Issues with Windows XP after malware/spayware

I recently had problems with malware/spyware/viruses. Got tremendous help from your staff members here and the malware seems to be gone, but the system is not working properly. Please check the other topic to see the details: http://forums.whatthetech.com/Multiple_vir…tc_t100674.html. ANY help is more than appreciated. Thanks in advance!!!

Hi, I'll be more than glad to help you out with your issues. However, the thread you posted is VERY long. I got the jist of it maybe? It appears you can not run windows updates, maybe cant run internet explorer, and some services are failing? Can you please confirm what problems you are having exactly so I don't have to sift through your entire malware thread. Thank you.

Sure! The following are not working: Windows Update/Security Center Windows Installer - problems with installing/reinstalling/unistalling McAffee Internet Explorer couple of smaller issues - as dragging and copying off the internet thanks

Ok.. That helps out some..

Click start -> run -> type 'msconfig' and press ENTER.
When msconfig opens, under the general tab, please inform me if it is set to "Normal" startup? If it is not, please set it to normal startup and reboot the computer. Determine if your problems still persist.

If it is already set to normal startup, and/or your problems persist after setting it to normal startup please continue on.

Please reboot your computer and then wait for it to completely boot up (let the hard drive access slow, and all the programs startup). Now, click start -> run -> type 'eventvwr.msc' and press ENTER.

Event viewer will open and display the option to view some log files. We are interested in the "Application" log and the "System" log. Please right-click each one and select "Save log file as…" Please save both files to your desktop and name them application.evt, and system.evt accordingly. Now, you can close event viewer. Find the two .evt files on your desktop, select them both (hold the ctrl key and click to select them both), and then right-click them and select "Send to" -> "Compressed zip folder." When the message box pops-up asking you to associate compressed zip folders with .zip files, just click "NO." A new .zip file will be created on your desktop. Please upload and attach that file to the forum for me. Thanks.

Here the files you requested

Hi… Did you verify what mode msconfig was running in? Was it normal mode? Also, I'm getting next to no information in both event logs you sent me. I think they may be full. Please flush the system and application event logs by opening eventvwr.msc again and right-clicking each log and selecting "Clear all events." When asked, tell it you do not want to save the current log. Now, reboot the computer. Please wait at least 10 minutes after startup, and follow my previous directions to export the two new logs and zip them. Send the new file to me. Thank you. EDIT: You have some really repetitive failures that are filling the logs up so quickly that they aren't producing anything useful at the moment. The flush should take care of it long enough to get something useful.

OK. And sorry - yes, the msconfig was in normal mode

When you are done posting the new logs, please verify that you are showing all hidden/system files:

How to show hidden and system files in Windows XP:

• Open My Computer, then click the Tools menu, then click Folder Options.
• In the Folder Options window, click the View tab.
• In the Advanced Settings window:
  
  • Select Show Hidden Files and Folders.
  • Uncheck Hide extensions for known file types.
  • Uncheck Hide protected operating system files.
• Click OK, and close the My Computer window.

Now, I see in your profile you are running XP Professional? If this is correct please continue with the following instructions:

Open My Computer, navigate to C:\Documents and settings\. Find the NetworkService folder and right-click it, please select "Sharing and Security" from the context menu. Now, under the "Security" tab, please verify that "Administrators", "NETWORK SERVICE", and "SYSTEM" all have full control. If any of them do not have full control, please use the "Add" option to add each user listed above and select "Full Control" for permissions. Now, once all three users are listed with full control, please click "Advanced" under the security tab. Under the "Permissions" tab in the advanced security window please select the option to "replace permission entries on all child objects with permissions shown…" and click "OK" and then "OK" again to exit out of all the windows.

Reboot your computer, and export a new application log, zip it into a new .zip file, and upload it to the forum. Thank you.

new logs…

Yes.. The event logs are nearly empty. Several services are not running on your computer because there is a problem with the "NETWORK SERVICE" profile folder on your computer. I'll be anxiously awaiting your next post after you check the permissions on that folder and upload a new log.

The hidden folders and files are shown now.

Yes, I have XP Pro version 5.1 SP3;

However, my Network Service Folder under Sharing tab has only 2 options:
Local sharing and security
Network sharing and security - there is no "Security" tab; only "General", Sharing" and "Customize"

Please open My Computer, click Tools, Folder Options, Under the view tab in the advanced settings window uncheck "Use simple file sharing." and click OK.

Now continue with the instructions for network service permissions.

Done! Now - rebooting and new event viewer logs

Here are the newest event logs

Ok.. That didn't fix the problem. This is going to be difficult. I know we talked about it is late and we are going to continue at another time. So, that is great. I'm going to throw something out there for you to try when you come back around.

We need to rename the C:\documents and settings\NetworkService folder to NetworkService.bak. However, the folder will be in use and won't let you rename it.

Please open task manager, click the "Processes" tab, make sure "show processes from all users" is selected at the bottom and then find any process running uner the "NETWORK SERVICE" user account. Kill those processes. Then try to rename the above mentioned folder. If you are successful, please reboot and see if a new NetworkServices folder is created in c:\documents and settings. If it did, then please upload new event logs.

However, if you are still unable to rename the networkservices folders, please let me know. I have NEVER seen this particular problem and it is going to prove quite challenging but I'll see you through it. We need to get that networkservices profile rebuilt.

On second thought… DO not perform this procedure. The more I have though about your issue the more I think a hatchet approach is best suited to start with. I see that you ran system file checker, and I am concerned by the events it created in your log file. It appears it complained about and replaced dozens of files. This would've required that you have a WIndows XP installation CD. What version of disc did you use? Does it have service pack 3 already loaded on it, or does it contain SP2 or earlier? Also, does this disc match the software that is installed on this computer and do you have the valid product key for it?

I'm trying to think what I would do in this situation. And I certainly wouldn't waste hours trying to troubleshoot several different strange problems without first trying a repair install of windows after seeing how much corruption has taken place here. The system file checker log makes me want to do this even more now.

This is not directed at you, but to anyone else who reads this thread in the future. I have never, out of literally thousands of computers that I have repaired, used system file checker to fix a problem. I'm concerned that this may have made things worse. If you used a SP2 or earlier disc it doesn't even match the version of windows you currently are running. I want to make sure you have everything in place to perform a successful repair installation of windows before continuing further.