Please help! I've tried EVERYTHING!

[PoisonIvy]

Hey there,

I really don't know where to start. I have been having so many problems with my laptop, again. Whenever I fix a problem, I get more and more. I have posted on a few message boards for help, but for everything I am reccomended to do, it wont work! I'll try to keep this as short as I can:

I have AVG, last week it said Im clean, then I'd get a popup telling me I have briss trojan,and others & to run AVG, SO, I do. It either can't find it or can't delete it! Ran again yesterday,moved it to virusvault- said it could not. SO, I try other scans- pandascan,when I click it,nothing happens! (I noticed this happened after I changed my activex settings as suggested,could that be why?). Trendmicro- SO confusing- I read the information but i cant figure out which version/update I last used, when it ask to check item for updates- none of them appear to be the free scan! 3rd try. I downloaded A2 AV last night,saved it as a2, open then it says :" Setup files are corrupted. Please obtain a new copy of the program" ! What the? The icon is on my screen,but I cant use it now! NOTHING is working! NOW, it wont let me run windows updates!! This is driving me crazy! I placed all the windows addresses in my trusted zone, read everything- switched my settings to allow activex- I STILL CANT update! I just cant figure out what is going on. I need to rid these viruses & can't. I dont know if I am allowed to post links here, but if so, I can link the message board where it explains it all. I have talked to just about everyone,& read everything. I'm all out of answers & would appreciate any help. Thanks so much,

~Ivy

ps I have heard alot about mozilla,firefox. Would this make much of a difference? Is it complicate to setup/use? And would I be able to transfer my bookmarks? Ahhh, sorry for the 20 questions. My head is spinning. thanks again,

[Boris]

Firstly a2 is not an anti-virus package, its a trojan scanner.

How many anti-virus packages have you got installed on your laptop ? If you have more than one active it can cause conflicts.

What O/S are you running (your profile says "other")

[bvw]

Follow the instructions here to download and run HiJackthis.....and then post your log.

http://www.windowsforum.org/forum/index.php?showtopic=6901

[trackrat]

Were you refering to Trend micro Housecall as this is free, I use it about once a month.

http://housecall.trendmicro.com/housecall/start_corp.asp

[PoisonIvy]

Hey there,

Wow, thanks for the prompt replies! As for any other AV , I believe only the avg, I recently uninstalled norton when it expired. It never caught my viruses! Anyway, I did disable the avg when I downloaded the a2, so I dont know what I did wrong there. As to my laptop- this is a xp/ toshiba if that helps? (sorry, don't know what o/s is..I'm not great with computer lingo).

Regarding the HJT, thats one of the problems,( I'm pasting my post from another site,to help explain): My HJt icon on screen is version 1.97.7 (if it makes sense/helps it is in c:\Documents an settings\cc\desktop\hijackthis.zip). But, days ago, I went to config., misc tools, & check updates, that is where I managed to screwup. Somehow, after I"thought" I got the latest update, I exited, & re-clicked the HJT icon- still was old version- so I tried again, same thing. Soo, I ran search for HJT in Local C harddrives & got dozens of things- most say "Temporary directory.." , but not all. My problem is, since the NEW version is in a temp file (2 actually because I re-tried), it tells me it NEEDS to be in file of its own, but it does not say how to do this." Now, I thought I followed that exactly as I was supposed to,don't understand how it got there. I was given instruction how to relocate it,I followed that to a t -but when I hit save it will not respond-at all. SO, should I uninstall or delete all HJT and start over? I am worried I may have too many on my computer. Once I fix HJT I can post the logfile.

Finally, Packrat; thanks soo much! The link you gave worked, it loaded fine and I got the latest update! Now I can scan- I just wanted to ask, am I supposed to check the "auto scan" option? Because I don't see that in the illustration. I want to be sure I do this right 8) whew, long post. Hopefully there is a simple fix for the mess I made, until then I'm going to wait on scanning until I know if I should check the auco clean button. Thanks so much for all the help!

~Ivy

[nellie2]

I suggest you delete all copies of hijackthis that you have, you can download the latest version from here and there is a little tutorial here that tells you how to unzip it into a folder of it's own. :)

[pwp]

sounds like your virus is in system restore and you would need to disable system

restore to remove it. avg is unable to remove it as any file in system restore is protected.

this tells you how to disable and enable system restore.

from microsoft knowledge base article 310405

By using the System Restore feature, a computer system can be restored (rolled back) to a time before certain events occurred. For example, the computer may be restored to a time before specific software or hardware installations. System Restore monitors changes to the computer and to some program files, and automatically creates restore points. You can also create your own restore points whenever you want to.

By default, System Restore is turned on in Windows XP. It is a powerful tool that generally should not be turned off.

Turn off System Restore

To turn off System Restore, follow these steps:

Click Start, right-click My Computer, and then click Properties.

Click the System Restore tab.

Select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

Click Yes when you receive the prompt to the turn off System Restore.

Turn on System Restore

To turn on System Restore, follow these steps:

Click Start, right-click My Computer, and then click Properties.

Click the System Restore tab.

Clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

[PoisonIvy]

Hi there, 8)

Alrighty, I will go ahead and delete the HJT and start fresh. But- I want to be sure I do it right this time, do I just right click & delete the HJT in my temp files & the icon on my screen? Or am am supposed to do a "uninstall" process? Im afraid If I accidently leave it on when I start over I'll be back to square one. (I looked in control panel/add/remove hardware & it was not in there to uninstall,dont know if that is normal). After that, I'd like to do the trendmicro scan but need to know If I have to the check auto clean box? Once I do that, I guess I should do the system restore (which scares me for for some reason!). I wish I knew how all this crap got on my computer so I could prevent it from happening again. Lastly, do you think using mozilla or firfox would prevent any of this? Someone suggested I use it, but I dont know anything about it or any of the benefits using it. All this advice is much appreciated, thanks again,

Ivy

[mark2]

Hi there Ivy, to delete the Hijackthis folders/files you can simply r/click & delete them, there isn't an uninstall for HJT.

I would leave the system restore cleaning until we have cleared out all the "live" problems

Firefox is simple to setup and use, with the benefit it doesn't have the same number of vulnerabilites as IE

[trackrat]

Yes check the auto clean box

[Besty]

Im not sure if it has been said but dont make the same dumbass mistake i did and delete everything in hjt because that is not good which i found out wen my comp got all buggered

[PoisonIvy]

Hey there!

Alright, I disabled the AVG & ran the trendmicro scan, (took forever,but found a trojan horse). I think I have a few though. It said "uncleanable". I just went ahead and deleted it. I HOPE that rids that one at least 8) Earlier today, when I read the message to go ahead and just right click delete the HJT, I did, but I just noted the message from Besty, about deleting it can mess things up, so now Im a little worried. Did you mean dont delete the results on a HJT logfile- or HJT itself? Hope I did the right thing! Tommorrow when I get a chance , I'll download HTJ again & take it from there. Im just so confused with what I should do next mozilla/firefox, or system restore..

Finally, I was wondering if anyone can tell me what may be causing this one; when I go to do windows update, I get this:

"Windows Update uses ActiveX Controls and active scripting to display content correctly and to determine which updates apply to your computer... To view and download updates for your computer, Windows Update should be listed as a Trusted Site in Internet Explorer." But, I already have http://*.windowsupdate.microsoft.com &
/>http://*.windowsupdate.com typed in my trusted zones,& I recently fixed my activex settings in the internet zone (as suggested from another message board). So I dont know how else I can get my updates. So I am wondering if maybe my other activex settings may be wrong (since they were for the zone I had to fix, Im begining to wonder). But I dont know which zones should have which settings (disabled,enabled?). Any suggestions on what the other zones be? You guys have been really helpful, I am learning alot. Thanks 8)

~Ivy

[madboy33]

Ensure that active X is enabled correctly

In IE go to tools>internt options>security, then click on the custom level tab

[madboy33]

next one

[nellie2]

What Besty meant was.... don't go fixing everything that shows up in your hijack log, wait for advice!

It is ok to delete the HJT exe. It is a stand alone program and doesn't install onto your PC.

[PoisonIvy]

Hi there,

Whew, okay, I deleted almost all of the htj that showed up in my computer before starting over (only items I couldnt were emptyfolders that said "Temporary Directory26 for hijackthis.zip" 7 of them,they wont allow me to delete).

I followed the link that Nellie provided (thanks a bunch, that looks very simple to follow!). I wrote all of the steps down, now before I start the new download, I was wondering I am supposed to delete *or* use this: "winsockfix" says it restores registry keys after being corrupt,option to "fix"? Could this help clean my computer? If I recall correctly, I was supposed to do something with that months back but was told to forget that for the moment because I had other problems to fix. Second thing I did, I changed the activeX settings in the internet zone to the ones listed above, however, I was told on another site to keep them set this way to keep me safer:

"Signed Active X - disable

Unsigned Active X - disable

Initialize and script Active X not marked as safe - disable

Run Active X controls and plug-ins - disable

Script Active X controls marked safe for scripting - disable

Access data sources across domains - disable

Navigate sub-frames across different domains - disable

Active Scripting - disable

Allow paste operations via script - disable

Scripting of Java applets - disable

The others can be set as PROMPT or ENABLE."

(so Im a bit confused as to which settings I need). After I set them as madboy33 suggested, I tried again, but cant get my windows updates-still,after being in trusted zone too. 8( Im soo confused. Yesterday,I ran trendmicro, deleted the uncleanable trojan,was a different one,not the briss one, that never showed up! But, again & again, I still get the AVG popup telling me I have the Briss.d trojan . I just dont know what to do. So, should I leave the winsockfix, & just download hj this & post that logfile, or do something else first? Perhaps winsock could help me? Im worried someone is tracking what I type. Or that this could eat up my computer. What a mess! Thanks to you all 8)

~Ivy

[nellie2]

You can download the 30 day trial of Trojan Hunter from here, it is an excellent program and well worth the investment if you wanted to buy it.

The winsock thing, I assume you mean LSPfix? Don't do anything with that unless you recieve advice to do so.

You will be able to get rid of the hijackthis in your temp files by emptying your temporary internet files.

[trackrat]

What operating system do you use?????

and have you tried pwp`s post about turning off system restore and scanning with

avg or trend micro

[PoisonIvy]

Hi Nellie,

thanks for that link, I just may use that trojanhunter. I just went ahead and downloaded the HJT, I was prepared for a bunch of steps, as listed on that page, but it appears to be finished- all I had to do was save,save in desktop,close & the HJT icon is on my screen! That surprised me, because it said if you have XP the icon should have a zip through it, & to rightclick to extract. Mine wont give me that option,& the icon is not the file with a zip it is the bundle of dynamite. When I doubleclick it is ready to scan, so, it does not say anything about extracting files, or any of the remaining steps listed to follow. I know I didnt mess anything up there, so hopefully this is normal & it is ready to use? Tomorrow I will give the system restore a go & hopefully that will clean this up.

As to trackrats question, what operating system I have, I hate to say it, but I have no idea- I really dont know what that is (is that something I can find out easily? all I know is it is a XP/Toshiba/I dont know if that answers it). Anyway, looks like the HJT is ready to use, shall I run & post that logfile? thanks soo much

~Ivy

[nellie2]

hmmm, it must be self extracting now! That will make things easier! Yes post your log. I'm at work now and I think Mark2 will be too soon, but I'm sure expertec will be around at some point today.

[Scarecrow Man]

You can 'usually' tell the OS by clicking the start menu.. Read the vertical text along the left side. Windows 98, Windows ME, Windows 2000, or Windows XP

If XP is in the XP skin mode, it looks a lot differen't than the others. You'll know the difference.

:)

[trackrat]

Read the vertical text along the left side.

Crowman, what vertical text I do not have any on my start menu.

Can you post a picture to clarify this.

[Scarecrow Man]

Start menu has to be in classic view (windowsXP)

[trackrat]

My start menu looks like this. just changed it to the classic view and it is the same as you posted.

[Scarecrow Man]

That's the default XP start menu. None of the other versions look like that. They all look like mine.