No applications running / 1.5 hrs to boot

Haven't worked on a XP machine in a very long time.
You realize what we try to correct will still leave your machine vulnerable?

Let's try to do a few things without rebooting till we can get some of these malicious files off.

Print this topic or save to notepad, it will make it easier for you to follow the instructions and complete all of the necessary steps as we will need to close all windows that are open later in the fix.


Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows and browsers except HijackThis and press fix checked.



C:\Documents and Settings\pete\Local Settings\Application Data\VNT\vntldr.exe
C:\Documents and Settings\pete\Application Data\Search Protection\SP.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://vosteran.com/…=1457156043&ir=
O2 - BHO: Browser Extensions - {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} - C:\Documents and Settings\pete\Application Data\BrowserExtensions\Coupons.dll
O4 - HKLM\..\Run: [VNT] "C:\Program Files\VNT\vntldr.exe"
O4 - HKLM\..\RunOnce: [WSE_Vosteran] C:\WINDOWS\system32\wscript.exe /E:vbscript /B "C:\DOCUME~1\pete\APPLIC~1\WSE_Vosteran\UpdateProc\bkup.dat"
O4 - HKCU\..\Run: [Search Protection] "C:\Documents and Settings\pete\Application Data\Search Protection\SP.EXE" /autostart
O4 - HKCU\..\Run: [Browser Extensions] "C:\Documents and Settings\pete\Application Data\BrowserExtensions\BEHelper.exe"
O4 - HKCU\..\RunOnce: [WSE_Vosteran] C:\WINDOWS\system32\wscript.exe /E:vbscript /B "C:\DOCUME~1\pete\APPLIC~1\WSE_Vosteran\UpdateProc\bkup.dat"



Download OTM by OldTimer Here & save it to your desktop.

• Double click on OTM.exe to run it
• Copy & paste the contents inside the Code box below beginning with :Files into —>> Paste Instructions for Items to be Moved

Note: Do not type it out to minimize the risk of typo error

:Files
C:\Documents and Settings\pete\Local Settings\Application Data\VNT\vntldr.exe
C:\Documents and Settings\pete\Application Data\Search Protection\SP.EXE
:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
[-HKEY_CLASSES_ROOT\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VNT"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WSE_Vosteran"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Search Protection"=-
"Browser Extensions"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WSE_Vosteran"=-
:Commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]

• Click on MoveIt!
• When done, click on Exit

Note: If a file or folder can't be moved immediately, you may be asked to restart your computer. Choose Yes.
A log will be produced at C:\_OTM\MovedFiles\date_time.log, where date_time are numbers. Post this log in your next reply.

~~~~~~~~~~~~~~~~~~~~~

If there are any personal files, pics, etc. on your computer you cannot live without, back them up now just as a precaution.
Emergency Backup Procedure - Tech Support Forum

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

How to use ComboFix

Download ComboFix from here:
Link 1
Link 2
Link 3

Place ComboFix.exe on your Desktop <–Important

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  ComboFix doesn't play well with AVG, make sure you try to disable it using the directions found in the link below.
  
  You can get help on disabling your protection programs here
• Double click on ComboFix.exe & follow the prompts.
• You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)
• Your desktop may go blank. This is normal. It will return when ComboFix is done. Combofix may need to reboot your computer more than once to do its job this is normal.
• When finished, it shall produce a log for you. Post that log in your next reply
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  
  Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer
  
  ———————————————————————————————
• Ensure your AntiVirus and AntiSpyware applications are re-enabled.
  
  Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
  Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.
  ———————————————————————————————
• If there are Internet issues after running ComboFix:
  Internet Explorer:
  Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" and check to "Automatically detect settings". Also clear any proxy address and port. ok, apply (only if applicable), ok.
  Firefox:
  Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection. "No Proxy" should be selected, unless you have one set up yourself.
  Chrome:
  Select -> Tools menu -> then "Options", then go to "Change Proxy Settings", then "LAN Settings" , then take out the check mark for "Use a proxy server for your LAN" if set, unless you set this up yourself.
  Safari
  Launch Safari
  Go to general settings menu
  Then in Preferences/ Advanced
  Then on line click Proxies change settings …
  Click Internet Options, then click the Connections tab, click Network Settings.
  Disable option (uncheck) for the use of proxy server …
  
  

We got some work to do here….

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

• [external image: xehzOq95.png.pagespeed.ic.1o1xpAkZbO.png]Backup Internet Explorer Favourites
• [external image: xQlf57ne.png.pagespeed.ic.SnwgqhVB9v.jpg]Backup Firefox Bookmarks
• [external image: U5NwUGc.png]Backup Chrome Bookmarks

We're going to have to uninstall both Google Chrome and Firefox, this will ensure both will be cleaned.
Tools we can use will jab at it but it's best to backup favorites, then reinstall.

Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on Google Chrome
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

NEXT** Do the same for Firefox


~~~~
http://www.google.com/chrome/ <–For Google Chrome reinstall

https://www.mozilla.org/en-US/ <–For Firefox reinstall


~~~~~~~~~~~~~~~~~~~~~

I'm going to try and not hit you with to much to do at once….

[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  
  

Info:  Chrome did not reinstall easily.  Upon first attempt, to run Chrome after the reinstall, it just vanished & nothing happened.  I RE-uninstalled it & gave it a 2nd round with a re-boot.  The 2nd attempt initially did not appear to yield any positive results.  Initializing Chrome took btwn 1 & 2 minutes.  However, I have confidence that from here on, it will respond better.

 

A couple of quick questions:

1- Running FRST.exe, I was not presented with a "Run as administrator" option.  However, the app runs till I view: (see attachment)

2- You mention "Ensure the Addition.txt box is checked.".  AM I to believe that this is in ADDITION to what is checked by default?  (see attachment).  i.e. the boxes checked, in addition to the "Addition.txt" are all checked by default (i.e. the White list).  

• Should I run from this point as is?
• Do I UNcheck the other boxes & run?

The infections you have on the computer are causing most of these problems.

When you open FRST, if the Addition.txt is already checked, good!
Sometimes it's not. Thats the only check box we need for right now.

My comment Run as administrator is more or less for newer operating systems which generally are Windows Vista - Windows 8.

Hello Juliet,

 

Re: "Are you receiving help elsewhere?, I see the presence of running ComnoFix?"  Ans:  No, I am not.  This assistance is the ONLY assistance I am receiving.

 

Stuck>  Re:  "When the Control Panel window opens click on the Uninstall a program"  I see no selection "Uninstall a program". (see attachment).  I changed to view categories, but still no "Uninstall a program"  I have "Add / Remove Programs, but nowhere can I find what you point out.  Please advise.  Thanks.

Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on Slick Savings
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

If successful try these others one at a time.


Ebay Shopping Assistant by Spigot
Browser Extensions
Search Protection
YTD Video Downloader 4.8.7

Hello Juliet,

 

Found & removed:

 

However, I have opened Firefox & located Slick Savings.  Removed

 

Still, no Slick Savings nor Ebay Shopping Assistant found for uninstall 📎Revo.PNG

 

 

Will proceed at, "Open notepad. Please copy the contents of the quote box below. To do this . . . " when instructed to.

Please advise.  Thanks.

Now
please post
Fixlog.txt
C:\AdwCleaner.txt
JRT.txt

it's late here and I got a baby to put to bed. Will be back in the morning.

Looks good, remove quite a bit of stuff.

Hope your seeing improvements?

Download Malwarebytes' Anti-Malware to your desktop.

• Windows XP : Double click on the icon to run it.
• Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: MBAMDashboard_zpsddef9b5f.gif]

• On the Dashboard click on Update Now
• Go to the Setting Tab
• Under Setting go to Detection and Protection
• Under PUP and PUM make sure both are set to show Treat Dections as Malware
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
• Then on the Dashboard click on Scan
• Make sure to select THREAT SCAN
• Then click on Scan
• When the scan is finished and the log pops up…select Copy to Clipboard
• Please paste the log back into this thread for review
• Exit Malwarebytes

***************************************

How's the computer now?