Much grief after upgrading! - SOLVED

[essexboy]

Oops my apologies I saw the 64 bit and then promptly ignored that it was XP

How is the computer now ?  If the problems are still apparent I will use a compatible programme

[gshantz]

The irony is that what I thought was an Avast problem, wasn't. In the process of testing for SafeSurf, he felt that there were indeed other problems and passed me over to you. The few uglies like unwelcome web pages and search pages are gone. Otherwise, things seem pretty normal and OK. I find that as long as things are normal, I don't notice much. Only when the unexpected happens.

I had to restore my Hosts file which got stripped. That's OK because it had gotten cluttered with much junk.

Thanks again for the help. I won't forget your expertise and what you were able to do. Amazing!
GShantz

[essexboy]

I missed a few Google entries so if you wish I will remove them now as part of the clear up

 

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=adbartrp&affID=101067&mntrId=3443063a000000000000001d7d072706&q="
  [2012/06/23 00:23:57 | 000,000,000 | ---D | M] (TelevisionFanatic) -- C:\Documents and Settings\Geralds.GERALD-64\Application Data\Mozilla\Firefox\Profiles\lsfyxzox.default\extensions\64ffxtbr@TelevisionFanatic(2).com
  IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
  IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rlz=1I7ADBR_en&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  O2 - BHO: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
  O8:64bit: - Extra context menu item: &Search - http://tbedits.televisionfanatic.com/one-toolbaredits/menusearch.jhtml?s=100000415&p=XPxdm003YYus&si=CLGuntL1zq4CFeMbQgodVE54-w&a=BE4DA973-13F8-42BB-9CC0-6CD87A1FAD4E&n=2012030423 File not found
  O8 - Extra context menu item: &Search - http://tbedits.televisionfanatic.com/one-toolbaredits/menusearch.jhtml?s=100000415&p=XPxdm003YYus&si=CLGuntL1zq4CFeMbQgodVE54-w&a=BE4DA973-13F8-42BB-9CC0-6CD87A1FAD4E&n=2012030423 File not found
  
  :Commands
  [emptytemp]
  [CLEARALLRESTOREPOINTS]
   [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?Keep safe  :wave:

[SafeSurf]

@ gshantz,

If you feel that your issue is now resolved/fixed, please go back to the first open post in this topic, click the modify button in that Post and change the title/subject, add [Resolved] to the beginning of the title so this thread can be closed. 

Feel free to come back any time you need help, to learn something new, or just to ask questions.  We are here 24/7 for your convenience. 

Should your issue or any problems related to your current problem reoccur, continue with your current thread and we will help you (and delete the "Resolved" in the title in this case).  Thank you for letting us assist you. 

[gshantz]

The reason for my delay in changing the status of this thread, is I have unexplained issues that seem to persist. At the time of EssexBoy's last post, I had followed all instruction to the letter. These issues are hard to put one's finger on, but still quite annoying. The most common is the use of MSIE 8 - it often locks up in the middle of something (like accessing a page) and one time the whole system could not be booted normally. At that time, I booted to safe mode and ran Malware-bytes, which found a half dozen items - all different from what we found before. Since then I've run Full scans with both Malware-bytes and Avast, but found nothing.

I also seem to have lost my ability to burn DVDs within the last few months, but don't see how this could be related. It may be hardware failure, but there are 2 drives and neither one works  - I should say they burn, but are too error prone to use. I will see if I can find something to test the hardware 1st.

[essexboy]

Could you post the MBAM log please

[gshantz]

Even though I've told Malware-bytes to not start up with Windows, it keeps running for about a minute frequently. I was surprised to see such a small mbam file, but here it is. (Now there are about 100 log files)

[SafeSurf]

1.  Do you have MBAM Pro?  If you do, have you added the exclusions in Avast Behavior Shield under expert settings for MBAM Pro?  And add Avast under MBAM Ignore List...this is so both software trust each other.

2.  You need to update MBAM prior to doing the scan.  Please update MBAM and rescan, then post your MBAM log again.  Thank you.

3.  I noticed that your MBAM "Protection" is off.  Why is that? 

[essexboy]

MBAM does load a driver even if it is not starting with windows

What are the exact problems at the moment

[gshantz]

1.  Do you have MBAM Pro?  If you do, have you added the exclusions in Avast Behavior Shield under expert settings for MBAM Pro?  And add Avast under MBAM Ignore List...this is so both software trust each other.

2.  You need to update MBAM prior to doing the scan.  Please update MBAM and rescan, then post your MBAM log again.  Thank you.

3.  I noticed that your MBAM "Protection" is off.  Why is that? 

If you mean Malware-bytes, no. I didn't know how long the trial was good for, and truthfully, I wasn't familiar with it, so was holding off. Same for the "Protection is off" - I was unsure what if any conflicts it might have with both Avast and Spybot-Search and Destroy. Spybot-Search & Destroy has a utility called "Team timer" which is supposed to monitor things too. I know AVs can fight with one another, so that's why I was wary.

Are you suggesting that the Pro verson of Malware-bytes is different than the trial version?

I'll upgrade the program and then come back to post the new MBAM.txt.

Exactly what of Malware-bytes needs to be entered into Avast to promote harmony? The program name, or the link to it?

MBAM does load a driver even if it is not starting with windows

What are the exact problems at the moment

Do you know if there are any conflicts with Tea Timer?

My mail data is residing on drive E: and running very slow. That's why I wanted to check that drive.
I was trying to check out drive E: - a Samsung 120 Gig - half full. When running chkdsk in Windows, it "hangs". If I run it in a command window, it hangs. Tried to run it in safe mode and it still hangs. While still in safe mode, I used the task manager to close explorer in an effort to regain control and temporarily lost all icons etc. Tried to open MSIE and the 1st thing to show up in the URL line was, "redirect2.documentprocessingcenter.com/" with a box asking for permission to close the window. When answering yes, it went on to the home page. Have no idea what that is about.

As I mentioned earlier, "The most common is the use of MSIE 8 - it often locks up in the middle of something (like accessing a page) and one time the whole system could not be booted normally. At that time, I booted to safe mode and ran Malware-bytes, which found a half dozen items - all different from what we found before. "

[SafeSurf]

If you mean Malware-bytes, no. I didn't know how long the trial was good for, and truthfully, I wasn't familiar with it, so was holding off. Same for the "Protection is off" - I was unsure what if any conflicts it might have with both Avast and Spybot-Search and Destroy. Spybot-Search & Destroy has a utility called "Team timer" which is supposed to monitor things too. I know AVs can fight with one another, so that's why I was wary.

Are you suggesting that the Pro verson of Malware-bytes is different than the trial version?

I'll upgrade the program and then come back to post the new MBAM.txt.

Exactly what of Malware-bytes needs to be entered into Avast to promote harmony? The program name, or the link to it?

Do you know if there are any conflicts with Tea Timer?

Your new MBAM log looks fine.  Yes, there is a difference between the MBAM trial, Free (on-demand/when you need it), and Pro (resident/on all the time).  There is no conflict between Avast and MBAM; they work differently and most of us here use both of them.  MBAM Pro has a one-time lifetime fee, but well-worth the money.  Here is the link to their products: http://www.malwarebytes.org/.  If you install the MBAM Free version, you should not have to enter any exclusions in Avast or MBAM.  If you decide to install the pro version of MBAM, you may need to add exclusions into Avast Behavior shield under expert settings. Under MBAM > Ignore List > enter Avast.  See the following for more information on exclustions: http://forums.malwarebytes.org/index.php?s=f9802d682ec5371a4fc724d9054d94a4&showtopic=10138&st=0&p=417798&#entry417798.  Make sure you reboot after you install what ever version you decide to install; if you install the Pro version, print out your Key and email in case you need to re-install it again some day.

SB&D with TT has caused many problems and conflicts for users.  I highly suggest that you uninstall SB&D with TT or at least TT.  Here are the instructions for uninstalling:  http://www.safer-networking.org/en/howto/uninstall.html.
-   How to disable Spybot-S&D (temporarily).  http://www.safer-networking.org/en/howto/disable.html .  Even though it says temporarily, the resident parts of SpyBot Search & Destroy must be enabled manually if disabled in this manner.  TeaTimer doesn't load into memory at all when disabled.
-   SB fails to detect: http://www.brighthub.com/computing/smb-security/articles/65492.aspx.  Reboot after uninstalling.

You are better protected using Avast and MBAM Pro than using SB&D with TT, keeping your software updated, your browsers and any plug-in's up to date, and there is a link that Essexboy will give you if he didn't already on how to prevent getting infected in the first place or again.

As for your other issue(s), I will let Essexboy answer them since he is more experienced in that than me.

[essexboy]

I used the task manager to close explorer in an effort to regain control and temporarily lost all icons etc.

You will as explorer controls the desktop

When running chkdsk in Windows, it "hangs".

A 120GB drive will take a while to process .. What switch were you using ?

[gshantz]

The last MBAM.txt was with the pro version. I got the exceptions filled out according to the instructions. (both ways)
I was totally unable to uninstall SB S&D. It said it couldn't load some uninstall DLL file, even though it was in the folder plain as day. ?? So I manually removed all folders and references to spybot, including the Registry. (tedious)

When running chkdsk in Windows, it "hangs".

A 120GB drive will take a while to process .. What switch were you using ?

I had tried with and without the "/F" option with the same result.

Sun 8th AM
Tried to check mail and after a couple mouse clicks the computer locked up. Had to do a hard reboot.

Just before bed, I started the CHKDSK through windows w/ no switches.

Mon AM, There was an error window indicating that the scan could not be concluded - (never started). Tried to check mail, and nothing was working quite right.
Tried to close any and all windows and lost control- locked up tight. Had to do a hard reboot.

Tonight- checking mail and it ground to a lock. Had to do a hard reboot. Later while using MSIE, it stalled and I had to close and restart MSIE.

Is it possible that I have a hardware problem that is causing all this? I've seen bad drives cause much mishief before. Even though my drive E: seems to be working to look at it and it seems to be keeping my mail data, I'd sure like to be able to do a test of that drive. I searched for a utility for Samsung and found it to have been taken over by seagate. Tried to install seatools and it couldn't because it didn't find .NET 4. Tried to reinstall .NET 4 and it couldn't because it can't be in "compatibility mode". The documentation for .NET does not include the words "compatibility mode".    

Since I set this OS up some time ago, I have never been able to get all the .NET flavours to install properly. Even removed them all and started over to no avail.   

Perhaps I'll try an older version of Seatools after I send this.

I feel like I'm going in circles or maybe a spiral.

Thanks much.

[essexboy]

Could well be the drive try seatools for DOS http://www.seagate.com/support/downloads/seatools/

[SafeSurf]

Essexboy,  How about if the OP goes into Safe Mode to search for SB&D and TT?  It may be hidden.  The links I provided are from the vendor and their forum, but I'm just thinking of other options.