1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Problem With Xp Home Security And Now More...

Discussion in 'Malware Removal Help' started by Sreiss123, Jun 3, 2011.

  1. Sreiss123

    Sreiss123 Registered Members

    Joined:
    Jun 3, 2011
    Messages:
    26
    Location:
    Saint Louis
    Operating System:
    Windows XP Home
    Computer Brand or Motherboard:
    Dell Dim 3000
    CPU:
    Pentium 4 CPU 2.8 GHZ
    Memory:
    2 GB RAM
    Good News....things have been running pretty smoothly. I did get a message from my Firefox browser that it blocked Metasearch Plug in, but other than that, no problems.

    So I guess we're ready for any final steps. I do have a few questions too.

    1) In the event I see I have a virus, what is the first thing I should do?

    2) Since many of the viruses are now smart enough to stop MBAM and the like, what would happen if I renamed all those things NOW? Would I be able to run them in my time of need?

    3) I seem to recall during our cleansing process that we created a Restore Point. Is it smart to periodically do that, or do I really just need one? Am I better off running a System Restore or trying to remove a virus?

    4) Microsoft has offered to download Window's Malicious Software Removal Tool; is that any good?

    5) I now have several virus removal items on my computer (OTL, TFC, Roguekiller currently named Winlogon), MBAM). Should I keep them all on my computer?

    Lastly, once again, thank you for all your help.

    Steve
     
  2. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Sreiss123

    Ok, let's see what we have...

    Always make sure that programs like MBAM are up to date.
    Update them every day, even if you only run them once a week.
    Then if you think you see anything suspicious, you'll more or less have the latest updates..... especially if you get blocked from updating.
    Also run a full virus scan with your resident AV ( most AV's will remove other things besides virus's now)

    Possibly.
    Some malware will stop programs by name.... some malware will just block all .exe files from running.

    If system restore is turned on, a restore point will be created everytime you log on to the system.
    Sometimes you can run a system restore to an earlier date and that will sort out the malware.... but some malware will block all restore points from being used.

    Actually i did find it quite good.
    The only downside was the size of the file to download..... it's quite huge. ( MBAM is a fraction of the MS program)

    OTL
    No, this will have to be removed as it doesn't auto update and is updated quite often, so you'll need a fresh copy each time)

    TFC
    Definitely keep this and run it as often as you like.
    I run it every 2 days.

    Roguekiller
    Again, this is updated quite often as new rogue programs come along and it doesn't auto update.... so no value in keeping it.

    MBAM
    Definitely keep this, update it every day.... even if you only run it once a week. ( but can be run as often as you like)

    Ok, let's finish off then:

    Step 1
    Restart MBAM.
    Click on the Quarantine tab
    If there are items in quarantine.....
    Make sure everything is selected and then click Delete All.
    Close MBAM.


    Step 2
    Please uninstall ComboFix by
    Clicking on Start ...then run ... and type in combofix /uninstall (don't forget there's is a gap between x and /) Then press Ok
    .

    This action will uninstall Combofix and also perform a few cleanup measures



    Step 3
    • Please double-click OTL to run it.
    • You should see a CleanUp! button, press that button,

      [​IMG]
    • This will cleanup an assortment of tools used during malware removal, plus itself

    Note:
    MBAM will not be removed


    Step 4
    Now you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

    The easiest and safest way to do this is:
    • Go to Start > Programs > Accessories > System Tools and click "System Restore".
    • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the Restore Point a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
    • Then go to Start > Run and type: Cleanmgr
    • Click "OK".
    • Select the drive for cleaning then click OK (usually 'C' drive)
    • Click the "More Options" Tab.
    • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.


    To find out how you may have been infected....read this topic:
    How did i get infected?

    Not all of the following information will be applicable to you, but it's still best to read it all.

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    • Use an AntiVirus Software
      Note*:
      Upon installation MS Security Essentials will check that your OS is a legal copy.

      Only install one AntiVirus program
    • Update your AntiVirus Software regularly
    • Use a 3rd party Firewall NOTE: If choosing Zone Alarm be aware that the free version also installs ZoneAlarm Spy Blocker. It is recommended however that you UNcheck this option.

      Only install one software Firewall

      Some 3rd party Firewalls will turn off the windows firewall when they are installed.
      It's always best to check that the Windows Firewall is turned off:

      How to turn off Windows Firewall:
      Start ... Control Panel ...click on 'Classic View'.
      now select Windows Firewall.
      When the Windows Firewall box opens, put a tick against .. Off (not recommended) and then click Ok
    • Scan regularly with a 'Stand Alone' Anti-Malware scanner:
      Installing another scanner that you can run once or twice a week is always beneficial.
      Something like:
      Malwarebytes Anti-Malware
      SUPERAntiSypware
      Remember to update these programs each time before running.
      You can install more than one of these if you only run them as stand alone programs.
    • Use an alternative browser:
      Some excellent alternatives to MS Internet Explorer are:

      Firefox
      For added security, add the NoScript extension to this browser:
      Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks
      also consider adding:
      WOT - Safe Browsing Tool

      Web of Trust warns you about risky sites that cheat customers, deliver malware or send spam. Millions of members of the WOT community rate sites based on their experience, giving you an extra layer of protection when browsing or searching the Web.
      Btw: you don't have to make a contribution.

      Opera

      They offer better security, more stability, and better speed.
    • Keep a backup of your registry
      Keeping a regular backup of your registry will help when something goes wrong.
      Use a program like:
      Erunt

      A full tutorial on how to set up and use Erunt can be found here:
      Erunt tutorial
    • Keep your system clean of temp files etc, using a 'Cleaner':

      Cleaners are programs that will help to clean out your:
      Windows temp files
      Current user temp files
      Cookies
      Temporary Internet flies
      Browser history
      Recycle bin
      Etc.......
      In other words.... all the rubbish that you accumalate over the course of your browsing and day to day usage of your pc.
      Programs like:
      TFC by OldTimer
      ATF Cleaner
    • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    • Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:
      Using and installing SpywareBlaster
    • Update all your 'Security' programs regularly - Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    Glad I was able to help.

    Safe surfing. [​IMG]
     
    Last edited by a moderator: Feb 4, 2014
  3. Sreiss123

    Sreiss123 Registered Members

    Joined:
    Jun 3, 2011
    Messages:
    26
    Location:
    Saint Louis
    Operating System:
    Windows XP Home
    Computer Brand or Motherboard:
    Dell Dim 3000
    CPU:
    Pentium 4 CPU 2.8 GHZ
    Memory:
    2 GB RAM
    A couple (hopefully) last things.

    After uninstalling combo fix, my avast popped up, saying it found a suspicious file..../??/C/Combo-Fix6934C/mbr.sys I chose to delete it....hope that was correct.

    I also noticed that when I run a search for combo fix, I still find a couple misc. "pf" files, in a folder called Prefetch. Do I need these?
     
  4. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Sreiss123

    That's fine.

    The prefetch files are basically Windows way of trying to save you time when using the same files.
    If there's any combofix files in there they can be removed, but normally we just forget about them.
    They won't cause any problems and take up hardly any space at all.
     
  5. Sreiss123

    Sreiss123 Registered Members

    Joined:
    Jun 3, 2011
    Messages:
    26
    Location:
    Saint Louis
    Operating System:
    Windows XP Home
    Computer Brand or Motherboard:
    Dell Dim 3000
    CPU:
    Pentium 4 CPU 2.8 GHZ
    Memory:
    2 GB RAM
    Thanks.

    It seems I'm having a compatibility problem.

    I downloaded Armour Online Free and ran it. It required that I shut the computer down; I did so and then walked away.

    When I checked the computer this morning, here's what I found:

    A blue box with a header reading: Microsoft Visual C ++ Runtime Library

    Below that, it read:

    Runtime Error!
    Program: C:/Program Files/HP/hpcoretech/comp/hptskmgr.exe
    This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information.

    I really don't know what the Runtime Library is, so I'm a little at a loss here. Any ideas?
     
  6. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    This has nothing to do with Armour Online Free.

    hptskmgr.exe (HP Task Management Component)
    It belongs to a HP device - scanner or printer, most likely -
    update the drivers from HP should fix the problem for you.
     

Share This Page