Reformat and Clean Install - How the TECH do ya do it?

Toshiba Satellite M45-S355; Windows XP Home SP2; 1.8 Ghz Intel Processor; 100 GB HDD; 1 GB RAM. It was giving me all kinds of trouble and finally refused to work at all, so out of desperation, I reformatted and setup using the Toshiba Recovery CD over the weekend. However, it only did a quick format of the drive - - I don't know if that's the trouble, but it still doesn't seem to be right. It's much slower than it was before the recovery and it freezes up repeatedly. I updated everything immediately after the recovery. I installed Zone Alarm Internet Security and began deleting all the stuff the recovery disk put on that I didn't want. During this deletion, I got the blue screen stop error; Windows asked that an error report be sent, so it was. During the next few hours, the stop error occured three more times. After the last error report, Microsoft replied that it needed an updated driver, which I downloaded. The computer has run for several hours without any more blue screens; however, it still just isn't right. I would like to do a complete format of the drive and a clean install of Windows. Here's the trouble: I did that in May with the help of Toshiba phone tech support guy(s). It took days because I kept getting switched between guys or cut off. Finally got set back up after about 8 days and the computer was fine until it was attacked when I stupidly downloaded a bitmap converter from a free software site. Tried everything to get over it - - but after purchasing Zone Alarm, new spyware, etc. the computer was still acting weird: spawning programs, redirecting websites, freezing up, etc. until it finally refused to load Windows. Hence, the attempt at reformat/recovery. The XP on the recovery disk is Windows Home Edition. I tried and tried to get assistance on another tech-help site but never could get anywhere (before the recovery attempt) - - I had done a Panda Totalscan and found an RKinstaller which it couldn't fix for some reason and also had sent a HiJackThis log to the tech site and the reply was that there was also a rootkit (whatever that is) on the drive and I needed to completely reformat and do a clean install instead of a recovery, but that was as far as it got. Days went by with no further instruction, and I needed the computer. Obviously, I'm clueless. I've been using computers for 20 years, but this spring was the first time I'd done reformatting and that was with a lot of help and done over several days time and quickly forgotten. So, here're the questions: (1) Is it legal to use a copy of Windows XP Pro from a previous computer which died and has been scraped? It is an OEM CD that was installed by the builder I hired to build that desktop computer ($2500)- - something went wrong with the processor after about a year's use and I scraped it and bought the Toshiba notebook in 2005. I'd like to use the Pro Edition if it's legal. Someone told me that it was legal because it isn't being used on any other computer anymore, but I'd like to be sure about that. If so, is it okay to use the OEM Windows XP disk from another computer? The only other Windows copy I have that I can use for the new setup is on the Toshiba recovery disk. (2) I downloaded all the drivers for the Toshiba from Toshiba's driver download page, but I seem to remember there's a specific order in which they need to be installed. Is that so? If so, how would I know what the order was? (3) I should have written it all down but didn't (a mistake I won't make this time); but I just don't recall how to proceed. Do I just choose the C: drive and tell it to reformat? Then what? Should the XP disk be in the CD drive when the computer is reformatted? After the format and install and update of Windows, are the drivers next? (4) Is that all there is to it before loading software - - reformat; install and update Windows; install drivers? Is there more to setting up? (5) Over the past year or so, I've purchased SpySweeper; Ad-Aware Plus; Norton's Internet Security with Norton's utilites such as WinDoctor and defragger called SpeedDisk, etc. (replaced Norton's now with Zone Alarm Internet Security); XoftSpy; Spyware Doctor; and SUPERAnti-Spyware (which I returned); Registry Mechanic; and PC TuneUp just trying to stay safe or fix this last disaster. Also, had downloaded some free stuff recommended by some folks, such as SpywareBlaster; AVG Anti-virus; AVG rootkit. SpySweeper seems to be having trouble with Zone Alarm or maybe it's just that the computer isn't stable. Which of these are actually necessary and won't conflict with the others? I just can't spend anymore money on computers right now, so I have to use something I've got. (6) And, finally: my husband and I pastor a small church and have used a wonderful Bible software program I downloaded from the Internet. The basic program is free and then you can purchase add-ons, which I did. I made copies of all of it in case of disaster. Yesterday, I attempted to put it on my machine; however, Zone Alarm detected a virus with every file - - the same virus attached to each different file - - TROJAN-PDW.Win32.OnLineGames.zc - - WITH EVERY FILE and there are dozens of separate installation files for this program. I thought somehow the CD copies were bad so I attempted to re-download from the site (e-Sword.com), but Zone Alarm wouldn't download because of the Trojan connected to all the files on the site. Is it possible this is just something the site or the program needs for all the downloads/installations? When I googled it there were a lot of sites talking about that same Trojan and how to get rid of it but no mention of e-Sword. Is there a way to safely use this program? - - it's a really great study tool for ministers. It's also installed on my husband's Dell Inspiron. It's been on both computers for almost a year, both before and after the reformat in May. Possibly, it's what caused the trouble with the Toshiba. The Dell's running really slowly, especially on the Internet, (but that's a different post one of these days). I know I've been lengthy, please forgive my wordiness. If anyone can help, it would be most appreciated. Thanks in advance, LostInCyberSpace

Hi Lostin

I can only help partially, I'm afraid, but here goes. Microsoft provide all kinds of useful info on their Knowledge Base. Here's a place to start with repairing / reinstalling Windows. In Place Reinstall

As to your security software, you have multiple conflicts. This may be the source of all your troubles. You only need ONE each of: firewall; antivirus, anti-spyware with resident protection; (optional, very optional) standalone anti-spyware scanner.

As a basic kit I'd recommend (others will have their favourites, but these are all free and reliable) PC Tools Firewall Plus; AVG Antivirus Free Edition; Windows Defender; (optional) AVG Anti-Spyware Free edition. If the last one offers you a free trial of its paid-for real time protection, decline the offer, as this is already being provided with Windows Defender. Google will give you the download addresses. If Microsoft has issues installing Windows Defender (e.g. it can't validate due to your attempts at making repairs) then you could try Spyware Terminator (without the Web Guard or whatever it's called and without the Clam AV, to avoid conflicts.) Just install the basic program with resident protection. Don't keep doubling up - stick to one good 'un of each kind of protection. Uninstall everything else properly, through Add & Remove Programs, and keep it uninstalled…

eSword is a magnificent bit of kit, and perfectly clean. There was a rash of false positives, especially on the installers for Bible and commentary modules. but that's all they were. Many AV providers sent out updates around October 31st with these false detections - they've since been corrected. eSword is fine, clean as always, praise God!

Hope it all works out for you - it's horrible when everything goes wrong like that!

Greetings, PVTele! It's great to hear from someone. I noticed that you just joined this forum today. I joined 10 days ago and this is the first I've heard from anyone; however, I was able to get quick help on another forum the next day. I had become infected with some nasties and had a bad memory module, but things are looking up. It's amazing how you can use the Internet for email and for research to teach Bible classes and find that somehow you've gotten infected with something called "Kitten Free Sex Dialer" and "RKinstaller"! Horrible little things that you don't know are there and can do wretched things to ya! I was happy to hear about e-Sword. I let ZoneAlarm "disinfect" my backup and that seemed to make the firewall happy. I installed e-Sword and it's been working fine. Both my husband and I love the program and we've bought several of the add-ons. They have a new audio Bible for about $25.00 that looks good - - it's dramatized. I will check out the link you sent and keep it for future reference. Thanks for your reply. Have a very blessed day! LostInCyberSpace

Hi LostinCyberSpace, I'm sorry you had to wait for a long time before you got a response, I usually try to respond pretty quickly where i feel I can help, but I guess in the case of your particular post I must have missed it! and obviously the same applies to the other regulars on this forum. If you still need help on reformatting your machine and installing Windows then please post back here (shortish posts if you can manage it!) and I will do my best to help. 1 Are you still troubled with malware? 2 s your machine quick, reliable free from crashes or stall/lags and now running perfectly? 3 Do you have a back up or disc with all your drivers together with any updated ones? 4 It is odd that you have needed to reformat twice within a short space of time ( this is abnormal and needs investigating) 5 Have you used System Restore to "turn back the clock" on your machine subsequent to it becoming infected? 6 Have you thoroughly checked your data back up files to see if they are contaminated with any viral or other malicious code? 7 Having had hardware problems ( with your RAM )have you had the rest of your machine professionally checked and cleaned? An OEM version of windows generally can only be installed on the original machine that it was purchased with. Post back and let us know how you want to proceed and we will do our best to help. Regards paws

I'm sure there are many folks clamoring for assistance. It isn't at all odd that some might be missed for a while. I got some help on another forum right away, but within hours after closing the topic, suffered another crash. I'm just not sure how to proceed. To answer your questions: 1. I'm not sure. Downloading an update to RealPlayer, I got an alert saying a trojan had been blocked, then an immediate STOP error. I've run several anti-spyware scans and ZoneAlarm anti-virus - - trojans have been deleted a couple of times. I don't know where they're coming from. 2. Not running perfectly. The system is Is slower to boot up, runs slower than before, and sometimes the mouse cursor jumps around. Sometimes when I try to go to another page on the Internet, the same page reloads. Freezes up sometimes. 3. Have downloaded all the drivers for this model. 4. Had to reformat before because of damage done by a Trojan that I don't know how I got - - this time the system crashed when I stupidly tried to download a 'free' graphics converter. 5. System restore wouldn't work, Windows wouldn't even come up; that's why I had to use the recovery disk, which only did a quick format. 6. Have scanned all back-up files with ZoneAlarm and Spy Sweeper. 7. No, I only installed new RAM purchased from Crucial (it was a financial stretch) after MemTest86+ showed bad RAM. The machine isn't overheating or anything. If I could afford it, I'd take it somewhere to have it looked at, but that's not an option right now. I have the Toshiba recovery CD with XP Home on it, but I don't know how to get it to do a full format. Plus, it put on several things I don't need and am not sure if I can safely delete. I wouldn't want them back on if I reformatted. Any advice will be very much appreciated. Thank you for your response and your help. LostInCyberSpace

Hi,
I understand,
In the final analysis it must be your call on whether or not you wish to do a reformat and reinstall of Windows.

It is generally considered to be a "last resort" or suitable only when a particular form of malicious code has been found on your machine or when the usual techniques of correcting your machine's behaviour by more conservative means have failed.

In our workshop we usually take about 3 to 4 hours to do this work (sometimes it's shorter, but rarely much longer!) however I have known folks who have spent weeks (literally) trying to carry it out successfully and then, finally, have been forced to take their machine in to a workshop in order to get it serviceable again…… In view of this you can see why I say "its your call"

The symptoms you describe, coupled with the history you have given, indicate to me that whatever you decide to do…..its' probably going to take a lot of time, application and commitment on your part to get your machine satisfactory again. I think it's important to understand that before we go any further.

I am quite willing to stick by you and offer any assistance I can, and draw upon the support of colleagues here on the forum where appropriate, but it's you that 's sitting in front of your machine and not me!

To establish if there is malicious code present on your machine, viruses, worms, Trojans, spyware etc) it will be necessary for you to visit our malware removal forum and post an HiJackThis log in order that a trained malware fighter can take a look at exactly what is going on inside your machine. He or she will then provide you with detailed and specific instructions on exactly what you need to do to eradicate any infections found.

Please understand that if you adopt this course of action, then you should accept advice and follow the recommendations only from your expert adviser. (for this reason we would not want here on this particular sub-forum to offer any advice or recommendations until your machine had been declared clean of infections, by your malware removal expert .) If malware is found on your computer the cleaning process can involve a fair amount of work….there is rarely a "magic bullet" that fixes the entire problem at one hit! Once your machine has been declared clean by your malware removal expert please feel free to post back here in this thread if you are still having issues with your machine and we will do our best to help.

I don't want to appear unduly gloomy, but felt an obligation to you to spell out in just a little detail what we are faced with here.

So if you want your machine checked for malware then please go here and follow the instructions:

http://forums.whatthetech.com/Welcome_New_…ers_t34502.html

Please make your Topic as follows: Referred by paws" (without the quote marks) and provide a link to your post here on this forum (so they can see the background information.)

In any event, whatever you decide to do, please let us know your ntentions, but please don't post your HJT log in this subforum as we don't analyse them here!
Regards
paws

Yes, I agree. The thought of reformatting again is daunting. I'm sure that I could do it with help because I've done in once before with help, but still, it's a big job after which you still have to reinstall all your software and files, too. Because of the incident with a trojan the other day, a HiJackThis log would probably be a good idea, however, I've scanned again and again. Other than those two or three scans a few days ago, nothing that looks significant shows up. Before I post a log (knowing it takes someone quite a while to look over it and evaluate all the info), do you think I should run a System File Check? Could some files be damaged due to the problems the other day with the trojan, blue screens, etc.? I haven't done a file check before, but it looks fairly simple. I read an article by a Microsoft engineer about it. I'll wait to hear from you before I do that. Can you send instructions on how to provide a link back to this page if I post a log in the other forum? I see "Insert: Post Link" in the Quick Access Box, but I'm unfamiliar with how to use it to link between here or there and somewhere else. I REALLY appreciate your help. Thank you, thank you, thank you, Sharon (LostInCyberSpace)

Hi, Ok,
Yes I understand, It might be sensible to print this out for reference…..

When you post your HJT log in the Malware removal forum please make your topic "Referred by paws, Tech Team" (without the quotes)
The link back to this page is:
http://forums.whatthetech.com/Reformat_and…728#entry414728
All you need do is to:

a.) highlight this link (left click and drag until all the text highlights,) [generally turns blue]
b.) hold down the Ctrl key and press c
when you need to paste it in your malware thread, (or into notepad, see instructions below) position your cursor where you want the link to appear and:
c.) hold down the Ctrl key and press v

If you need to keep a permanent note of the link for your own purposes then try this:

01 Click on Start
02 Click on Run
03 Type in:
notepad
04 notepad will open, so now you can:
05 hold down the Ctrl Key and press v
your link will appear.
to save this notepad text file
06 Hold down the Ctrl key and press s
in the box that opens labeled "Save In"
07 Click the down arrow and:
08 Click on "Desktop"
09 Move your cursor down to "File Name"
10 if the file name is not highlighted Click on it to highlight it, if it is already highlighted then:
11 type in:
linktopaws
12 Click on "Save"
You should now have a link to this thread here safely on your desktop.

It is Ok to run the Microsoft System File Checker, before you post your HJT log (not afterwards please unless asked to by your expert helper).
This will check for any damaged or missing Windows protected System Files and attempt a repair by copying over fresh and intact copies of the required files, either from within your computer or by asking you to insert the Microsoft Windows XP installation disc. (Its Ok if you don't have the disc, to borrow the correct copy of the disc from a chum, providing it's the same version and Service Pack level (SP2) as that installed on your machine.)
The scan will take approximately 20 minutes or so to complete and will fix errors found automatically. There will be no log file created.

The procedure to start the scan is to:

13 Click on Start
14 Click on Run
15 type in:
sfc /scannow
(please note the space between the "c" and the "/" is essential)
16 Click on OK
you may then stay poised, disc in hand, ready to insert it, if asked…..
When it is all done, remove the disc (if you were asked to insert it) and:
17 Close down your machine
18 Wait 30 seconds
19 Restart your machine and see how you go.

The very best of luck to you and remember, once you have made your post with the HJT log in the malware forum, please don't make another post there (it's OK to post here) until your expert malware removal specialist responds to you.
Regards
paws

Good morning, Paws; Thank you for the info you sent earlier. At the moment, the computer seems some better. I deleted some things yesterday and removed 4 items from startup (probably more I could remove but wasn't sure about). But every little while and only for a second or two, the mouse cursor still jumps around, or programs will hesitate for several seconds when told to open or close (this computer has always been so fast before), or webpages won't change when told to. Also some video services don't work anymore (foxnews, fox.com, ABC); while some still do (NBC, CBS). One question: do you know if those glitches would more likely be caused by something like a missing file or by malware (or something else). My one concern is having someone take all the time to inspect a HiJack log if it's something else that I could fix myself. I know it's time-consuming and I'd be very sorry if anyone had to waste time with it if there was some other cause. I will run the file checker this afternoon and see if any files are missing. I know you folks must be busy with so many people. Your advice is invaluable and I hope everyone appreciates all of you as much as I do. Have a SPECTACULAR day, Sharon

OHMYGOODNESSWOW! After disabling some Toshiba startup items and disabling Indexing Service and AppleMobileDeviceService (don't have an Ipod or iTunes), this machine will completely boot up in less than 2 minutes! Awesome, sometimes it pays to "Google" stuff! Don't know about all the problems yet - so far, only had one little squiggle of the mouse - but it's only been a few minutes since I edited startup and services. System File Checker didn't find anything wrong. One thing I forgot to mention: a couple of days ago, I opened SpywareBlaster to check for updates, and over FOUR THOUSAND items in Internet Explorer Protection and Restricted Sites Protection had been disabled (unchecked). No one's used this machine but me, how do you think that happened? I tried rechecking them, but it was going to take hours, so I uninstalled and re-installed the program. I was puzzled by that, as I had downloaded and installed the program after the recent recovery and had checked to make SURE everything was enabled.

Hi Sharon,

Firstly, well done on getting your machine to boot up in 2 minutes. This is good for a laptop, so the actions you have taken have been effective.
The glitches you mention could arise from a number of different sources and in themselves don't indicate a specific problem. however they are abnormal and need addressing.
It looks to me as though for the time being anyway your are putting on hold your thoughts of either reformatting and of running HJT. I f this is correct then I suggest you do this:

1 Go to PcPitstop http://pcpitstop.com/
2 Run a full test ( takes about 5 minutes)
3 Consider both the report it produces and implementing its recommendations
you will be asked to register with a valid email address and accept an ActiveX (both are generally considered to be safe from that site.)
4 If you want to share the report and recommendations with us here then post back with the TechExpress link (your IP address will be obfuscated)

The report and recommendations will give you a good insight in the the programmes that are loading from startup, your hardware and software and some important features of your machine.
Regards
paws

Early this morning a Zone Alarm anti-virus scan detected a Win32.Trojan - I let it delete it. It's hard to understand how I'm getting trojans in my system several times a week with ZoneAlarm installed - I thought it was supposed to block them.

Just a short while ago, I ran the PCPitstop Full Scan. Here's the link for the test from PCPitStop - - it gave the system a 'thumbs up." http://www.pcpitstop.com/techexpress.asp?id=78STSWLRLQVSWALV

Should one just never browse the net? I was shopping for sheet music and googling for different computer related info yesterday and today there was a trojan on my system. Do you have any ideas about what caused SpywareBlaster to be reset as recorded in my last post - - could it have been a fluke or a malicious act by something?

If you think I need to post a HiJack log, I can do that. Just wanted to see what I could do before someone else had to go to all that time and trouble.

Gratefully,
Sharon

Hi Sharon, Your machine is running so many anti malware applications that there is a strong possibility that they are conflicting with one another. Sometimes more is not necessarily best… The trojans that are being reported may be false positives or real threats…….. a malware removal expert is needed to advise you on this. A golden rule is to have only one antivirus application running (active in memory) together with one 2 way software firewall. If you have more than one of each running active at the same time then you risk slow downs errors, conflicts, and other poor performance. Before you do anything else I really do feel its time for you to run an HJT log and post it in the malware removal forum. The expert who responds to you will be able to provide you with detailed advice. Post back here when your machine has been declared "clean" and we will give you some further advice on the recommendations and information provided by your PcPitstop report. Regards paws

Just got your post, Paws. I will do a HiJackThis log in the morning and send it. I'll post back here after the computer is certified as clean if it looks like I still need to reformat. You've been great! I really do appreciate your help. Thanks a million, Sharon

Hi Sharon, I understand. I will keep an eye out for your posts…the system here on WTT will automatically notify me of your posts here on this subforum. Good luck with the HJT work. Regards paws