Do you have any reason to suspect malware?


Let's try this:
-- Download DDS by sUBs (http://download.bleepingcomputer.com/sUBs/dds.scr) and save it to your Desktop
-- If your AV has a...

^^^What she said!!

Actually, though, in your case I think a reformat was the right way to go - I was just a bit leery of the homemade XP CD.

Glad it all worked out OK :)

PP

Do you have a utility on the compy to burn recovery media from this partition? It would probably be START > All Programs > Tools or Accessories, if not obvious....

That would be best, if you are...

Do you need a second partition?

Is d:\ your original recovery partition?

You're not going to ruin anything. Worse comes to worse, you can buy a legit OS CD and use that.
All you are doing is wiping the hard drive - no worries. If you run into problems with your current...

I'd rather try a bootable recovery console, than the homemade XP CD, to be honest. Very leery of that.
With the recovery console, we could repair MBR and Boot.ini.
Unfortunately, my time is very...

Hang on for a bit and let me go over the thread and try to answer those questions :)

Will post them shortly.

HA! I know - same here!
Hey - at least I learned some things along the way about Vista and Laptop touchpad sensitivity....... I'm sure they will come in handy down the road for people with similar...

Well . . . . I didn't think of it either . . . .

Happy to have been of service :)

I feel a tinge of regret in saying this, but it appears the Ulysses of Daniweb threads has come to a close....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:31:46, on 29/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
...

-- What do you mean by that - what happens when you try?
(tap F8 on restart)

-- Don't panic just yet :)
While a reformat is generally best in these cases, I suspect you may run into problems...

You're welcome :)

-- I was talking to a friend and she mentioned she had a similar problem with her laptop cursor jumping around and it was due to her touchpad.
In your control panel / mouse...

Yes - That is normal. No worries. Just let it run and delete the baddies it is unable to neutralize.

-- Can you attach that Zip from AVPTool for me please.

Since combofix can't run and MBAM...

That is not the proper procedure. We like to operate under the assumption that "an infected restore point is better than none at all" in the event that the repair process goes awry and we need to...

Did you reboot and try combofix?



If that doesn't work, let's try another powerful tool:
Please Download Kaspersky's AVP Tool (http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/)

--...

What's the setup.exe from?

At this point, I am not sure what to tell you - there are so many different areas to investigate that it would not really be feasible to do that in a forum setting.
The...

OK - Let's have a whack at this AVG:

Please download the attached RemAVG.zip and extract RemAVG.reg from the Zip to your desktop.
-- DoubleClick on RemAVG.reg and allow the contents to merge...

Great!

Now, do the Avenger step from post #57 and see if combofix will run.

Let me know how you fare.

PP:)

I am going to be away from the computer for a while, so I'll assume you were able to copy atapi.sys to C:\atapi.sys as in post #56.


If it is not still on the ill machine, please download The...

It may not allow you to do so. No worries - we'll do it a different way.

-- Open task manager and see if you can stop svchust.exe from running. Note the spelling.
Let me know.

-- Also, try...

I've got to run, so I'll assume you can get a command prompt.

Let's do this:

Open a command prompt and type the following exactly as I have posted it. Copy and paste would be better so you...

Well . . .I need to update that a bit LOL!

Anyhoo, I think it shows enough to get started.


Are you able to get a command prompt on the ill computer?
START > RUN > Type cmd OK

PP:)

Great - I'll post some removal steps late tonight or Monday to remove the AVG stuff from registry.

PP:)

Please do.

It will make removing it easier ( yeah - I know I'll probably regret saying that.....)

PP:)

LOL!
I was trying to reply the other day, but I couldn't access the thread - got some sort of phpbb error (I think) . . .

PP:)

Is that the whole thing?

I figured there'd be more - no worries if not.

PP:)

Well . . . Unfortunately it is not very lucrative at the moment :)


Luckily for you, we are not nearly as overwhelmed as some other forums.
I have a friend who runs a popular forum and they are...

There are a number of different ways malware accomplishes this. Lately, modifications to legit files along with some rootkitted components seems to be the method of choice.

In your case, atapi.sys...

Are you able to download the attached FindWPP.zip and Extract the FindWPP Folder from the ZIP and place it on your ill computer?

If so, do that and then open the FindWPP Folder and run RunThis.bat...

It shows in your DDS Attach log:
iTunes
Java(TM) 6 Update 15
Junk Mail filter update

Any trouble installing the updated version?


No worries - we can deal with that. Did you try to delete...

Just go into Add / Remove Programs and remove to old one - I think I saw only one old version.

What file?

Download Bill James’ RegSrch (http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip)...

I have never had a problem with Seagate - have five of them and three are at least 5 years old and still as good as new.....
Haven't looked too much at the big drives, though, so I couldn't say...

I think you are right - probably pushing a bit hard + Vista needs a good deal of RAM.

I am partial to Seagate (and Newegg, for that matter):
Seagate FreeAgent Desk 640GB USB 2.0 Silver External...

That's odd - can you give me the exact error message? Definitely need to see that before I can make any suggestions.

On the plus side, those other logs look good, so I think you are OK as far as...

That is good news indeed! And, a very generous thank-you offer to boot!
Generally, I am happy if people "pay it forward" and do a good turn for somebody else in need. I figure that eventually it'll...

Finally! LOL! Lovin' that Vista!

See if you are able to install Adobe now - hopefully that will complete OK and then we can look at security again.

Typical busy Fall weekend upcoming - will...

AllRightyThen - On we go!

Let's try again to set up that reg key and see what happens:

Open another elevated command prompt and Copy&Paste

reg add...

That's terrible!

Are you sure you've been hacked? There are a lot of ways to steal identities and defraud people these days....

That said, you did have traces of rootkit activity on your...

OK - I was a bit sloppy with that batch file, but not enough to cause that error.
Let's have another go at it:


-- Download the attached FixPerms.zip to your Desktop and Extract the FixPerms...

Let me rewrite it - something's hinky.

Will post it again asap - could be tomorrow, though. Or late tonight.

PP:)