Here's the Malewarebytes log. The only items that came up were 3 listings for the Blekko Search Bar. I thought I had gotten rid of that in the past, but it's back again. What exactly is that?.
———————————————————————————————
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Database version: v2012.07.20.07
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Jerry :: SERVER [administrator]
8/10/2012 3:00:19 PM
mbam-log-2012-08-10 (15-27-28).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 193783
Time elapsed: 15 minute(s), 5 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7D9E1ADC-7DB1-4EAF-B6C7-7E062074E6BE} (PUP.BlekkoSearchBar) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7D9E1ADC-7DB1-4EAF-B6C7-7E062074E6BE} (PUP.BlekkoSearchBar) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7D9E1ADC-7DB1-4EAF-B6C7-7E062074E6BE} (PUP.BlekkoSearchBar) -> No action taken.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Results of screen317's Security Check version 0.99.43
Windows XP Service Pack 3 x86
Internet Explorer 8 ``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG Anti-Virus Free
Antivirus up to date! `````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
JavaFX 2.1.0
Java™ 7 Update 4 Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader X (10.1.3) ````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe `````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 11% Defragment your hard drive soon! ````````````````````End of Log``````````````````````
Blekko was still hanging around but seems to have been dealt with. Apart from that things are still looking good.
A final scan should show that all is well.
Run ESET Online Scan
Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply. Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.
NOTE. If Eset doesn't find any threats, it won't produce a log.
I followed your instructions but cannot get the Eset Online Scanner to work.
My anti-virus is disabled. I held the CTRL key and clicked the ESET link you provided.On the ESET "Get A Free Virus Scan" page, I clicked "Run ESET Online Scanner".
A box came up with the terms of use. I accepted as instructed, then click "Start"
After about 10 minutes a box came up. At the top is, "Click here to install the following ActiveX control, "Online Scanner cab" from ESET, spol. sro…
When I click to accept this, another box come up labled, "Windows Internet Exporer". Beneath this, in the box is, "To display the webpage again, Internet Explorer needs to resend the information you've previously submitted. If y ou are making a purchase, you shoukl click Cancel ro avoid a duplicate transaction. Otherwise, click Retry to display the webpage again.
If I click Retrry it goes back to the page labled, "ESET Online Scanner-Windows Internet Explorer". I can't get beyond that point…
The problem is probably due to Eset having been run before and there is an old remnant of the ActiveX file still on your computer. Let’s get rid of it and try again.
Run OTL
double click on the icon to run it.
copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL
Ran OTL as instructed and rebooted. Ran ESET again with the same results as before.
Checked the box to accept the Terms of Use and clicked "Start".
This brought up the page labled at the top, "ESET Online Scanner - Internet Explorer. After 10 minutes, as before, the ActiveX warning came up. I can't get beyond this page.
This is the 2nd OTL scan. I didn't have my anti-virus disabled the first time. It hasn't made any difference. I still can't do an ESET scan. I get just a couple pages and get the same ActiveX message I mentioned before. I can't get beyond this.
******************************************************
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Starting removal of ActiveX control {7530BFB8-7293-4D34-9923-61A11451AFC5}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Jerry
->Temp folder emptied: 7253 bytes
->Temporary Internet Files folder emptied: 1091998 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 470 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16889 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.00 mb
OTL by OldTimer - Version 3.2.55.0 log created on 08122012_174439
Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_77c.dat not found!
PendingFileRenameOperations files…
File C:\WINDOWS\temp\Perflib_Perfdata_77c.dat not found!
Registry entries deleted on Reboot…
If you are having a problem, let's try another scan.
Run AVPTool by Kaspersky
Please click here to download AVP Tool by Kaspersky.
save it to your desktop.
reboot your computer into SafeMode.
You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.
double click the setup file to run it.
click Next to continue.
it will by default install it to your desktop folder. Click Next.
hit OK at the prompt for scanning in Safe Mode.
it will then open a box. There will be a tab that says Automatic scan.
under Automatic scan make sure these are checked.
System Memory
Startup Objects
Disk Boot Sectors.
My Computer.
Also any other drives (Removable that you may have)
After that click on Security level then choose Customize then click on the tab that says Heuristic Analyzer then choose Enable Deep rootkit search then choose ok.
Then choose OK again then you are back to the main screen.
then click on Scan at the to right hand corner.
it will automatically neutralize any objects found.
if some objects are left un-neutralized then click the button that says Neutralize all
if it says it Cannot be Neutralized then choose the Delete option when prompted.
after that is done, click on the reports button at the bottom and save it with the file name Kas.
save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report - it will be at the very top under Detected. Post those results in your next reply.
Note: This tool will self-uninstall when you close it so please save the log before closing it.
After almost 6 hours to download AVP Tookls, it doesn't work.
I tapped the F8 key while restarting and a page came up labled, "Windows Advanced Options Menu". I highlighted "SAFE MODE" and clicked ENTER.Then I was instructed to choose the operating system to start. I chose Windows XP Professional.
Then a page of numbers came up. It didn't stay long so I couldn't get much of it, but most of the line began with,
"multi(0)disk……….That's as much as I could get. Each line filled the width of the screen.
Then a page came up asking me to select my user name. The two choices were Administrator and Jerry. I clicked Jerry. A box came up asking if I wanted to continue in Safe Mode. I clicked YES and this took me to the desktop in Safe Mode.
Most of the steps you mentioned never appeared. After highlighting Safe Mode and clicking ENTER, you said to click the setup file. There was no Setup File to click. You mentioned a tab that says "automatic scan". That wasn't there. You said under "automatic scan" to make sure System Memory, Startup Objects, ect. are checked. None of these appeared anywhere to check.
From the SAFE MODE dsektop I clicked the icon to run AVP Tool. A box came up and 4 items were listed then an error box came uphat said, "Some installation files are corrupt. Please download a fresh copy and retry the installation.
In the main page behind this box, the last of the 4 items listed is, "CRC failed in 0048461rar.exe
Unexpected end of archive.
This is as far as I got with AVP Tool.
Where it said to "ownload a fresh copy", does that mean download AVP Tool again? A month or 2 ago when I got everything going good again, I didn't have to use AVP Tool.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
