(use the task manager to do so if the need). Then delete the current version of Fix.txt and download this modified one to the desktop:



Then reboot your machine into Safe Mode with Networking and run the custom OTL script as outlined prior please.

[Faithsa]

I just saw your response. I walked over to the computer to follow your instructions and it is a blue screen....? Should I do a hard reboot?

[Dakeyras]

Should I do a hard reboot?

Aye, just depress the power button until it shuts down etc and then boot it back up into Safe Mode with Networking.

[Faithsa]

And now Otl is not responding....

[Faithsa]

And I'm in safe mode with networking.

[Dakeyras]

Hi.

Perform a hard reboot back into Safe Mode with Networking again, delete the current version of fix.txt then download and try this modified version instead:



If that works all good and I can target what I have omitted later on.

[Faithsa]

OK that worked. I have rebooted into safe mode. Should I just post the log? Or continue with malware bytes?