Atreyu
Topic Starter
Hello all (first post!),
In some respects, I'm an advanced user, but in others I'm not very smart. I'm working on a friend's box:
HP/Compaq, unknown model (desktop case, rare these days)
Asus P4SD "Stingray" micro-ATX (865 chip set), Pent-4 3 GHz, 512 MB RAM
Seagate Barracuda 7200 RPM 40-Gig drive, one giant NTFS partition
Win XP Pro SP2, CD-Rom drive
(don't know if she has her original XP CD or not)
Probably sold in the fourth quarter of 2004 (CD-Rom manufactured August 2004).
Stuff I've done to it:
Removed dust from CPU fan/heat sink
Removed MS "Bilt-Broken" ™ Java
Removed "Registry Defender Pro/Platinum/whatever", "My Web Search", "Win AntiVirus Pro 2009", Vundo infection, Spy Shredder, "Fun Web Products" (fun? yeah, right), IncrediMail, and an expired copy of Norton Internet Security 2007.
Put her hard drive in my machine, it scans clean with AVG 8.0. Put the drive back in her machine, MalwareBytes' Anti-Malware says it is clean too.
Her box can reach most sites I tried (including slashdot, usatoday.com, timesofindia.com) but cannot reach microsoft.com or avg.com. Some spyware alters hosts files to stop her from reaching these helpful sites, but that did not happen here.
Two symptoms, maybe related:
1. There is an icon on her screen ("Shredder") that is not there in the "Docs & Settings\Pat\Desktop" folder. Looked at Mark Russinovich's blog here (The Case of the Phantom Desktop Files, Feb 3, 2009). Tried Process Monitor, but somebody (XP?) shuts it down immediately. (Can't go to microsoft.com, had to get the executable from another PC).
2. Obviously, I cannot get to certain sites. My ADSL service redirects microsoft, for example, to their own special page ("did you mean to pick from one of these preferred links, none of which will take you anywhere near where you want to go"?). After I changed her DNS to use OpenDNS.org's octets/dotted quads, she gets the exact same list of circle-jerking time-wasting parked-domain "helpful link-farm sites" that she did before.
Her PC was very slow, but it is not anymore. I think we can rule out a rootkit (I fixed Srizbi on her sister's box a few months back). Plus the scanning says it's clean.
Windows Control Panel doesn't detect a problem with her wired connection (and most websites do work, haven't tried checking her e-mail yet). I've had cases where IE works but Firefox doesn't, or vice versa. I suspect the problem could be inside her box.
Mike Lin's Control Panel may still list remnants of Google toolbar or Yahoo! search bar. Any chance this is messing up her connection or TCP/IP stack or whatever?
Any thoughts or advice greatly appreciated.
In some respects, I'm an advanced user, but in others I'm not very smart. I'm working on a friend's box:
HP/Compaq, unknown model (desktop case, rare these days)
Asus P4SD "Stingray" micro-ATX (865 chip set), Pent-4 3 GHz, 512 MB RAM
Seagate Barracuda 7200 RPM 40-Gig drive, one giant NTFS partition
Win XP Pro SP2, CD-Rom drive
(don't know if she has her original XP CD or not)
Probably sold in the fourth quarter of 2004 (CD-Rom manufactured August 2004).
Stuff I've done to it:
Removed dust from CPU fan/heat sink
Removed MS "Bilt-Broken" ™ Java
Removed "Registry Defender Pro/Platinum/whatever", "My Web Search", "Win AntiVirus Pro 2009", Vundo infection, Spy Shredder, "Fun Web Products" (fun? yeah, right), IncrediMail, and an expired copy of Norton Internet Security 2007.
Put her hard drive in my machine, it scans clean with AVG 8.0. Put the drive back in her machine, MalwareBytes' Anti-Malware says it is clean too.
Her box can reach most sites I tried (including slashdot, usatoday.com, timesofindia.com) but cannot reach microsoft.com or avg.com. Some spyware alters hosts files to stop her from reaching these helpful sites, but that did not happen here.
Two symptoms, maybe related:
1. There is an icon on her screen ("Shredder") that is not there in the "Docs & Settings\Pat\Desktop" folder. Looked at Mark Russinovich's blog here (The Case of the Phantom Desktop Files, Feb 3, 2009). Tried Process Monitor, but somebody (XP?) shuts it down immediately. (Can't go to microsoft.com, had to get the executable from another PC).
2. Obviously, I cannot get to certain sites. My ADSL service redirects microsoft, for example, to their own special page ("did you mean to pick from one of these preferred links, none of which will take you anywhere near where you want to go"?). After I changed her DNS to use OpenDNS.org's octets/dotted quads, she gets the exact same list of circle-jerking time-wasting parked-domain "helpful link-farm sites" that she did before.
Her PC was very slow, but it is not anymore. I think we can rule out a rootkit (I fixed Srizbi on her sister's box a few months back). Plus the scanning says it's clean.
Windows Control Panel doesn't detect a problem with her wired connection (and most websites do work, haven't tried checking her e-mail yet). I've had cases where IE works but Firefox doesn't, or vice versa. I suspect the problem could be inside her box.
Mike Lin's Control Panel may still list remnants of Google toolbar or Yahoo! search bar. Any chance this is messing up her connection or TCP/IP stack or whatever?
Any thoughts or advice greatly appreciated.
