Can't visit major security sites, use Norton, or MSN/Gmail..

[Gecko]

Hello Caeliferum,

Warning these instruction are for this thread only!
You should never attempt to use them for anything else!

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Click Start, click My computer and then right click on your C: drive and select "Properties"
Now click the "Disk cleanup" button, in the next window put a check next to Recycle Bin, Temporary Internet Files and Temporary Files click OK and then click yes in the popup window.

Click killbox.exe, now select the option "Delete on reboot".
Now click on the "All files" button (it will turn green)

Next copy the below red part:

c:\windows\system32\rbn.dll
C:\cp1041.NLS


Click 'File' in the killbox Menu on top and choose Paste from clipboard
Now click the red X icon to delete these files on reboot
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

After the reboot you will loose your internet access again
If you do, then run the WinsockFix.exe. file you saved to your desktop.

Launch WinsockFix.exe click the "Fix" button and follow the onscreen instruction ending with rebooting your system.

After this last restart please create a new hijackthis log and post it in your reply.

[Caeliferum]

[Gecko]

Caeliferum,


Let's try a fix and repair tool:
Please download and save it to your desktop.

Double click combofix.exe and follow the prompts.

When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

[Caeliferum]

Combofix doesn't seem to run properly. A black console appears and says:

find.exe: Windows XP: No such file or directory
find.exe: Windows 2000: No such file or directory
The process tried to write to a nonexistant pipe.
The process tried to write to a nonexistant pipe.

It happens so fast I had to screenshot it. o_O

[Gecko]

Caeliferum,

I think something is running in the background, let's see if we can find it.

Start HijackThis and click the Open the misc tools section now put a check next to "List also minor sections (full)
Now click the "Generate StartupList log" button notepad will open copy the contents of notepad into your reply.

[Caeliferum]

[Gecko]

Caeliferum,

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please download and save it to your desktop.

Double-click VundoFix.exe to run it.
When VundoFixopens, click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the
Scan for Vundo button." when VundoFix appears at reboot.

After the reboot(s) post a new Hijackthis log in your reply.

[Caeliferum]

No infected files found. o_O

[Gecko]

Caeliferum,

I know that the combofix is the tool we need to use so let's try from a different location.
Please delete the combofix on your desktop and then download a new copy of comboxfix from

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Now run the combofix.exe it might take a couple of times to get it to work all the way through.

If it still gives you trouble try renaming it to cbfix.exe and try it again to get it to finish.

If it finishes reboot to normal windows and create a new Hijackthis log and paste it into your reply.


If you cannot get combofix to run or finish then download extract it to your root like this:
C:\rkr\RootkitRevealer.exe

Close all other programs, windows and disable your screen saver before you start RootkitRevealer.
While RootkitRevealer is running, you shouldn't do anything at all with the PC.
Put down the mouse, back away slowly, and let the program do its work.

Start RootkitRevealer.exe and press the Scan button.
It will take some time to finish an hour is common so just wait it out.
Once the scanning is finished RootkitRevealer will create a log, please copy the contents of that log into your reply.

[Caeliferum]

Combofix still not working. It now says my OS is incompatible. My OS is Windows XP Media Centre 2005, btw.

As for Rootkit Revealer, it was able to find 20 discrepencies, but I'm not able to provide them because the program generates an error when trying to save the report.

[Gecko]

Hello Caeliferum,

It looks like the quick fix tools are not going to work here so we will have to to it by hand.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please download
Extract the contents of MGTOOLS.zip to the root directory of drive C:\. This will create a folder named MGTOOLS in the root directory of Drive C.

( Do not attempt to run these programs from inside the ZIP file or by using Winzip. They will not work properly. )


Navigate to C:\MGTOOLS and double click on the following script:
GetRunKey.bat
When it is done notepad will open do not close this window yet.

Navigate to C:\MGTOOLS and double click on the following script:
ShowNew.bat
When it is done notepad will open do not close this window yet

Now copy and paste both notepad logs into your reply.

Do not run any other files in the C:\MGTOOLS folder

[Caeliferum]

Both batch files are generating errors like:

The process tried to write to a non-existant pipe.

It seems both are attempting to check the OS, and they both say mine is unsupported.

Is there really a difference between XP Media Centre and XP? Or could malware be tricking all of these applications?

[Gecko]

Caeliferum,

Let's try one more time to remove this by hand.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

Click start > run and type Wininit.ini and press enter
Delete the following line in the Wininit.ini file:
C:\WINDOWS\System32\spool\drivers\W32X86\3\Old\1\SDhp1020.HLP||C:\WINDOWS\System32\spool\drivers\W32X86\3\Old\1|
(note that it will be much longer than the above but should start with the same path)

Close Wininit.ini and click yes to save changes.

Click start > run and type regsvr32 -u lao.dll and press enter (a window will open and close this is normal)

Start Killbox now select the option "Replace on reboot", and put a check net to "Use dummy"
Now type or paste the following into the Killbox text box:
c:\windows\system32\lao.dll
Next click the red circle with the X in it.
Killbox will tell you that all listed files will be replaced on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

You will loose you internet so use the WinsockFix to get it back.

Once you have the internet back post a new HiJackThis log when you reply.

[Caeliferum]

....Windows cannot find Wininit.ini.

[Gecko]

Caeliferum

I really think that Norton Internet Security is causing us a lot of frustration and is why it's such a fight to run anything.
If the below fix does not get you stable then we might have to uninstall Norton Internet Security and then reinstall it once we get it fixed.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when we are done

Click Start > My Computer > C: Drive > Windows > and scroll down until you see the Wininit.ini file.
Double click it and it will open in notepad, now delete the following lines:
[Rename]
C:\WINDOWS\System32\spool\drivers\W32X86\3\Old\1\SDhp1020.HLP||C:\WINDOWS\System32\spool\drivers\W32X86\3\Old\1|
(note that it will be much longer than the above but should start with the same path)
Close notepad and click Yes to save changes.

Click start > run and type regsvr32 -u lao.dll and press enter (a window will open and close this is normal)
(if you get an error just continue with the rest of this fix)

Start Killbox now select the option "Replace on reboot", and put a check net to "Use dummy"
Now type or paste the following into the Killbox text box:
c:\windows\system32\lao.dll
Next click the red circle with the X in it.
Killbox will tell you that all listed files will be replaced on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

You will loose you internet so use the WinsockFix to get it back.

Once you have the internet back post a new HiJackThis log when you reply.