Any Windows XP guru's out there?

[Tilar]

My brother brought me his computer because he had one of those popups that tell him his system is infected and if you buy their product they will uninistall this pesty bug they gave you. Windows Recovery I believe was the name of it.

I've ran Malwarebytes, SuperAntispyware, Spybot Search and Destroy, AVG antivirus all updated and even tried Combofix as a last resort but that wouldn't run right for some reason.

Anyway, everything is fairly well back to normal with the exception that I get the popup "Internet Explorer Script Error" and it will show a website like advertising.com, fastclick.net or something similar asking if I want to contirnue running scripts. I'm getting these errors as soon as the system boots up. I don't have to be on the internet or even connected to the net.  Any suggestions? I'm comfortable working with the registry if I knew where to go and what I needed to check.

I have pretty good luck with this sort of thing normally but this one is eating my lunch.

[Khyron]

Open IE, Click  Tools>Internet Options>
Click on the "connections" tab.
Click "Lan Settings"

Make sure nothing is checked by "automatically check settings"

click ok and exit

Open Explorer
navigate to
c:\windows\system32\drivers\ect

double click "hosts"

when prompted open with notepad

make sure it only says this.

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

[BananaDan]

Click Tools, Manage Add-Ons.  Look for the offending script/applet and disable or remove it.

Dan

[Tilar]

I've checked the "Lan Settings" and I had checked the hosts file to begin with.  I also checked the addons in IE but I don't really see anything that really sticks out.  Maybe I can get a list of everything in the addons and post them.

[Khyron]

start> run> "msconfig"

look in startup and disable everything but your Anti virus and wireless
Click "services" tab, click the mark that says hide Microsoft services look in there

start> run> regedit

HKLM> software> microsoft> windows> current version> run

look for anything out of the norm and remove

HKCU> software> microsoft> windows> current version> run

same

[KS71owner]

I had this same problem a while back - the search engine reroute was giving me fits. If it's a rootkit like it was with mine, antivirus software won't remove it. Try TDSSkiller from Kaspersky Labs. Worked wonders for mine.


http://support.kaspersky.com/faq/?qid=208283363

[BananaDan]

I've checked the "Lan Settings" and I had checked the hosts file to begin with.  I also checked the addons in IE but I don't really see anything that really sticks out.  Maybe I can get a list of everything in the addons and post them.

Yes, post your IE add-ons.  If it only happens when you launch IE, the problem is likely there.

Dan

[SRT-440]

I had this same thing (windows recovery console) on my computer at work yesterday...caught it from one of these automotive forums. My IT chic ran a anti-malware disc on it and then deleted it from the IE add-on...it gave my computer hell but now it's all good. Popped up all kinds of fake warnings...thought my hard drive was toast.

[mikepmcs]

lay off the porn.   

[resq302]

my wifes netbook has something similar.  I ran all the Avast antivirus and such and came back clean.  The only problem she keeps having occasionally now is that if she loads up say www.dodgecharger.com, it goes there for a sec and then gets redirected to another web location.  Is there any fix for this?  Its driving her nuts which is causing me to go nuts!

[elacruze]

Google chrome.

[BananaDan]

Google chrome.

Agreed, Chrome or Firefox are more secure browsers.  For your IE issue, grab a screenshot of your Manage Add-Ons screen and post it here.  It's likely a similar issue.  You could also try another AV scanner, like AVG or Microsoft Security Essentials.  I put instructions on how to get to your add-ons in IE above in this thread.  When you have the window open, hit Alt-PrintScreen.  Open Microsoft Paint, hit Ctrl-V to past your screenshot into Paint.  Save the file as a .jpg and upload it here.

If the list is long and requires scrolling, you'll have to post multiple screenshots showing the entire list.

Dan

[BananaDan]

start> run> regedit

HKLM> software> microsoft> windows> current version> run

look for anything out of the norm and remove

HKCU> software> microsoft> windows> current version> run

same

Yes, cleaning these keys out is a good thing to do/check when infected, or even regularly because non-malware will deposit junk in here and cause extra resources to be used because they have processes autostart from here.  RealPlayer, Adobe and iTunes are notorious for this.  But, if you don't know what you're doing, don't delete anything from the registry.  You're better off posting the screenshots of these registry keys and asking what can be safely deleted if you aren't sure.

Dan

[Khyron]

Or contact me tonight and I'll remote into your machine, take your porn and then clean your machine

[twodko]

I had this same problem a while back - the search engine reroute was giving me fits. If it's a rootkit like it was with mine, antivirus software won't remove it. Try TDSSkiller from Kaspersky Labs. Worked wonders for mine.


http://support.kaspersky.com/faq/?qid=208283363

Same thing happened to my laptop. It was a nasty "redirect" virus that could not be removed by Norton, Kaspersky or anything else I could find. Ended up reformating my HD and reload the XP OS.

[Tilar]

start> run> "msconfig"

look in startup and disable everything but your Anti virus and wireless
Click "services" tab, click the mark that says hide Microsoft services look in there

start> run> regedit

HKLM> software> microsoft> windows> current version> run

look for anything out of the norm and remove

HKCU> software> microsoft> windows> current version> run

same

Nothing looks out of the ordinary in the registry keys you mentioned. I ran msconfig and the only thing I'm finding that is questionable is something called mccicmservice.exe. I did a search on it and it might be something to do with his Centurylink internet but i'm not sure.

I had this same problem a while back - the search engine reroute was giving me fits. If it's a rootkit like it was with mine, antivirus software won't remove it. Try TDSSkiller from Kaspersky Labs. Worked wonders for mine.


http://support.kaspersky.com/faq/?qid=208283363

I downloaded this and it will not run.

Agreed, Chrome or Firefox are more secure browsers.  For your IE issue, grab a screenshot of your Manage Add-Ons screen and post it here.  It's likely a similar issue.  You could also try another AV scanner, like AVG or Microsoft Security Essentials.  I put instructions on how to get to your add-ons in IE above in this thread.  When you have the window open, hit Alt-PrintScreen.  Open Microsoft Paint, hit Ctrl-V to past your screenshot into Paint.  Save the file as a .jpg and upload it here.

If the list is long and requires scrolling, you'll have to post multiple screenshots showing the entire list.

Dan

Here is the list of addons:

Name          Shockwave Flash Object
Publisher     Adobe Systems Incorporated
Status        Enabled
File date     Friday, November 12, 2010, 8:37 PM
Version       10.0.45.2

Name          AcroIEHlprObj Class
Publisher     Adobe Systems, Incorporated
Status        Enabled
File date     Tuesday, December 14, 2004, 2:56 AM
Version       7.0.0.1333
Load time     1.05 s

Name          AVG Safe Search
Publisher     AVG Technologies
Status        Enabled
File date     Friday, March 25, 2011, 5:43 AM
Version       10.0.0.1319
Load time     8.81 s

Name          XML DOM Document
Publisher     Microsoft Corporation
Status        Enabled
File date     Monday, June 14, 2010, 3:41 AM
Version       8.100.1052.0

Name          Windows Media Player
Publisher     Microsoft Corporation
Status        Enabled
File date     Wednesday, August 25, 2010, 11:36 PM
Version       11.0.5721.5280

Name          Diagnose Connection Problems...
Publisher     Not Available
Status        Enabled

Name          Windows Messenger
Publisher     Not Available
Status        Enabled

Name          {53707962-6F74-2D53-2644-206D7942484F}
Publisher     Safer Networking Ltd.
Status        Enabled
File date     Monday, January 26, 2009, 3:31 PM
Version       1.6.0.0
Load time     12.86 s

Name          Java Plug-in 1.5.0_10
Publisher     Sun Microsystems, Inc.
Status        Enabled
File date     Thursday, November 09, 2006, 4:21 PM
Version       1.5.0.10

Name          SSVHelper Class
Publisher     Sun Microsystems, Inc.
Status        Enabled
File date     Thursday, November 09, 2006, 4:21 PM
Version       5.0.100.3
Load time     2.52 s

Name          Sun Java Console
Publisher     Sun Microsystems, Inc.
Status        Enabled
File date     Thursday, November 09, 2006, 4:21 PM
Version       5.0.100.3

Name          YInstStarter Class
Publisher     Yahoo! Inc.
Status        Enabled
File date     Sunday, July 30, 2006, 2:25 PM
Version       2004.11.7.1

Now, one thing I've noticed is in his Windows/Prefetch directory there are file names with different sizes than my originals. Take the TDSSkiller.exe file for example, The original file is 1.31 megs in size and the one in the prefetch directory is named tdskiller.exe-1DE72614.pf and it is 11kb in size. Is this normal?

I wish it were a hardware problem because I have pretty good luck with that, but software gives me a hard time sometimes.

lay off the porn.   

Damn, that's gonna break his heart. 

[Khyron]

download this

http://www.teamviewer.com/en/download/index.aspx

[Khyron]

let me know when it's installed

[Tilar]

Alright give me a few minutes and I'll get it downloaded.

The thing that is odd is I don't have to have internet explorer open to get these errors.

[Khyron]

Im goin gto PM you my cell number, when its installed and open, text me the login and password it give you, let me take a look

[BananaDan]

Nothing looks out of the ordinary in the registry keys you mentioned. I ran msconfig and the only thing I'm finding that is questionable is something called mccicmservice.exe. I did a search on it and it might be something to do with his Centurylink internet but i'm not sure.

This is ok, it's for your modem.

Here is the list of addons:

Name          Shockwave Flash Object
Publisher     Adobe Systems Incorporated
Status        Enabled
File date     Friday, November 12, 2010, 8:37 PM
Version       10.0.45.2

Name          AcroIEHlprObj Class
Publisher     Adobe Systems, Incorporated
Status        Enabled
File date     Tuesday, December 14, 2004, 2:56 AM
Version       7.0.0.1333
Load time     1.05 s

Name          AVG Safe Search
Publisher     AVG Technologies
Status        Enabled
File date     Friday, March 25, 2011, 5:43 AM
Version       10.0.0.1319
Load time     8.81 s

Name          XML DOM Document
Publisher     Microsoft Corporation
Status        Enabled
File date     Monday, June 14, 2010, 3:41 AM
Version       8.100.1052.0

Name          Windows Media Player
Publisher     Microsoft Corporation
Status        Enabled
File date     Wednesday, August 25, 2010, 11:36 PM
Version       11.0.5721.5280

Name          Diagnose Connection Problems...
Publisher     Not Available
Status        Enabled

Name          Windows Messenger
Publisher     Not Available
Status        Enabled

Name          {53707962-6F74-2D53-2644-206D7942484F}
Publisher     Safer Networking Ltd.
Status        Enabled
File date     Monday, January 26, 2009, 3:31 PM
Version       1.6.0.0
Load time     12.86 s

Name          Java Plug-in 1.5.0_10
Publisher     Sun Microsystems, Inc.
Status        Enabled
File date     Thursday, November 09, 2006, 4:21 PM
Version       1.5.0.10

Name          SSVHelper Class
Publisher     Sun Microsystems, Inc.
Status        Enabled
File date     Thursday, November 09, 2006, 4:21 PM
Version       5.0.100.3
Load time     2.52 s

Name          Sun Java Console
Publisher     Sun Microsystems, Inc.
Status        Enabled
File date     Thursday, November 09, 2006, 4:21 PM
Version       5.0.100.3

Name          YInstStarter Class
Publisher     Yahoo! Inc.
Status        Enabled
File date     Sunday, July 30, 2006, 2:25 PM
Version       2004.11.7.1

I'd disable everything in red.  In addition, try to avoid installing IE toolbars, even from reputable companies like Google and Yahoo.  They crud up IE with extra crap, slow it down and tend to include tracking/spyware code.

Now, one thing I've noticed is in his Windows/Prefetch directory there are file names with different sizes than my originals. Take the TDSSkiller.exe file for example, The original file is 1.31 megs in size and the one in the prefetch directory is named tdskiller.exe-1DE72614.pf and it is 11kb in size. Is this normal?

Yes, prefetch is not the actual file, it's a cached chunklet of the file.  Don't worry about that.

[Khyron]

He has the new version of the AV2011 virus, Im in his machine now. It's a java exploit to get in.
I just cleared all temp folders and files, purged the bug out of the registry, im now removing java and will install the new version that is protected.

[Tilar]

Well, I'm going to wait till this new RAM gets here which should be Monday before I go any further. This thing is still awful slow rebooting but it is running faster once it gets completely booted up.

The new Java is installed but I'm still getting the script errors.

[Tilar]

Well, I gave up. 

I did everything that I was familiar with, I uninstalled, disabled, reinstalled everything that was suggested. Khyron spent quite a bit of time trying to repair it and really made it run a lot better, but we just couldn't get rid of that friggin script error.  I just did a fresh install of XP on it.  Anyway, I just wanted to say "Thank you" to everyone for the suggestions and help. 

[Khyron]

Sorry I haven't been around to help more :-(