A lot of problems...

Craig18Craig18 New
edited June 2007 in Spyware & Virus Removal
Hello.

I'm awful with computers and seem to have encountered a lot of problems. Much of them are my own fault. I was recently given a lap-top by a family member (As he now has a new one) and am having problems. I'm sure that I'm posting this in the wrong section, but seeing as I don't really understand the problems, I feel that I'll post it here. Apologies if it doesn't belong here.

1: I installed Mozilla Firefox and then un-installed it later. I kept un-installing and re-installing Google toolbar, Yahoo toolbar and Mozilla, as I couldn't make my mind up of which one to keep. Could this have caused any problems? I have SpywareBlaster and Mozilla is still enabled. I uninstalled the program, so why is it saying that it is still enabled? Is it completely removed or has it become my default browser?

2: When I downloaded Google Updater for the toolbar, a message appeared on my Comodo Firewall that Google Toolbar/Updater is using belkin for something that could send personal information to keyloggers. What's the problem here?

3: A blue screen appeared when I was on the net and it was froze. It said that a problem has been detected and windows has been shut down to prevent damage to the computer. PFN_LIST_CORRUPT

4: MSN Messenger keeps flashing and stating that it's signing in. Why is this happening when I don't click on it? I don't want messenger and have tried to get rid of it but it isn't even in my list of Add/Remove programs. If I try removing the folder from my program files, it says that it could stop other programs working properly, so I chose not to.

5: When I switched back on, Microsoft said that the system had recovered from a serious error. Should I report the signature/files information here?

6: Spybot S&D Resident said that it had detected an important registry entry.
Category: System startup. Global entry.
Change: Value deleted.
Entry: Kernel Fault Check.
Old data: %systemroot%\system32\dumprep0-k

7: On the keypad, if I need to use @, it's located where " should be and vice versa. Why aren't the buttons located in the correct place?

I'm awful with computers and seem to have a lot of problems. Much of them are my own fault. I'm seriously considering going on a course.

I know that I've probably posted this in the wrong section and I apologise. Could you tell me where it would be more appropriate?

Any help is greatly appreciated and I am again sorry to bother you, but a lot of you seem extremely capable on here with computers and the world of the internet.

Comments

  • TroganTrogan London, UK
    edited June 2007
    Hi Craig, and welcome to Icrontic! Sorry for the delay.

    Some of your problems have logical explanations that I should be able to answer. We may need help from others for certain questions/problems.

    But first, lets check if the computer is clean since you posted in the Spyware forum.

    Click here to download HJTsetup.exe. Save it to your Desktop!
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
    • Copy and paste the log here
    DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.

    Onto your problems:
    1: I installed Mozilla Firefox and then un-installed it later. I kept un-installing and re-installing Google toolbar, Yahoo toolbar and Mozilla, as I couldn't make my mind up of which one to keep. Could this have caused any problems? I have SpywareBlaster and Mozilla is still enabled. I uninstalled the program, so why is it saying that it is still enabled? Is it completely removed or has it become my default browser?
    What do you mean Mozilla is still enabled? Do you mean installed? If you uninstalled it, it should be completely removed.
    2: When I downloaded Google Updater for the toolbar, a message appeared on my Comodo Firewall that Google Toolbar/Updater is using belkin for something that could send personal information to keyloggers. What's the problem here?
    Do you remember the exact message? Would help if we knew exactly what Comodo said.
    4: MSN Messenger keeps flashing and stating that it's signing in. Why is this happening when I don't click on it? I don't want messenger and have tried to get rid of it but it isn't even in my list of Add/Remove programs. If I try removing the folder from my program files, it says that it could stop other programs working properly, so I chose not to.
    MSN Messenger is trying to sign in as the option to automatically log in is selected. If you want to uninstall it, look for the entry Windows Live Messenger in Add/Remove programs.
    6: Spybot S&D Resident said that it had detected an important registry entry.
    Category: System startup. Global entry.
    Change: Value deleted.
    Entry: Kernel Fault Check.
    Old data: %systemroot%\system32\dumprep0-k
    Don't worry about this too much.
    7: On the keypad, if I need to use @, it's located where " should be and vice versa. Why aren't the buttons located in the correct place?
    Normally a reboot (restart of the computer) should reset the Keyboard settings. If that doesn't work, let me know. There is somewhere in Control Panel, where you can change the settings.
  • Craig18Craig18 New
    edited June 2007
    Here's the logfile

    Logfile of HijackThis v1.99.1
    Scan saved at 2:22:33 PM, on 6/24/2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wpabaln.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  • TroganTrogan London, UK
    edited June 2007
    Hi Craig,

    Log is clean. Please do an online scan with Panda ActiveScan

    - Once you are on the Panda site, click the Scan your PC button
    - A new window will open...click the Check Now button
    - Enter your Country
    - Enter your State/Province
    - Enter your e-mail address and click send
    - Select either Home User or Company
    - Click the big Scan Now button
    - If it wants to install an ActiveX component allow it
    - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    - When download is complete, click on Local Disks to start the scan
    - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

    Post the contents of the Panda scan report, along with a new HijackThis Log
  • Craig18Craig18 New
    edited June 2007
    The computer freezed on the first scan. This often happens, where the mouse seems to freeze. It isn't the quickest computer.

    Anyway, here's the report from the Panda scan (Copy and pasted from Notepad)
    Incident Status Location
    Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\Paul\Cookies\paul@anm.co[1].txt
    Here's the Hijack this logfile

    Logfile of HijackThis v1.99.1
    Scan saved at 4:42:07 PM, on 6/24/2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wpabaln.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  • Craig18Craig18 New
    edited June 2007
    1: I did uninstall Mozilla Firefox. However, the protection is still available and currently enabled on my SpywareBlaster.

    2: I'm sorry but I can't remember the exact message. However, I clicked on the deny button, so I assume if there was anything malicious attempting to take over, the firewall should have blocked it.

    4: Here's the list of my currently installed programs...
    Adobe Flash Player 9 ActiveX
    AVG 7.5
    Belkin Wireless USB Utility
    CCleaner (remove only)
    COMODO Firewall Pro
    Google Toolbar for Internet Explorer
    Hijackthis 1.99.1
    Hijackthis 1.99.1
    Microsoft.NET Framework (English) v1.0.3705
    Panda ActiveScan
    Spybot - Search and Destroy 1.4
    Spyware Blaster v.3.5.1


    7: I restarted the computer. However, nothing has changed.

    Again, thanks for your help. Sorry to bother you with all this.
  • TroganTrogan London, UK
    edited June 2007
    Hi Craig,

    The computer looks clean.

    The computer still has Service Pack 1 and it is important get Service Pack 2. Go to Start > All Programs > Windows Update and download Service Pack 2.
    1: I did uninstall Mozilla Firefox. However, the protection is still available and currently enabled on my SpywareBlaster.
    Don't worry about that as it won't do anything. I suggest using Firefox as it is an excellent browser.
    2: I'm sorry but I can't remember the exact message. However, I clicked on the deny button, so I assume if there was anything malicious attempting to take over, the firewall should have blocked it.
    OK!
    4: Here's the list of my currently installed programs...
    Adobe Flash Player 9 ActiveX
    AVG 7.5
    Belkin Wireless USB Utility
    CCleaner (remove only)
    COMODO Firewall Pro
    Google Toolbar for Internet Explorer
    Hijackthis 1.99.1
    Hijackthis 1.99.1
    Microsoft.NET Framework (English) v1.0.3705
    Panda ActiveScan
    Spybot - Search and Destroy 1.4
    Spyware Blaster v.3.5.1
    It looks like you don't have MSN Messenger, or you have uninstalled it. Maybe what is running is Windows Messenger. Read the following link to prevent it from running.
    Link: http://support.microsoft.com/kb/302089
    7: I restarted the computer. However, nothing has changed.
    Go to Start > Control Panel > open: Regional and Langauge Options. Check the settings are correct and then restart the computer. If you need help with this, let me know.

    Let me know how things go.
  • Craig18Craig18 New
    edited June 2007
    1: There was a key icon on my desktop stating that I needed to activate my copy of Windows. I did so and everything went OK. Is this because I've been given the computer from somebody else? Also, the name Paul is the previous owner of this laptop. Do I need to change the name to my name or is this not important? By the way, I've heard good things about Mozilla. I may use that.

    4: When I went on the website, I installed updates that it said I needed. These programs have been added...
    Update for Windows XP (KB898461)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Installer 3.1 (KB893803)
    Windows XP Hotfix -KB842773

    7: I did that. Most of the settings seemed to be set to the United States. I changed them to the United Kingdom. However, the @ and " are now where they should be located.
  • TroganTrogan London, UK
    edited June 2007
    The name shouldn't matter. OK, when you went into Windows Update, did you click on Express Install? If so, it should provide a list of critical updates including Service Pack 2 - was that the case? Try again, if you need to.

    Glad the Keyboard is back to normal.
  • Craig18Craig18 New
    edited June 2007
    Should I keep HijackThis and the Panda ActiveScan installed? If so, how often should I run them? As often as Spybot S&D, AVG, etc?
  • TroganTrogan London, UK
    edited June 2007
    Keep HijackThis, but do not use it. It can be a very powerful, and misusing it can be bad. If you need help with a spyware problem, then post a log from HijackThis.

    Panda is not a program, as such. But for extra assurance, you can run a scan every now and then to make sure that your other programs have not missed anything.
  • Craig18Craig18 New
    edited June 2007
    I used express install and installed the 65 (WOW!) updates.
  • TroganTrogan London, UK
    edited June 2007
    Did that include Service Pack 2? It is important that you get SP2 as a lot of bugs and security patches are included in this.

    Without these updates, you can easily be infected by malware.
  • Craig18Craig18 New
    edited June 2007
    I began to install it. After about 2 hours, the download was running extremely slowly, so I decided to switch the computer off (Thinking of doing it another time). To my surprise, the Service Pack was installed when I switched on. New features like the security center are now in operation and appear.

    I'd assume everything is OK now?
  • TroganTrogan London, UK
    edited June 2007
    Everything security wise is OK.

    How is the computer running?
  • Craig18Craig18 New
    edited June 2007
    Everything was going OK for the most of the time. However, despite my belkin connection signal being excellent, I just kept getting "The page cannot be displayed" page every time I attempted to connect to the Internet. I couldn't understand the problem. I uninstalled Comodo and everything was working fine again. Was the Firewall blocking my internet connection or something, due to the recent changes made?

    Should I re-install it or go for another free firewall? Comodo is apparently the best and I haven't had any problems before this.

    Thanks for your help on everything. You've cleared a lot of things up. Cheers,
  • TroganTrogan London, UK
    edited June 2007
    Comodo is a good Firewall; I use it too. Try a reinstall first and see how it goes.
  • Craig18Craig18 New
    edited June 2007
    Thanks for your help.

    Everything seems to be working fine now.
  • TroganTrogan London, UK
    edited June 2007
    You're welcome! :)

    I'll mark this resolved. Start a new thread, if you need help again.

    Hope you stick around the forums!
This discussion has been closed.