Virus - XP Internet Security 2012 [Solved]

Hi peteinmaine,

Nothing of real consequence in the ESET log. Anything in the OTL folder will be removed when we remove OTL.

pw finder.exe Is this a password finder?

Next, Double click on OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:services

:files
C:\Program Files\mozilla.org\Mozilla\plugins\npzango.dll

:Commands
[CLEARALLRESTOREPOINTS]

Then click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Hello Oldman960,

pw finder.exe Is this a password finder?

Yes. But it is a long ago used on a Word file & no longer needed.

OTL.log to follow:
=============================================================================

========== SERVICES/DRIVERS ==========
========== FILES ==========
C:\Program Files\mozilla.org\Mozilla\plugins\npzango.dll moved successfully.
========== COMMANDS ==========
Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.31.0 log created on 01142012_203308

Hi peteinmaine,

Ok you can delete it if you don't need it. If no problems we'll clean up the tools.

From your desktop, please delete, if present

• any notepads/logs that we created
• aswMBR.exe
• mbr.dat
• mbr.zip

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep it updated and use it regularly.

Updates and upgrades

You can get a new copy of Avast from

Avast
Help and support can be found here Avast Forum


XP SP3

You can either get it through Windows Updates or download the stand alone installer from HERE . It may say "for IT Professionals and Developers" but you can saelt use it. TIP: When installing SP3 make sure your antivirus program is disabled.


Adobe Reader

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources. If you choose to install Foxit decline the Foxit toolbar.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 7.0.8 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Add a firewall you have.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)

You have SpywareBlaster installed, use it. It will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Make sure you have reset Automatic Updates to your chosen option. Click your start button > Control Panel > System > Automatic Updates tab > Updates tab


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE

Take care

Hello Oldman960,

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Add a firewall you have.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)

You have SpywareBlaster installed, use it. It will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis
- Make sure you have reset Automatic Updates to your chosen option. Click your start button > Control Panel > System > Automatic Updates tab > Updates tab

Here is my problem. Windows Firewall no longer works. The 2nd party firewall no longer works.
See attachments:
1- A warning pops up (#5).
2- So, I go to windows Firewall (#1)
3- As you see (#2), I cannot activate the windows Firewall [a long, LONG time ago!]
4- I press "Security Center (#3) & "Turn on Automatic Updates" [Remember, I cannot turn on ANY firewall]
5- Again. windows tells me I cannot do this (#5)

When the windows Firewall was originally disabled, I went to Zone Alarm. When THAT firewall proved to have problems [design problems by Zone Alarm], I used Comodo. However, now I am no longer able to load Comodo.

Windows Updates:
http://www.update.microsoft.com/windowsupd…mp;thankspage=5
Windows only tells me to do what I cannot

Any ideas?

Hi peteinmaine,

Ok one step at a time.

Make sure that the startup type for the following services is set to Automatic, and that the status is set to Started:

Automatic Updates
Background Intelligent Transfer Service (BITS)

• Click Start, click Run,
• in the run box copy and paste services.msc and click OK.
• In the list of services, right click Automatic Updates,
• click properties
• make sure the Startup type is set to automatic
• if it isn't use the drop down menu to set it to automatic
• Make sure the service status is Started
• If it's not runing click the start button
• Do the same for Background Intelligent Transfer

If you made any changes click Apply, and then click OK.

Hello Oldman960,

Click Start, click Run,
in the run box copy and paste services.msc and click OK.
In the list of services, right click Automatic Updates,

Really? [See attachments] Automatic updates is supposed to be there? Could not locate it. I gather they are supposed to be alphabetic. Alphabetic is that of which I did a screen capture. [On edit, I added the 2nd attachment which shows the balance of all the services] I searched the entire list, even for a name such as "Windows Automatic . . ." I also searched the "Standard" tab [as if there would be some difference]. Still, nada. Have I missed something?

Please advise. Thanks.

Hi peteinmaine,

• Click Start, click Run
• In the run window, Copy/paste the bold line below into the white window then click ok
  
  REGSVR32 %SystemRoot%\System32\WUAUENG.DLL

Now check to see if Automatic Updates is present in services.msc

Is Background Intelligent Transfer in the list?

Hi

While you are in services.msc have a look for this service Windows Firewall/Internet Connection Sharing (ICS). Just let me know if it's there and what it's status is.

Hi peteinmaine,

• Click Start, click Run
• In the run window, Copy/paste the bold line below into the white window then click ok
  
  REGSVR32 %SystemRoot%\System32\WUAUENG.DLL

Now check to see if Automatic Updates is present in services.msc

Is Background Intelligent Transfer in the list?


Click Start, click Run,
in the run box copy and paste services.msc and click OK.
In the list of services, right click Automatic Updates,
click properties
make sure the Startup type is set to automatic
if it isn't use the drop down menu to set it to automatic
Make sure the service status is Started
If it's not runing click the start button
Do the same for Background Intelligent Transfer

If you made any changes click Apply, and then click OK.

Automatic Updates : Automatic Updates is now present & DONE
Background Intelligent Transfer : DONE

Hi peteinmaine, Have a look at my post right above yours.

Hi Oldman960, As we see with the previous tow attachments ["services.msc" screen capture] Windows Firewall/Internet Connection Sharing (ICS). does not exist

Hi peteinmaine,

Sorry about that.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield
• Do not copy the word CODE , please note the script starts with the :
  

  :reg
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess /s

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Hi Oldman960,

SystemLook.txt to follow:
=============================================================================
SystemLook 30.07.11 by jpshortstuff
Log created at 19:51 on 15/01/2012 by Peter
Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Start"= 0x0000000004 (4)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
(No values found)


-= EOF =-

Hi peteinmaine,

Doesn't look like the firewall is installed.

• Click Start, click Run,
• type cmd and then click OK.
• At the command prompt, copy and paste the following command line, and then press ENTER:
  
  Rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf

When it's finished reboot your computer.

Next

• Click Start, click Run,
• type cmd and then click OK.
• At the command prompt, copy and paste the following command line, and then press ENTER:
  
  Netsh firewall reset

Next

• Click Start, click Run,
• At the command prompt, copy and paste the following command line, and click ok
  
  firewall.cpl

If everything went right you should see the firewall interface. How did you make out?

Hello Oldman960,

Click Start, click Run,
type cmd and then click OK.
At the command prompt, copy and paste the following command line, and then press ENTER:

FYI: "copy and paste" doesn't work at the Cmd prompt. I had to type the command in manually. It was a long command & failed with correctly typing it the 1st time.

firewall interface is AOK!
Automatic Updates: is ON!