Spyware Warrior

anniam · Last edited by anniam on Sun Sep 19, 2004 6:23 pm; edited 2 times in total

Hi,
Was sent here by TeMerc. I had some problem with spyware which was removed and after running an HJT log, I was pronounced "clean" by TeMerc. The problem is that even though the spyware is out, my computer is still doing funny things. Here are a few examples: Some preinstalled programs on my computer don't work. For instance, I can click on Control Panel and all is fine, but if I click on Help & Support I get nothing. Actually, it sounds as if it's trying to open, but it doesn't. When I open my email, I don't see any mail. It's there, it just doesn't show up anymore unless I click on Inbox. Didn't have to do that before. If I click on Search, I get the search box but it is empty.
As far as the internet goes, I can't go to many places. It's a miracle that I can get here. The "page cannot be displayed" has now become a common feature on my computer. That's what happens when I try places like eBay or Google. With Ask.com, I can get to the homepage, and that's it. If I try a search I am told that the page cannot be displayed. When I go to my work webpage I can get to the homepage, and then I can click to my heart's content and nothing happens.
I hope this gives you a rough idea of what I am experiencing. I did fear that perhaps I lost some things when I tried HJT and TeRec says he will try to explore this further. But I also know that some if not all of these problems existed before I got help with spyware. Actually it's what tipped me off that I had a real problem and that Ad-Aware alone wasn't going to cut it. The only thing that has come back in full swing was my hijacked internet homepage, and I am not getting foreign things just dropped off into my favorites.
Hope you can give me some hope that this can be fixed. I did email my internet provider, since some problems seem to be with the internet and I am awaiting their response.
Thanks for your help.

3162 · Posted: Tue Sep 14, 2004 6:48 pm Post subject:

Holy cow, how did I miss this one!
I am so sorry, will be back in a few
_________________
Proud member of the Chest Zipper Club!

3162 · Posted: Tue Sep 14, 2004 7:37 pm Post subject:

This note is for my reference, no need to click on it - it is your original thread.
*note*origthread

Do you have an original XP disk with the KeyCode?
Or is this a generic box with a Partitioned HardDrive? (Many machines have a quasi-hidden D-drive, which

contains the basic OS)

Here's your first option:
If you have the Disk,
Click [Start] [Run] and type sfc /scannow in the [Open] box.
(Note that there is a space between sfc and /scannow)
You will probably be prompted to insert your XP Disk.
If you have a partitioned Drive with a complete OS in it, change the C to D (should be D.....)

This will start the System File Checker and allow you to repair.
It is an extremely slow procedure, and you may have to choose certain options regarding missing files.

Here's the second:
Click Start then Run then type in regedit
Navigate by clicking the + on each of these, in the left pane:
HKEY_LOCAL_MACHINE
SOFTWARE
Microsoft
Active Setup
Installed Components
{89820200-ECBD-11cf-8B85-00AA005B4383}

In the right pane, R-click and Modify or Create the Value Data Type(s) and Value Name(s) as detailed below.
For Data Type: DWORD // Value Name: IsInstalled
For Setting for Value Data: (Change the Value from 1 to 0)
Exit Registry

When you have made the registry change, download Internet Explorer 6 from my link below. The Internet

Explorer 6 download includes Outlook Express 6. Reboot and check to se if everything works.

IE6

If neither of those work, you will probably have to do a complete Restore of XP from a licenced copy of XP.
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Wed Sep 15, 2004 1:39 pm Post subject:

Hi,
Thanks so much for trying to help. Let me tell you what happened. I chose option 2. Your directions were great and all went well until the right pane info. There is nothing in my right pane. You mentioned modifying what was there, so I can't do that. You also said that my other option was to create the Value Data types, etc. How do I do that? I am not very computer savy and it's probably a simple process, but I don't know how.

Should there be a solution to all this and I can go through the process that you mentioned I just want to double check one thing. After going through the process that you delineated, I just exit the registry? I reboot only once after downloading Explorer 6? (I am trying to stay positive here and believe that this will finally work. It's been a long haul!)

3162 · Posted: Wed Sep 15, 2004 2:08 pm Post subject:

There could be two entries for 89820200-ECBD-11cf-8B85-00AA005B4383

Try the second one, it should have a + against it (left pane)
Highlight it, and you should see IsInstalled in the right pane. Then you can change the value to show (0) at the end of the series of numbers.

If you don't see it, then do this:

R-click over the white area and you will see New. Mouse over it and
select DWord Value
Rename the New Value to IsInstalled
Change the Data string to show (0) at the end of the series of numbers.

Exit registry.

Then go get IE6 from my link.

If you only have one 89820200-ECBD-11cf-8B85-00AA005B4383 tehn follow the above and create the DWord value in that one (right pane)

Yes, reboot once should do the trick.
Let me know
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Wed Sep 15, 2004 5:17 pm Post subject:

OK was able to follow your first suggestion of highlighting and changing the 1 to a 0. However, when I went to download from the link provided, nothing happened. I just got a blank page. That's a problem that I have been having since before the spyware was removed. I can't get anywhere from links that have been provided me by those who tried to help me to remove spyware. I think I was sent a Zipfile once containing HiJack this. It was the only way I could get it to work. We always had to try round about ways to get me to certain links or sites. Don't know if this is possible here.

3162 · Posted: Wed Sep 15, 2004 5:31 pm Post subject:

OK, what happens if you hit ctrl/n (at the same time)?

Does it open a new instance of IE?
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Wed Sep 15, 2004 6:59 pm Post subject:

Holding ctrl/n keeps reopening the same page that I am on.

3162 · Posted: Wed Sep 15, 2004 7:07 pm Post subject:

OK, that is actually a good thing.

Here are some commands to use:
What we are trying to do is recognise the links, if that makes any sense. Pay attention to where the spaces are.

Click Start, then Run and type in regsvr32 urlmon.dll then click OK
Do the same for these:
Start-->Run-->regsvr32 Shdocvw.dll
Start-->Run-->regsvr32 Msjava.dll
Start-->Run-->regsvr32 Actxprxy.dll
Start-->Run-->regsvr32 Oleaut32.dll
Start-->Run-->regsvr32 Mshtml.dll
Start-->Run-->regsvr32 Browseui.dll
Start-->Run-->regsvr32 Shell32.dll <<System may balk at this one. That's OK.

See if that helps
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Thu Sep 16, 2004 11:31 am Post subject:

Did what you said, and I was told that I "succeeded" each time I clicked OK. Oh my God, I think it actually worked. I tried to go two sites that I couldn't go to before and I actually got there. I didn't want to do too much until I had your ok. Do I still have to download from your link or not? When I first turned on my computer this afternoon (before I went through the last process that you suggested) I got a message that "Internet Explorer 6 has been removed from this program. Do you want to clean up your personalized settings..." I clicked no since I didn't want to get rid of anything that I shouldn't get rid of.

3162 · Posted: Thu Sep 16, 2004 1:11 pm Post subject:

Yes, go ahead and click my link. It should overwrite IE6 and replace missing files.

Let me know
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Thu Sep 16, 2004 5:44 pm Post subject:

Was able to go to your link and download. To be honest the process was supposed to take an hour and I walked away while it was happening. By the time I returned it was done and my computer rebooted. Here's a stupid question...how do I know if it downloaded successfully?
I can use the internet now. I tried all the sites that I couldn't get to before and now I can. Thank you, thank you, thank you!!!!! You are a life saver.
The different things that were not working on my computer still don't work, however. I am almost certain I may have lost some of these during a HJT log.

3162 · Posted: Thu Sep 16, 2004 5:56 pm Post subject:

Glad to help.

Now, what is still not working?
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Thu Sep 16, 2004 6:21 pm Post subject:

Little stuff really. Things that I mentioned in my first post. If I click on Help and Support I get nothing. Basically I get a sound that seems like it wants to open, but it doesn't. If I click Search, I get an empty page. When I check my email, I have to click on Inbox before I see it. That's an extra step that wasn't there before. I'm not sure what else at this moment. If I have to I can live with it as far as I'm concerned.

3162 · Posted: Thu Sep 16, 2004 6:43 pm Post subject:

anniam · Posted: Sat Sep 18, 2004 6:26 pm Post subject:

Let me answer your questions in order:
I am not trying to access help for anything in particular at the moment. It's just that I noticed before that it would not open and it still doesn't.

The Search I am talking about is Windows Search.

My default email is Web based.

Now, at the risk of you becoming my own personal guru, can I throw two more situations into the ring ???
1)I had Norton virus scan professional installed in my computer before all this hell broke loose. At some point in the game I was instructed to remove it so that we could possibly have better success at trying to fix my computer. I was instructed to reinstall it later. I tried yesterday and in the middle of everything I got a message that said "Internet Explorer Script Error" Then under this it said, "An error has occurred with the script on this page." And it asked if I wanted to continue. It didn't matter if I clicked yes or no, it wouldn't do a thing. What's this all about?

2) After one of the "clean up" procedures I noticed that I couldn't get my printer to work. I was instructed to reinstall the program. I did and it worked. Yesterday I tried printing and you guessed it, nothing. I checked the Add or Remove programs section and it is still there. Do I just try to reinstall it again???

Thanks and please don't lose patience with me.

3162 · Posted: Sat Sep 18, 2004 6:44 pm Post subject:

I'm not likely to lose patience, just trying to get all of the facts straight here.

If you look at

anniam · Posted: Sun Sep 19, 2004 2:51 pm Post subject:

I know why you are asking the questions. That's not a problem at all. It's just that every time I turn around it seems like something else pops up. I worry about frustration setting in...with you, not me.

Anyway to answer your latest:
When I click Start and then click on Help and Support it sounds as if something is about to open, but nothing happens, not even a blank page.

As far as SP2 Critical Update, I clicked on the link you provided and I only got a blank page. I tried typing it in myself with the same results. Noticed that once today when I went on the net to search for something. At one point I got a blank page.

Could my IE6 repair not worked in some way?

3162 · Posted: Sun Sep 19, 2004 2:59 pm Post subject:

The board is experiencing a problem, I will answer you as soon as possible.
We will repair the problem as soon as possible, thanks for your patience.

If I have not replied to your question, please post again tomorrow.
Sorry for the inconvenience.
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Tue Sep 21, 2004 6:47 pm Post subject:

Haven't heard from you so I am posting again as per your directions.

3162 · Posted: Wed Sep 22, 2004 9:50 am Post subject:

Hi there, even after the board go tfixed, I have had ISP issues which should now be sorted out. Sorry for the delay, I'll be back with you shortly on this
_________________
Proud member of the Chest Zipper Club!

3162 · Posted: Wed Sep 22, 2004 4:40 pm Post subject:

OK, instead of using my link to get the updates, try Start>AllPrograms>Windows Updates
and if that doesn't work, try this link which should redirect to the correct page.
http://windowsupdate.microsoft.com/

If you still can't access the updates page, do this:
Click Start, and then click Run.
In the Open box, type sfc /scannow, and then click OK.
You will probably be prompted for the XP installation disk.

After the System File Checker is done, see if the problem is resolved.

Then let me know.
Thanks
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Mon Sep 27, 2004 2:31 pm Post subject:

Hi,
Sorry about the silence. Was away for a few days.

The only thing I could do of the items you suggested was the last. I ran the scannow. I was not prompted for the installation disk if that means anything.

I still have the same problems as before. (Actually, each time I go online, I discover other odd little things. A for instance would be when I tried ordering a few items from a company that I have done business with in the past, and I couldn't get their site to come up properly in order to place the order. So I had to place the order at work. I just tried their site again and it still doesn't come up properly on my computer.)

3162 · Posted: Mon Sep 27, 2004 4:06 pm Post subject:

OK, that sounds like a SSL problem.

Please check these links out, and see if anything there resolves your problem
http://support.microsoft.com/default.aspx?scid=kb;en-us;246725
http://support.microsoft.com/default.aspx?scid=kb;en-us;260096
http://support.microsoft.com/default.aspx?scid=kb;EN-US;259537

Thanks
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Mon Sep 27, 2004 4:16 pm Post subject:

I looked at the links that you provided but before I try anything, let me just ask a few things. Am I to try the one that sounds closest to my problem or am I to try all of them. Also, the "symptoms" they describe aren't exactly what I am experiencing. Is that o.k.? I don't get the message that the page can't be displayed as a symptom, I just get a blank page or no activity at all.

3162 · Posted: Mon Sep 27, 2004 4:20 pm Post subject:

I would try all of those options.

anniam · Posted: Mon Sep 27, 2004 6:31 pm Post subject:

I tried the link that ends in 246725 and found that what they told me to clear already was cleared. So I did all that I could do there.
As far as the other two....I'm not sure how to do what they ask. But further, the info at the bottom of the page does not indicate that the info applies to Windows XP.
Your final suggestion about security apps blocking page. I had tried adding the windowsupdate URL to the Trusted Zone. Obviously this didn't do a thing.

3162 · Posted: Tue Sep 28, 2004 4:20 pm Post subject:

OK, let's have another hijackthis log please.
Perhaps I can spot which of your security apps is blocking the pages from loading

Thanks
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Wed Sep 29, 2004 5:35 pm Post subject:

Here's another hijackthis log.

Logfile of HijackThis v1.98.2
Scan saved at 9:21:58 PM, on 9/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Owner\My Documents\New Folder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.usadatanet.net/
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\uvbr1f2i.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ChatSpace Java Client 2.1.0.95 - http://soapcity.chatspace.com/Java/cs4ms095.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

anniam · Posted: Wed Oct 06, 2004 6:32 pm Post subject:

Haven't heard anything in a few days, so I thought I'd pop this back up to the top.

3162 · Posted: Wed Oct 06, 2004 6:45 pm Post subject:

Hi there, sorry I missed you before.

OK, take a look around here
http://www.microsoft.com/downloads/details.aspx?FamilyID=049c9dbe-3b8e-4f30-8245-9e368d3cdb5a&displaylang=en

Particular attention to
http://v4.windowsupdate.microsoft.com/en/thanks.asp

This has to be a minor glitch in the OS..we've tried most everything else.

And uninstall WeatherBug please. It's a known source of irritations.
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Fri Oct 08, 2004 2:24 pm Post subject:

Hi,
Got to the first link no problem. But, what exactly am I supposed to be looking for? It seems to be a site for downloading windows for multiple computers.
As far as the second link goes, I get nowhere with that one. Just a welcoming page.

Just a note...I am noticing the same problems over and over as I use the internet more. I've narrowed the biggest problem to what I call a security issue. There are some sites that once I try to get to a higher security area, I am simply stopped. I can't get to the last and final step. Doesn't happen with all (like eBay for instance), but with many others. And a wierd one is that I can't print anything from the internet.

anniam · Posted: Thu Oct 21, 2004 6:35 pm Post subject:

Hi,
Just checking in one more time. If we've gone as far as we can with this, then I just want to say thanks. Doesn't seem like much to say, but I am greatful. I've gotten back more usage of my comptuer than I thought I would. If you have one last suggestion, or another place I can go to try to get the missing pieces back, I would appreciate the info. Sorry that I've taken so much time.

3162 · Posted: Fri Oct 22, 2004 12:14 pm Post subject:

Hi there, sorry I haven't gotten back to you in a while.
I'll go through everything again this evening and see if I can come up with any new suggestions

Thanks for your patience
_________________
Proud member of the Chest Zipper Club!

anniam · Posted: Sun Oct 24, 2004 7:16 pm Post subject:

OK thanks.
As I may have mentioned, I still have some places that appear as blank pages when I try to open them. I still can only print things that I type up, but I can't seem to print anything from the internet. And I still can't get all the way through to some internet sites. I don't know if there is a common link to all this. I wonder if I can somehow download programs from Windows that were originally installed in my computer?

wawadave · Posted: Sun Oct 24, 2004 9:16 pm Post subject:

hello
you might give this a try.
goto start,run,type
sfc /scannow click ok incert xp cd when asked.
be warned recovery cd,s will not work for this!
sfc /scannow how to: http://www.updatexp.com/scannow-sfc.html
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

anniam · Posted: Thu Oct 28, 2004 3:07 pm Post subject:

HI wawadave,
Thanks for your suggestion. Here's the problem. I don't have an xp cd. The only cd that came with my computer was Microsoft works. I checked with a friend who bought the same computer I have only a few weeks earlier and he doesn't have a cd either.
Can I get one? I emailed Microsoft the same question twice...no answer yet.

wawadave · Posted: Fri Oct 29, 2004 9:43 am Post subject:

hello
you could just try running it with out the cd,s. if the i386 files are on the hd it does not ask for cd. if it does hit cancel. you can allso try borrowing one for your version of xp.
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd