[Resolved] Laptop won't function after logging in.

I'm very thankful for the assistance I received with my computer. My roommate has an HP laptop running WinXP Home. After you boot up and log in the computer won't allow you do do anything about 3-5minutes after it's up and running. It seems to work fine in SafeMode. So I was hoping that you guys could help me out once again to help out my roommate. Thanks!

Hi cewong2

I believe that I was the one who did your last pc.
The problem your having may or may not be caused by malware but I will try to help you.

Please do the following:

FIRST:


Please do these steps:

Show hidden files, Here is how:

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

NEXT:

Please download ATF Cleaner by Atribune.

Download it

HERE:

This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

NEXT:

Malwarebytes' Anti-Malware

HERE

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
save and post the malwarebytes log when you get to the bottom of this page.
NEXT:

We need to download HijackThis, download it here
http://www.rosoftdownload.com/admin/images…/HJTInstall.exe
once downloaded click on it to install
By default it will install in c:\program files.Don't change the location
Then navigate to that directory and double-click on the hijackthis.exe file. When the program is started click on the Scan button and then the Save Log button to create a log of your information.
Once the log is saved please post it here .along with the Malwarebytes' Anti-Malware log
good luck

Be sure not to delete anything intill said ok to. also don't run any other cleanup programs till we
get done it may goof ours up.
Also if you have any questions feel fre to ask first.

When you post another HJT log and the Malwarebytes' Anti-Malware log , let me know how your PC is behavuing

I will be waiting to see new logs

mschroe919

Hi mschroe919, Yes you were the one to assist me last, thanks btw, Everything is running well, except the whole No Disk issue, but I just deal through it I'll probably end up uninstalling allt he drives through Hardware Explorer and letting windows reinstall and remap. But for the laptop, I have it running Malware on it when I left, so I'll post the HJT log when I get home.

Ok Finally got Malware running, sorry, I know you don't like this but I had to run combofix to get the computer to stop freezing halfway through. So I have posted that log as well. But Malware found nothing.

Hi cewong2, Yes the only reason we don't like to use any program without complete knowledge is you could render the pc/laptop useless I just hope you did it the way you did it on your pc. On the desktop? Also if you did get malwarbytes to run could you post it too. And please don't get ahead of yourself. and please don't run anything else till asked. also don't delete anything till asked good luck mschroe919

Here's the malware log. Yep ran it the same way through the desktop.

Hi cewong2

NEXT:
Make sure Internet Explorer isn't open

Run hijackthis again. Hit None of the above,
Click Do a System Scan Only.
Put a Check in the box on the left side on these: (Not to worry if not there)

O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)

Close ALL windows and browsers except HijackThis and click Fix checked
Then reboot

NEXT:
After reboot

Using Internet Explorer, please do a Kaspersky online scan] This scan takes about 60 minutes to complete.

Answer Yes, when prompted to install an ActiveX component.
The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure as follows:
Scan using the following Anti-Virus database:
Extended
Scan Options:
Scan Archives
Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.

[external image: Posted Image]

Click the Save as Text button to save the file to your desktop and post it in your next reply along with a fresh HijackThis log

* Turn off the real time scanner of any existing antivirus program while performing the online scan
When you p[ost the 2 logs tell mew how your pc is doing.
good luck mschroe919

ok, so here are the logs, I'm assuming you are looking for a new HJT log as well.

I'm still in Safemode, as the system still freezes while I'm in normal mode. I also have this interesting error and this I believe was before the computer even starting having the issues it has now:

[external image: Posted Image]

as you can clearly see the file is there. The first time it happened I reinstalled IE as well and upgraded it it at the same time from IE6 to IE7.

Hi cewong2

I noticed that there is no anti virus on this laptop, if it is it is disanbled???

When we get done with this part I will tell you were to get a free one.

BUT FIRST:

READ:
This family of Trojans utilises spoofing technology. The Trojans themselves are contained in fake HTML pages. Messages, purportedly from banks, financial institutions, internet stores, software companies etc. are sent to users. These messages contain a link to the fake page; this link exploits the Frame Spoof vulnerability in Internet Explorer
I would concider asking owner of laptop if he fell for the bank fraud.
These trojans can be cleaned up but they might want to concider if they did to make arrangement to change password for banking.
Now if they don't use this laptop for banking then all might be okay as long as they didn't give out any info.
Here is a example of a letter from the trojan

This Trojan program utilizes spoofing technology. It is made as a fake HTML page. It is made for stealing information about clients of Washington Mutual Bank. It is sent as an important message by Washington Mutual Bank:
Dear Washington Mutual customer,

Due to concerns for the safety and integrity of the online banking community
we have issued this warning message. It has come to our attention that your
account information needs to be updated due to inactivity. If you could please
take 5-10 minutes out of your online experience and renew your records you will
not run into any future problems with the online service. In case you are not
enrolled for Internet Banking, you will have to use your Social Security Number
as both your Personal ID and Password and fill in all the required information,
including your name and your account number.

However, failure to update your records may result in your debit card suspension.
Once you have updated your account records your internet baking service will
not be interrupted and will continue as normal.

Please follow the link below to renew your account information.

Thank you for your prompt attention to this matter

Sincerely,
The Washington Mutual Bank Team

If you want to contine or maybe do a factory restore to be safe let me know.
NEXT:
1. Please open Notepad
Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\WINDOWS\system32\.367fc6f6\367fc6f6.core.dll
C:\Documents and Settings\Amy Tao\Desktop\downloads\atao.zip
C:\Documents and Settings\Amy Tao\My Documents\old activities\HoCo\download\bittorrent-3.3.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Next, re-enable all the programs that you disabled prior to running ComboFix.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

8. Post the following logs/Reports:
ComboFix.txt
Fresh HijackThis log

good luk mschroe919

There is mcafee on it, but it's disabled as it kept interferering with everything. I'll probably end up removing it and putting something else on. Combofix ran, rebooted, and froze again while it was in normal windows, so I had to shut it off and restart in safemode again and rerun combofix under safemode. Here are the logs.

did you read the thing about thje trojan that can rip off your bank stuff? And if so I will continue mschroe919 also can you go to my computer, click on C:\ then click on program files then click on internet explorer then click on iexplore.exe click on the iexplore.exe and see if it connects to internet I am looking to see if you have and it works iexplore.exe

when I click on the iexplorer directly I get the same message. Also she doesn't usually click links that she gets in email for banking, she goes directly to the website for it.

Hi cewong2


you can uninstall ie7 from add or remove programs. then you can download and install ie7 from here:

Get ie7 Here:


use the download ie7 at near bottom of page

Lrt me know how it wporked and how your pc is doing

good luck mschrpe919

I uninstalled it, restarted, reinstalled it, and still got the same error. we can also continue with everything else too, in regards to the trojan.

Hi

Lets do another on line scan
if something can't be cleaned make note of it and let me know
do the scan here:

f-secure

the start scanning button is at bottom of page
good luck mschroe919


I don't reemember if they give you a log or not. But I do
know that if they find something they will clean up. So even if they don't give you a list you can print the sceen and ptint to a file and post that here