Win XP computer is messed up bad...

eesh. these posts are long and hard to work with, so i'll just respond at the top here...

First off, I'm doing the best I can with the time I can throw at this computer; like you (i'm sure), I have obligations during the day. Today, even, I have to leave the home to work so will lose a huge opportunity to work on it. Even at that, I'm staying up late (as I'm sure you are, too!) to do what I can. I have a home schooling deadline coming up the 31st that I'm no where near ready to meet.

Secondly, I am the only computer "geek" here; no one else attempts it.

Thirdly, you state:

I don't recall this at all and am not even sure where to look. But I'll be looking while I await your reply.

Lastly, so what I understand you to say is to go ahead and run the 2 AV (excluding spybot) and see what they come up with, saving the .txt logs and giving them to you here; is that correct?

I bumbled around till almost midnight last night trying to get photos copied; i still don't understand why i'm having such an issue with highlighting a whole bunch of them, so i was having to take one screen at a time. i also thought i had way more of these photos already on my Ext HD than it appears; kids must've put their photos in an 'odd' spot! So i'm still not completed with copying photos or music (haven't even touched music).

Here I go!

>>ETA<< re: txt files; i used my ctrl + F to look for the txt text on all four pages here but did not find where you'd told me how to save those files (or whatever it is you want me to do with them; perhaps I'm not looking for the right text?

secondly, running Malware now and the updates are 7 days old, so not TOO out-of-date...

 

Just a miserable update...

For the last 4.5 hrs, malwarebytes has been scanning the computer (and I asked it to scan the ext HD, 2). it is now scanning the Ext HD. I hope to be able to come up for air soon.

the good news?

no infected objects found (so far).

ETA: hoyven gloyven... it's still scanning the Ext HD and it has found an infected object! 5 hrs and 15 minutes in to the scan...and still not done yet... and I have to go to work!

K

 

Understood, but i try & answer EVERY question/s you post, in as simple but as detailed way as possible, including spending extra time taking/making/editing etc screenshots & uploading/arranging them etc. I do this because it's what i would hope to receive in a similar situation

OK & Yes

I am the only computer "geek" here; no one else attempts it.

I see, at least there is one

RE - Photos

Instead of doing ALL that you should just be able to left click the Folder they are in, KEEP hold of it & drag it onto the Ex HD. Like this

Ask them to show you where & make a note for when you copy them over to the Ex HD.

Yes

What txt on here ? The txt files i mentioned to upload are txt Log files that Avast/MBAM/SAS etc save/store after a scan, which you should be able find within each of them by going through their Tabs etc when you launch them, then save them to your desktop & upload here as Attachments. But see below why it might not be worthwhile now.

Yes it is, but you should be getting MBAM/SAS to scan your PC's C Drive ! You can scan the Ex HD later from your Laptop with AV/MBAM/SAS etc on there, thereby saving LOTS of time on the PC right now

It seems like unless your latest scans on the PC complete, & discover anything & deal with it successfully SOON, the best option now would be to drag/copy over Everything you want as soon as you are able to, & then we can try & sort the PC out afterwards. Initially, as you said you wanted to try & repair the PC, i thought we might be able to at least try anyway.

So if nothing happens Very soon with the scans, leave those & concentrate on solely copying over to the Ex HD

I appreciate it can be frustrating for you, but you have managed to grasp quite a number of things & being able to find info etc in the PC i've asked for, so you can be proud of that

Re - your latest EDIT

That's something anyway but as i mentioned above it might be best to leave the Ex HD scans for now, etc etc.

 

Oh, golly. I appreciate all the energy you are putting in to this.

I'm just saying it DOES take so much energy to make all the quote boxes correct, as you well know, and my time is so ltd as it is and if i want to be able to get as much done as quickly as possible, i'm foregoing all the cute quote boxes (unless they are important to what i'm saying...).

re: photos... well, they're not in a file... well, i don't SEE them in a file, but just sitting by themselves somewhere

re: scanning ALL files: gulp. OK. won't scan the Ext HD next time.

SCAN RESULT: this is the name of the infected file (my 14-yo DD had to write it down for me as I had to leave for work; it took 6.5 hrs to do the complete scan):
F:\Seagate backup\toshiba-user\History\Level2\C\documents and settings\Kathy Larvik\Desktop\zwinkysetup2.3.50.24zjman000.exe (Adware.MyWebSearch)

re: txt files. You had said you'd told me how to save them (save? i think?) and I could not find your instructions unless I don't know what I'm looking for...

so, now that the malwarebytes is done scanning, go to the superanti... and scan JUST the computer - correct? (just a note: last time I used it was May 18, successfully) (current scan commenced at 621pm)

I'll assume you're nodding your head and go ahead and do that.

I really feel I looked in every folder of the Avast software looking for the file it deleted; but I'll look again.

home for the night; will be checking in to see what words of wisdom y'all have to share w/me...

ThanX

ETA: scanning for 30 minutes: found 23 threats so far... and it was cleaned May 18 (Mt St Helen's volcano day, 1980, by the way!)

#2 ETA - scanning complete in less than an hour; only the 23 threats noted above.

now what?

 

This is what I can't find (where you showed me how)...

but while i'm waiting to hear back from you, i'll read thru all the posts to see what i missed or what you want me to do now...

If i don't find where you showed me how (hmmm. meaning you've taken time to take shots and share them...should find something!), i will need to know how to get them from one computer to my laptop and ultimately you.

ETA: Asked MWB to rescan and in the process, Avast popped up with the Rootkit virus - again - and asked to delete it then reboot system. system rebooting. and now avast is scanning. :-(

[oops. forgot to add this, which is why i came back in the first place: You said: "If can look in Avasts log etc & write down the EXACT name/s of the nasties, & post them it could help" So perhaps that is what you meant: just write the log down and then tell you.]

well, avast just found this:

file C:\Documents and Settings\All users\application Data\AVAST software\avast\arpot\8ed85-554-0.dat is infected w win32:alurion-FZ

I deleted it

ETA #2: avast has been running almost 30 minutes, showing 0% complete (i made sure to disconnect the Ext HD so it wouldn't be included in the scan)

 

Where is that "somewhere" ? If you can see them, get to them, explain EXACTLY the process you go through to do that, click by click.

I'm surprised that's all it found ! It might be due to it not being updated for some time. Did it update on May 18 ? You can launch it & see the date it last did, just do NOT do a scan again, close it straight you note the date. Thankfully that MyWebSearch is no big deal, unlike the nasty found before, still not wanted though. Did you allow MBAM to delete it ? If you didn't don't bother wasting time scanning again just for that.

Your daughter did a fine job of writing it down she might make a good PC fixer

Jeepers But at least it actually ran. Sometimes malware blocks it from running, unless you rename it, but don't.

re: uploading txt files.

We'll leave them for now.

Yes

Did it/you update it ?

Yes

Not a priority, but could be useful.

Sweet talker

Unless there is anything new to report, if SAS might take hours to scan, based on MBAM's scan time, it might be best to let it do it's thing, even if that's through the night Whilst you have some nice RnR etc As soon as you know anything, post back when convenient. But just seen your edit.

Here's how i recommend you configure SAS before scanning. Take your time, & copy of ALL the checked & unchecked boxes etc, EXACTLY as i've shown for you.











MORE

 

Just seen your EDIT before i posted, & posting about it in this new reply

When you say "cleaned" of what ? Different nasties or ?

That was quick compared to MBAM ! I wonder if it did a Full Scan ? as i've just shown you how to in my post above. If it didn't, do that.

See my last post about Logs. I know i took screenshots of how to upload txt attachments, but in the midst of doing everything else, i think due to you not finding any Logs, i skipped posting how to.

You could copy them over to the Laptop & then upload them. But let's first see if you can locate any. If you can then i'll consider doing it, but AFTER the SAS scan.

You mean MBAM ? Why are you scanning again with it ?

That was because you had difficulty in gettig your head around using the upload function on here. So it was a way of me getting to see the Log/s without you uploading it/them.

It's the same one as before !

Good But it's "possible" it might keep doing that, if it can't delete everything, due to Avast not having the latest malware updates for that nasty.

Cancel it for now & do the FULL SAS scan as shown, & post back with the result.

 

well, with all this scanning stopping, starting, finding, blah, blah, the photos are far from my mind. just when i was about to 'back up' on the photos to see if they were IN a folder, something else happened (oh, avast found that rootkit) and i abandoned further searching...

malwarbytes - i last used it may 18; i forgot to check the update date before i set SAS scanning, but I usually update (if possible) before I use a scanner...

yes, 14 yo deleted it for us.

I have SAS running now (per your specs), but Avast is running in the background and it found the rootkit again, asked to delete it then wanted to reboot. i told it no.

 

I ran SAS on May 18. BTW, when you gave me the specs, i found SAS log and many years worth of log is on it; should I clean that out ever?

i'm so weary, I have no idea what I mean, lol. the malwarebytes.

to see if the PC was clean?

 

per your settings, SAS has finished scanning and found no threats.

it's 912pm my time and i'm running out of go juice.

I don't know what to do next.

try to move photos, music?

FIND the photo file?

I'll find something to do...

 

now that i'm moving photos, i noted a file name at the end of the photo's properties. and i remembered you wanted me to find the folder where the photos are and move them.

i found the photos by searching for photos, so it brought up each individual photo; i thought that was an easier way to search than digging thru every folder.

would you correct me if i'm wrong, please?

i'll keep working on this for the next half hour then i have to go to bed.

 

Re - MBAM scanning again

But you already said, MBAM said it was ?

Earlier you said SAS found 23 threats so far, now you say, finished scanning and found no threats. So was it SAS or MBAM that found those 23 ? If it was MBAM, launch it & go to the Log Tab & open the LAST one & save it to your desktop. Open the one from just before & do the same.

Re - SAS log

Launch SAS & go to the Stats/Log tab & click View Log, save it to your desktop.

When you get chance, copy those MBAM/SAS Logs from the PC over to the Ex HD, then connect it the Ex HD to the laptop & move the Logs to the LT desktop. You can then reconnect the Ex HD to the PC & carry on moving things from the PC to it. Let me know when you have moved the Logs.

Don't do Anymore scans until advised, & cancel Any that start, eg Avast.

Re - photos/music

Did you ask the Others to SHOW/TELL you where their photos are ? They should know ! & once you know, you will know were to find them. They should be in Folders, make a note of where these Folders locations ALL are, & the Names of ALL the Folders. Then you can copy/move them.

Plus when you do a search for Photos, you will see where/which/ Folders they are in, make a note of ALL those folders. Some will be in the same locations/folders as what the Others have told you, & you've now made a note of. So you do NOT need to copy/move them twice. Just cross off on your note/list which ones you've successfully moved & then move on to the next Folder to copy/move in turn, until you've moved each one.

Do the same with music.

 

Extra

Just thought, whilst you have the Ex HD connected to the laptop, download MBRcheck & TDSkiller i linked to earlier, & save to the laptop desktop. Then copy/move them both to the Ex HD.

When you reconnect the Ex HD to the PC, copy/move both those files from the Ex HD to the PC's desktop. Let me know when have, but do NOT run them yet.

 

ignorance? thinking "more is better"?

SAS found the 23 threats

roger all the above and your instructions to move, copy, download (but not run) all the other stuff.

our school day is just starting, so i'll get to these tasks as I can this morning.

photos put in files by kids who aren't here any more. but you are right and i thought about it too late last night is that i just need to look for jpeg or jpg photos as i was getting bmp gif etc. don't care bout all them. so even if i do my search like i did, but refine it as i've stated here, i'll get closer to FOLDERS so i can just move those instead of globs of photos.

be back as i can. thanks again (it is 804am PST)

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/26/2011 at 07:14 PM

Application Version : 4.52.1000

Core Rules Database Version : 7086
Trace Rules Database Version: 4898

Scan type : Complete Scan
Total Scan Time : 00:53:10

Memory items scanned : 434
Memory threats detected : 0
Registry items scanned : 6510
Registry threats detected : 0
File items scanned : 28654
File threats detected : 23

Adware.Tracking Cookie
.stopzilla.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.stopzilla.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.stopzilla.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.stopzilla.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
www.stopzilla.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
sdesapio-conversiontracker.appspot.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\kathy\Application Data\Mozilla\Firefox\Profiles\cyupnepn.default\cookies.sqlite ]

 

the former was SuperAntiSpyware.

The following is Malware.yadda.yadda

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6612

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/26/2011 2:00:56 PM
mbam-log-2011-05-26 (14-00-56).txt

Scan type: Full scan (C:\|D:\|F:\|)
Objects scanned: 382610
Time elapsed: 6 hour(s), 18 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
f:\seagate backup\toshiba-user\History\Level2\C\documents and settings\kathy xxxxxxxxxx\Desktop\zwinkysetup2.3.50.24.zjman000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.

 

these pgms are now on my Ext HD awaiting your next command:


MBRCheck -http://ad13.geekstogo.com/MBRCheck.exe

TDSS Killer -http://support.kaspersky.com/downloads/utils/tdsskiller.exe

 

Re - Logs

Well you managed to post them obviously by copy/pasting, rather than using the Attatch button to upload them as txt files. But at least i can see them so

Re - SAS Log

You forgot to Exclude cookies fom being scanned by Unchecking that box, as i showed in my SAS screenies ! Never mind you'll know next time The good news is cookies can't bite = No worries.

Re - MBAM Log

Good it got rid of zwinkysetup2.3.50.24.zjman000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully but as i said earlier, that was not a Big nasty.

*

Good Also i'm thinking whilst we're at it, it would be a good idea to use another similar App too.

aswMBR is the rootkit scanner that scans for TDL4/3 http://public.avast.com/~gmerek/aswMBR.htm

There are a few other things i'd like you to DL to the Laptop & transfer over to the PC, before we get started as well.

So DL the above 3 more things, transfer those to the Ex HD & then transfer ALL 5 to the PC's desktop. Let me know when they are on the PC, but do NOT run any yet. No rush, just go the pace you can

*

Re - searching for Photos etc.

Very good refining will certainly help. I must add though, you "may" discover that the things you actually want to copy that you find, "might" be in Folders that contain other files. Some or possibly a Lot, could be OS etc files, depending which Folders the Photos etc have been placed in. The LAST thing you want is to copy over to the Ex HD Any/All those files as well.

It won't do any harm, but could take a LONG time & when you transfer the copied Folders onto the Laptop = same again. Also you would have to sort through all the Folders spending more time Only selecting/copying the wanted things, NOT the OS etc files. Plus, you ONLY want/need the Photos/Music anyway. So taking the time now to ONLY copy what you want, will save you Lots of time both now & later on.

I would suggest, creating 2 NEW Folders on the PC & name them Photos from PC & Music from PC then drag/drop/copy Everything you want into those. When you've found Everything & done that, you can then copy just those 2 New Folders onto the Ex HD & then connect it to the Laptop & transfer them to there.

But let's do the other things first.

Phew, i need a coffee ..........

 

I am DLing them directly to the Ex HD; is that OK or should I DL it to the LT THEN to the Ext HD THEN to the PC?

and you so deserve it. thanks so much.

 

O

Yes sure it is I wasn't thinking you could do that, so Will save time too

I've had a few nore since then

If we can get busy tonight, so much the better, for me anyway.

 

It's FRIDAY!

Let's rock it...

I stopped the DLing, so I'll commence that.

have been trying to transfer the music; you know how you click a line so you can (a) see a photo or (b) hear a song to see if you still need to keep it?

tried that w/this music i'm finding (most is kids')...forgot the speakers on the PC don't work.

so just copying it all over; deleted massive photos once i got them on the ext hd. the PC is just loaded. has 1gb of free space on the C drive (if you couldn't tell, it's partitioned; i didnt do it so dont say a word, lol!)

ok. onward. its 5pm here. we've got at least 5 hrs.

 

Not here it isn't I'm in the future

& Roll !

Along with the CD Drive & a "few" other things

Good idea

No way to tell from here !

Nothing wrong with having partitions, i have. Obviously you need to check in there too, as well as the C partition, for Photos/Music, but i guess you are/have ?

I'll be dipping in & out, so when you're ready, holla.

 

ug. i'd just started a copy of music and the copying box says it has 45 more minutes to go.

that would mean 45 minutes that we have to wait before we can go on to the next step.

just say the word and i'll stop it now.

(cuz of course it's using the Ext HD...)

 

Re - ug etc

Let it do it, but NO more for now. I'll enjoy the break

See you a bit later, post back when it's done.

 

first speed bump:

aswMBR version 0.9.5.256

when i opened it on the PC (from the Ext HD), i was given the opportunity to "run" it.

a DOS window opened with options to scan, fixMBR, fix, save log, exit...