Tech Issues Need Resolving

Had a serious malware problem which literally shut down my pc. Through assistance from this Forum it is now much better and we have solved most of the issues. Full details can be found in the following thread:

http://forums.whatthetech.com/index.php?sh…mp;#entry755677

Now before we can successfully conclude and do the final cleanup routine, a number of pesky tech issues are coming up which need to be resolved.

Mainly, when I restart pc I get the following:

1. Pop Up Box
Daemon Tools Lite
This program requires at least Windows 2000 with SPTD1.56 or higher.
Kernel debugger must be actvated

2. System Configuration Utility pop up
You have made changes….
Clicking [OK] takes you System Configuration Utility showing start up files, services, etc.

3. I was also getting a pop-up error about a driver and after using ‘msconfig’ I traced the offender and deactivated 'TBPanel', file is listed as:
c:\Program Files\EXPERTool\TBPanel.exe
This is still deactivated.

4. I also get a message from the toolbar (bottom right on screen) advising New Hardware Found, clicking on it takes you to install wizard of Nvidea GeForce 8400 GS
When I try to install I get to the stage where it states "The file 'nvinfo.pb' on Nvidea Windows XP (32 bit) Driver Library Installation Disk 1 is needed", indicate path. I cancel as do not have any disks or cannot find path.

Display Driver (NVidea) was uninstalled using ‘devmgmt.msc’ as it was thought to be causing problems.

Any help appreciated.

Regards

Pete

Hi Pete, Sorry to hear the problems with your computer continue despite all the good work you have done over the last 6 or 7 weeks and the expert and detailed advice provided by Achamian and Catbyte. There is no doubt that progress has been made, however as I'm sure you appreciate you have experienced not one problem with your computer but a whole host of problems, and these have been of a very serious nature. Had you bought this machine into my workshop for repair in early September, I would have had no hesitation in recommending that a full format and reinstall of the operating system, applications, and data be completed… However it's not in my workshop… so let's consider what is best to be done. I took a good glance at your logs over in the malware and Virus removal forum, and these are just some of the things that immediately jumped out at me…. 1 When you made your first posts in the topic you had practically filled up your C: drive (boot drive) having only around 11% of free disc space……It's vital that Windows has sufficient "elbow room" to create and add to temp files and to move files around as necessary. The situation is a little better now (following the excellent advice you have received over in the other forum, but is still too little to run effectively. Your D drive is also in a pretty similar position…. its too full! 2 Your logs indicate that someone had installed Peer to Peer file sharing applications on your computer, I see that you have removed parts of some P2P file share tools, but others (like for example utorrent) are still evident in your later logs. I know that Catbyte has given you expert and wise counsel on the need to remove these, so I will say no more, other than that P2P is a major vector for the distribution of malicious and undesirable code, and a great many viruses are spread by the downloading/uploading of files, especially music, videos, movies/films and cracked or otherwise non legitimately obtained Computer Programs/Applications. There are legitimate uses for P2P but often folks use them to download/upload files to circumvent rules on copyright and avoid paying the proper licence fees/dues . Some bad people will also "spike" a file with additional malicious code (in similar way that a drink may be spiked with a noxious substance in a bar disco or nightclub) therefore any file that does not have a good and indisputable "provenance" or is in any way "questionable" is best deleted and the Recycle Bin emptied. To work effectively P2P file sharing has to be granted access to parts of your computer…..and this is not always understood…it also is usually provided with access through your firewall…..(an important layer in your computers security…) 3 Your logs indicate that "Password Retrieval" or password crackers…have been installed on your computer. Here again there are legitimate uses for some of these types of applications, but quite often they have been used by bad people for their own ends…..As these have been installed on your computer its likely that anyone who has obtained physical or remote access to your computer, may have installed these and other Programs/Applications that would enable them to access your machine and its contents and see/use material that you had properly wished to keep confidential. You cannot therefore rely upon the integrity of practically anything on your computer. 4 Your logs indicate that you have used applications that are generally associated with the use of Internet Banking…remote access to your bank accounts etc. In the light of 3 above this is not a good situation for you to be in. 5 Your logs indicate that product serial key generator type applications (cracks) may also have been installed, and as I'm sure you are aware this is also not a good thing…. 6 Among a whole host of malicious applications present initially on your computer there were some very serious ones….. Some of these provide a remote attacker with a high degree of control over your computer, its contents, passwords, email etc. They will enable other pieces of malicious code or undesirable material to be downloaded and installed on your computer without your permission or knowledge. The rootkits for example have the ability to operate at the kernel level and make "invisible" or conceal certain files…. I will not try to list all the infections as you will have looked at the logs, but many of your files had been attacked by patch infectors, Remote Access Trojans, (Backdoors) and Zero Access infections… Despite the most expert cleaning of your computer (and believe me you have received truly expert assistance) there is no way that your computer can ever be relied upon after such a serious set of infections unless it is fully formatted, the disc cleaned and from a clean newly formatted partition everything reinstalled.(Windows, your Applications/Programs and data files where you are happy that their provenance is 100% and they are virus free.) 7 Your operating system has been compromised by these events, and despite the manual and automatic tools that have been deployed to clean or replace damaged or corrupted files…. it's clear that problems remain. 8 A "format and reinstall" is not the first step that we recommend to folks who have a problem with their machine…it is usually the last step…..and is undertaken only after lesser steps have failed to address the file corruptions and problems that still remain despite Herculean efforts to resolve them, and for example the "Repair" installation of Windows you performed recently. Nevertheless to my mind the next step is very clear…for I'm afraid that the only advice I can provide to you is to start again after wiping everything from your computer. The actual reinstall of Windows will only usually take 45 minutes or so, but you will need to reinstall your applications and do a bit of updating as well…..Your logs indicate that you are running on the same install of Windows that is now around 5 or so years old…so you don't need to feel bad about the reinstall…… You may be surprised by how much free space you have once the install is completed, and how responsive your machine has become.You will also be able to feel confident that with new passwords and the like, only you and those you authorise will be able to access your computer and use its full potential. One final word before you start…do check that your backup/copy/archive of everything that is important to you on your computer is kept safe on removable media, 100% accurate, complete, reproducible, and virus free, with at least one copy kept safe offsite. Good luck Regards paws

Paws First of all thank you for your excellent advice and wise counsel. I understand you are recommending a reinstall of Windows. Will need some guidance on how to do this. Is this done using the original Windows cd I have? It is some 5 years old. What about data (word docs, spreadsheets, etc I have on pc? Will all this be lost? If I save to usb and later reinstall if anything is infected will that not still be a problem? Tanks & Regards Pete

Hi Pete,
You are very welcome… I'm only sorry that I could not recommend a quick "magic" cure!
Yes you can use the original Windows XP installation disc however it may be worth trying the Service Pack 3 slipstreamed Win XP disc you created whilst under CatByte's care. If this works OK for you it will save a fair bit of downloading and updating….

If you can't get it to work then you will need to use your Original Microsoft disc…. if your original disc is Service Pack1a then its often possible to install Service Pack 3 and bypass Service Pack 2 entirely….this can save a bit of time, but if it doesn't work you just have to work your way through…. Its a good idea to have both SP 2 and 3 on disc, so you can install without connecting to the Internet…

Your Win XP product key should be on the Certificate of Authenticity that is often stuck on the back or side of your computer…make a note of the key …it's an alpha numeric key of 25 characters (5 groups of 5)
To be on the safe side run a tool to establish the actual product Key that is being used (and recorded internally) on your computer as in the case of an OEM machine the manufacturer will often image the Operating System from a master image and the key on the COA may therefore differ from the internally recorded one.
I would be inclined to run the Belarc Adviser tool, information and download available, free from here:
http://www.belarc.com/free_download.html
as this will not only advise you your product keys but also a great deal of information about your machine that will be most useful post reinstall and in particular provide details of your hardware so that you can download all required drivers BEFORE you format and reinstall (keeping them safe on removable media.) ( a printed hard copy of Belarc's output is a wise thing to keep!) You should make sure that you have several copies of your Network Adapter driver…as you may need this to connect to the Internet……and if you can't connect to the Internet then you can't download any other drivers or necessary files without using another internet equipped computer….

Please note that the format and reinstall is a destructive process…. it will clear your machine so if your D drive is capable of being physically removed then you can do so before formatting…..(be sure you understand what is going on here before you proceed!)

Check and double check your back up before proceeding…… I would be inclined to only reintroduce files to your new installation of Windows that you backed up Before the infections struck…… however if you decide to use a file that was backed up more recently (after the computer became infected) then you must appreciate that it could be compromised……..so there is a potential risk, even though you may have scanned it/ them with 3 independent anti virus/malware scanners before loading it/them on to your machine….. as always its your decision….

It is always wise to install an antivirus product as soon as the Windows installation is completed… so have the downloaded executable file handy (removable media again) and only connect to the Internet after you have installed Windows Service Pack 3, and you have checked that your Windows firewall is "ON" you should also only connect to the Internet via a router that has an internal hardware firewall (most do!)..When you connect do nothing other than update your anti virus product….. Microsoft Security Essentials is good, but as always its your call.. see here for details:
http://windows.microsoft.com/en-gb/windows…rity-essentials

Once your Anti virus product has been updated and is providing protection, you can proceed with updating Windows with the updates that have been issued by Microsoft since SP 3 was issued. Allow a bit of time for this as several reboots will be needed and after each reboot re-run Windows Update until there are no more updates to install (there will be well in excess of 100 of them!) You can then relax a bit and start to consider which applications you now want to install, Microsoft Word Excel etc.

Here's the link for the detailed procedures that will act as a guide to the actual format and reinstall process….
http://forums.whatthetech.com/index.php?sh…mp;hl=reinstall
Good luck and when all is as you want it, your machine running fast and sweet, free from virus or malicious elements then take a disc image using Acronis or Ghost or Paragon or one of the free disc imaging applications available from here:
http://www.thefreecountry.com/utilities/backupandimage.shtml

Make a bootable CD (a wizard within most disc imaging applications will show you how) for use in the event that horror of horrors, sometime Windows will not boot …..and keep the image safe on removable media (an external hard drive ( USB is ideal) and then if at some time in the future you hit a Windows or other software problem that cannot be overcome in a timely or cost effective manner, by the usual means (like your experiences with the viruses) you can simply plug in your external hard drive, insert your bootable CD and re-image back to your perfect set up and all in less time than it takes to walk the dog!

Regards
paws

Paws Thank you for your comprehensive reply. I truly appreciate your advice and I know what you are recommending is in my best interest. However, am I correct in saying that before I do a format and reinstall I have to save all data elsewhere or it will be lost? In such case, this can take some time, as I will use this to also do a personal clean up and delete as much useless data as I can. Secondly, I just have to ask, what if I do not do the format and reinstall? The pc seems to be working fine. Can I live with my pc in this condition. Thank you in anticipation for your assistance. Regards Pete

Hi Pete,

However, am I correct in saying that before I do a format and reinstall I have to save all data elsewhere or it will be lost?

Yes …..that is correct…..everything will be cleared.

Secondly, I just have to ask, what if I do not do the format and reinstall? The pc seems to be working fine. Can I live with my pc in this condition.

It's your call Pete…and I can't tell you if you can live with it in that condition…..all I can say is that I couldn't live with it in that condition if it was my machine….and if it belonged to one of my customers I would urge the format and reinstall as a matter of urgency. No one can guarantee that your machine is free of malicious code in view of the nature of the serious infections involved, despite the expert advice and cleaning done so far…

Just as a general comment Pete…backing up should be no big deal….some folks back up daily..others more frequently, and some take a chance and do it only very infrequently…and some not at all….. its your call.
Regards
paws

Paws Thanks for the advice. I truly appreciate it. I have already taken steps to back up data, bought an external drive and will get back to you when done. Like you said this is something I should be doing anyway. Will get back to you when done. Once again, thanks for your help. Pete PS Sorry for delay in replying, work is a bit hectic at the moment but should have some time over the weekend to work on pc.

Fingers crossed that all goes well

Paws It's been a while and considering all the incredible support given me by this forum, I would like to officially thank you and the team and bring this thread to a close. I have started on backing up everything (still some way to go) and decided that it is best to go to a professional for the restore. Very busy at work and it is dragging on so I decided this is the best route for me. I have some free time over the holidays and will hopefully complete by then. Once again thanks to you and all the team for your support and great advice. Wishing you all the best. Regards Pete