Recovering Windows Post malware

Tell us how the Internet performs when you are logged on to this new account..any improvement? Regards paws

Hi Paws: I created another user with Admin rights and started IE9 and went to www.bbc.co.uk and it comes up fast but there is no video capabilities or script-based sidebars. In fact IE9 doesn't pickup Javascript at all i.e. no improvement ~James BTW my malware and anti virus software detected the following rogue security software and backdoor software in the system files: WinAntivirus Pro 2006, WinSpyware Protect and Bifrost

Hi James. OK all understood, I think as you are getting malware prompts it would be wise to ask Ken to take a look…. Ken often keeps a professional eye on these sort of topics here…but in any event post to him ( with the new maklware warnings you are getting) in your original malware topic over at safer networking. He will be able to say if these are "real" or false positives..you could also explain that paws has advised you to post in your original malware topic. Regards paws

Hi Paws: Thanks for your help. I started my orginal post in Virus and Malware forum, but you want me to post to "Ken" in Safer Networking? More information please. ~James

Hi James, Sorry I was confusing two different topics..
It was Jeff that was assisting you with the malware not Ken, so please make your post in your topic here:
http://forums.whatthetech.com/index.php?sh…20975&st=45 Hopefully Jeff will be able to say if the malware threats reported are "real" or false positives….
Once Jeff has checked things out and signed you off as clear of malware,so to speak, post back here if you are still having troubles and we will continue to try and get it sorted out for you.
Regards
paws

Hi Paws: FYI, miraculously Chkdsk /r command completed its run as I started my PA this AM. (11/23/11) Don't know why it worked. ;-) ~James

HI Paws: Jeff has reviewed new logs and i convince that the reports I am getting from CA Tech are false positives. I am still having trouble with getting any scripts to run within webpages…no videos, no webmail, or online forms. That includes the scripts that run on this website e.g. formatting the messages posts I send you within this forum??!! Any recommendations? ~James

Hi James, That's good news that there's nothing malicious still lurking around… I had a good look at some of your logs to try and see if there were any clues as to your video problems etc…. These are the things that immediately jumped out at me: 1 Your boot drive is almost full to capacity…. the latest logs indicating somewhere in the regon of only 4% to 6% being free…… this is way, way, too low and is crippling the performance of your machine. Windows needs considerable "elbow room" to operate satisfactorily…. 2 You need as a matter of urgency to increase this to an absolute minimum of 16% and 25% would be a lot better….. 3 Uninstall any applications that you never use, and shift data files that you do not access every day to an external hard drive. or even fit a new internal hard drive (as long as your power supply and cooling system is up to it.) 4 You have old, vulnerable and out of date java installed…..these can make it easy for an attacker to get a toehold…… 5 Uninstall the 2 old Java that you have, reboot and update to the latest version (V6 update 29 will do nicely!) 6 Make sure you have updated Flash and also Shockwave to the latest versions….. 7 Your logs indicate that you had installed P2P file sharing at some time… probably now long since removed, but do check that you removed it all, including toolbars etc. and deleted any files downloaded via P2P where their provenance is not 100% 8 Your machine is a powerful beast…. good processor, lots of memory it should be fast….. was it originally fitted with Vista or did you install Vista to a basically new machine? if so did you install all chipset drivers video and audio drivers etc? (or did you just rely on the native Win Vista drivers? 9 Once you have followed the recommendations above and have 16 to 20% free disc space and updated Java Flash etc run chkdsk /r again and see if any more problems are resolved 10 Next run sfc /scannow from a cmd prompt (Run as Administrator) 11Next reboot your machine and then start Internet Explorer and see if you can watch a "you tube" video 12 try Internet Explorer with no "add ons"…any improvement? 13 Boot into safe mode with networking and try visiting www.bbc.co.uk for a short bu thorough test (don't go anywhere else and no downloading emails or surfing! as your protections will not be effective. Let us know how you go Regards paws 9

Hi Paws: I have 24% of free space on my HD. My PC came with Windows Vista software installed. I am unsure if all the chipset drivers and audio drivers were installed. I've had no problems since mid-October with video and other script-based content on the web. I have removed the old and updated Javaware and installed new with Adobe Shockwave and Flash. I have run the command for chkdsk /r and after it reboots says that it cannot run the command as the volume cannot be accessed. I cannot run my PC in safe mode with networking because it locks up the PC everytime as it loads systems drivers. I've run sfc /scannow command at the command prompt with admin rights and it has completed its scan and found files it cannot repair. I would post the CBS.log but its a huge file and I cannot attach it to a post. There is no presence of Vuze or P2P file sharing software except Vuze Remote toolbar which I cannot uninstall under Programs and Features in Control Panel. ~James

Oh and the internet experience has not improved. ~James

Hi James, all Understood Have you tried running the hard drive manufacturers disc checking/repair utility..? .as the inability to run chkdsk and sfc's inability to repair corrupted/damaged/missing Windows protected System files is pointing towards a failing hard drive Regards paws

Hi Paws: I ran Seagate Tools for Dos in Post #11. Should I do another? ~James

Hi James…yes… that will pick up most hard drive problems…first do the short test….then if no probs found do the long test…… When folks have problems with chkdsk its often a hard drive problem (assuming the operator is running chkdsk properly and it's not operator eror!) and this indication is strengthened when sfc has found Protected file problems and can't fix them. If this machine was in my workshop… these are the steps I would take: 1 Run a live distro Linux….. Ubuntu, Puppy or whatever is your favourite….. this will ( by definition) run solely in memory and will not write anything to your hard drive (unless you instruct it to!) Test the machine thoroughly……. any problems remaining…?. if there are no problems running Linux Live distro then we have ruled out hardware failure in the rest of your computer (excluding the hard drive) so the Problem is either in the hard drive itself (its electro-mechanical components) or in the Windows operating system or application software. The hard drive testing /repair utilities are good but not infallible! 2 Its the work of a moment to install a new hard drive and it doesn't take long to install Windows on it, install Flash etc and then see if your Youtube or whatever works… I appreciate that on the face of it…. most folks regard this sort of approach as too time comsuming, but sometimes its a quicker and more efficient method than trying ad hoc fixes……. In the workshop where time is money and computers must be fixed quickly and completely to satisfy customer's legitimate expectations…its the approach we would use to identify and solve the issues you are experiencing. Hope this helps Regards paws

Hi Paws: Thanks for the response. I understood from the beginning that I may have to replace the HD to get my PC problem-free. 1. I don't know anything about distro Linux. What kind of program is it? Please supply more info. 2. I would need more info on putting Windows on a new Hard Drive. Can I do it from the recovery discs I burned when I bought the PC? More info please. 3. I will run Segate tools for Dos to scan the hard drive once more Can you recommend a hard drive supplier to contact? ~James

Excuse my barging in… Greyhome, can you please compress your cbs.log file into a .zip file and attach it to the forum? To do so, right-click it and send to -> compressed zip folder. A new .zip file will be create that you can attach to the forum. Can you also download Mozilla Firefox from www.firefox.com and see if it behaves normally? I've been following along and would like to see the results of these two requests and maybe I can offer a couple of fresh ideas. Thanks Paws and Greyhome.