Referred from Malware Forum with regards to hardware problem

Hi,I was asked by Catbyte in the malware Infections/Removal forum to start a new topic here with regards to a possible hardware problem with my PC.
The topic is : Malware,rootkit,trojan or Registry Error? and the link is http://forums.whatthetech.com/index.php?showtopic=115707
I hope someone can help me get this sorted.
Thanks!

Hi Ally, sorry to hear of the problems you have been experiencing. Its good to know that CatByte has checked out your machine and killed the infections found.
Any infection is a cause for concern, and some can in certain circumstances infect files that you have copied as part of your regular back ups.
It would be wise before we make any recommendations, for you to check that your current backup is 100% accurate. up to date, reproducible and kept safe on removable media and to make a note of any backups made during the time your machine was infected….these backup made when your machine was infected should be treated with caution.

I see from your logs that P2P file sharing application (Utorrent) etc had been installed. Hopefully you followed CatBytes wise advice to uninstall it. I would also recommend that you delete any files downloaded via P2P filesharing unless their provenance is undoubted, the Recycle bin then should be emptied.

This is the suggestion for for correcting faults with a damaged or corrupted user profile

1 Set up 2 new User Accounts
2 Click on Start
3 Click on Control Panel
4 Click on User Profiles
5 Click on "Create New Account"
6 Follow on screen directions but make sure both new accounts are "Administrator" status.

Next we copy the settings from the original account to your new account:

• Ensure you've added a new user account and that you've logged in using that account at least once - this will create the folder under Documents and Settings
• Reboot the computer.
• Sign in with an account that is neither the old or the new account. This prevents "file in use" errors while copying. (NOTE: If you don't have another account, you can create a third one or you can boot into Safe Mode and log with the ADMINISTRATOR account.)
• Browse to c:\documents and settings\OldUserAccount
• Select everything in that folder except the three files called ntuser.dat, ntuser.dat.log, and ntuser.ini. (These may be hidden files, so if you don't see them, open My Computer, Tools menu, View tab, check "Show Hidden Files/Folders")
• Copy all those files into c:\documents and settings\NewUserAccount
• Reboot the computer and log in with your New user account.
• Once you confirm that all your documents are located in My Documents of the New user, you can delete the old profile (And the third account you created in Step #3 if it was needed). HOWEVER it is recommended that you run with the new profile for at least a month and satisfy yourself all is well before deleting your old profile

Regards
paws

Hi Paws, I have followed your instructions but am still getting the same kind of issues. I am considering a Re-Format of my drive as I don't have any important documents/data on my PC. I do have alot of music and my browser bookmarks that I will need to re-install which will be very time consuming. Do you think that would be the best thing to do?

Hi Paws, Just to update,I logged into pokerstars earlier and my Kaspersky suddenly popped up with a red warning Detected active malicious software,Trojan program: Packed.Win32.Katusha.n It then asked if I wanted to perform a special disinfection procedure which I am about to do. After the scan,A window came up before It logged off : SAS window : winlogon.exe - Bad Image the application or DLL C:\WINDOWS\System32\dr.prov.dll is not a valid windows image.please check this against your installation diskette. After re-booting,Kaspersky said full scan is required and also Post-infection system restore is required. Having disabled system restore (kaspersky tried to delete the file that was in volume system restore)and also trying to fix the issue by pressing the fix it now button on kaspersky I think it is not working. Anytime I press backspace on the browser,my computer goes haywire. Any further advice or help is appreciated.

Hi Sorry to hear of the latest trouble you are having. This is what you should consider doing: 1 Disconnect the troublesome computer from your Internet connection ( pull out the wire) 2 Disconnect the troublesome computer from your network of other computers( if applicable) 3 Do not use your computer until either Catbyte or me gets back to you. I will send a pm ( private message) to Catbyte asking for expert malware advice on the best way to proceed. It is possible that Catbyte may want you to run a further scan. Regards paws

Hi Paws, I will wait for your reply on how to proceed. Could you tell me if I should change any of my bank passwords etc.Is this malware a danger ? regards, Ally.

Do nothing at the moment. Catbyte will issue instructions shortly on how best to proceed. Regards paws

Hi,

I have moved this topic back to malware removal for the moment.

I don't believe you have picked up a new infection, I believe Kaspersky may be alerting to a reference to the old infection in one of your old restore points, which apparantly did not get flushed as anticipated during the clean up. (this will not harm the computer unless you perform a system restore)

So let's do that now, then once done, run a full scan with your Kaspersky Antivirus to meke certain there is nothing remaining, then we can move you back to the tech forum,

Please do the following:

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it and click Create, when the confirmation screen shows the restore point has been created click Close.
Next goto Start Menu > Run > type (or copy and paste)

cleanmgr

Press OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once that's finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.
To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

Now run Kaspersky, let me know the results

Hi Catbyte, I followed your instructions and then ran a full scan with kaspersky and also a critical area scan,they both detected nothing. The file or virus that kaspersky popped up the warning with was in the system volume restore. Kaspersky at the moments status is your computer is protected,no active threats.

OK, good that's what I thought I'll move this thread back to the other forum then and paws can take over - you are in good hands with him please post an updated status for him with as much information that you can about the outstanding issues

Hi Catbyte, Many thanks again for helping to get my PC sorted. I updated my malwarebytes and super-antispyware and have ran a quick scan with both and nothing was detected. The issues with my browser have now stopped so far and browsing has also speeded up a little. so far so good.

The issues have started again…..I think I might be better to re-format. I have a new portable 250gb drive and if I re-format could come back and find out how to back up my pc incase of any future malware issues. Is it possible to back up the full pc to prevent a re-format(operating system and all)? I will wait for your reply as to how to proceed. regards, Ally.

Hi Ally, Its good to know that Catbyte has ruled out infections on your machine.
Thanks CatByte

1 Did you create the new User profile as recommended in post 2? This might make a reformat and reinstall of Windows unnecessary…

2 If you decide to go along the format and reinstall route then be sure to copy all your important stuff, serial numbers, user names passwords, data files, all windows settings etc. and keep them safe on removable media and with at least one extra copy kept safe offsite. If necessary then a pencil and paper could be used for some of this!

3 Yes… it's recommended that you take a disc image of your whole system, using software such as Paragon, Acronis, or Ghost and keep an extra copy of it safe on removable media and offsite. Once you have done this and verified the image for accuracy and correct reproducibility and made a bootable CD (that will enable you to access an image file kept say on an external hard drive) you will be in a possition should trouble ever strike again in the future that cannot be resoved in a timely and cost effective way by the normal means, to re-image your computer and be up and running again in less time than it takes to walk the dog! There is plenty of free disc imaging software available see here fro details:
http://www.thefreecountry.com/utilities/backupandimage.shtml

4 You should only make the original disc image once your computer is running well,(NOT now!) free from virus or malicious code, all junk files deleted, all applications installed, email and Internet configured, address books, contacts and bookmarks/favourites in place and fully defragged. In short when your machine is at its "perfect state" The disc image will reproduce exactly everything on the disc or partition you imaged, so make sure your images are good! Once you have a good disc image then its possible to make incremental disc images (with a much smaller file size) that reflect ONLY the changes made since the last FULL disc image was made. This way you have a reliable "fall back position" should things go badly wrong!
Post back if you need any help with this.
Regards
paws

Hi paws, Yes,I created a new profile but I am still getting the issues. I have 2 copies of XP, 1 Home edition and 1 Pro Edition. Ideally what I would like is to re-format and get my op system on,get all my browser bookmarks sorted and music re-ripped and software that I use re-installed then back-up everything onto my portable hd but I am unsure how to back-up the full image. If I get my PC back to the state it was in can I come back and get instructions on how to back up the image to my external HD? Once again thanks to you and Catbyte for taking the time to help out with my PC. kind regards, Ally.

Yes Ally, I can steer you through the steps needed to make a disc image using Acronis ( thats the one I use and recommend to my customers) however the steps needed are usually quite straight forward and driven by a "wizard" that spells out what you need to do. One of the important things to remember when imaging is to be certain in your own mind that you are imaging the correct partition or disc to the correct destination drive….. Making sure the destination for the image is correct (your external hard drive, preferably) is made easier by remembering to plug it in BEFORE running the disc imaging software…and then making a note of the drive letter that Acronis allocates to it. Post back with any specific questions as you meet them and we will do our best to help Regards paws