Posts by gerbil

And that is not a gaming laptop. Which are strange beasts, anyway... sure, they are portable, but unless you can plug into the AC with the adapter the graphics card falls over. Power saving.
The graphics on this one are not great... but the rest is overkill for home use... docs, editing pics, net stuff. At least you can plug up to a proper screen with the HDMI if you want to watch a movie you've downloaded.
When the McAfee runs out, get something real. An eSata port might have been nice.
Get your hands onto the keyboard before you buy, too.

You are welcome, Tori.
It can be frustrating when one problem masks another, separate issue.
Get your softwares from reputable sites. A tip... if many sites have the same program, it's likely safe.
Cheers.

In Network Connections, Wireless tab, remove any old network profiles listed, do the same with the Intel software. Try to search for networks afresh.
And finally, try uninstalling the Intel Wireless software to see if windows can manage the adapter. Reinstall Intel Wireless.

Power management has not switched it off?
Earlier, you said you could not connect to download Kaspersky online scanner... can you connect with a LAN cable? Are there settings in your Intel\Wireless program iFrmewrk which could interfere?

Tori, ignore the henny penny lines... I was just testing how the site handled multiple spaces etc. - it removed them.
To paste on this site, I must use Ctrl-V.
In Device Manager, ensure that your Intel Pro Wireless adapter is working [no exclamation mark]. It is actually enabled, else it would not show in ipconfig.
I don't know if your lappie has a hardware or software switch for the wireless... Fn+F5 gets you the software menu - make sure the Master is on, and then your wireless adapter.
FSS says the software side [drivers] is okay.

henny penny
henny penny

Tori, those logs are satisfactory, except for the No Connection status in FSS. Your software appears ok in that regard. To investigate further, please open a cmd window [Start, Run, enter cmd], and enter...
ipconfig /all
If some entries such as IP Address, Default Gateway, DHCP/DNS servers are blank then is your router set to broadcast its SSID? What happens when you try to search for / establish a connection? Signal strength?
Post the content of that cmd window [cursor to top margin, rclick, choose Edit > Select all; again to Edit > Copy, then paste into a notepad].

The code detection system here looks for more than two consecutive spaces in a post, if it finds them it forces you to code snippet posting. I write in a notepad, then use Select All [ctrl-A] to pick up consecutive spaces, and remove them. And sometimes, it seems, the site formatter removes them. Beats me, too... :)

That was my mistake, Tori.... while cutting and pasting I managed to drop a header from the fix. This will run - paste it into Custom Scans/Fixes as before, press Run Fix.

:OTL
DRV - (SYMIDSCO) -- C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20050404.003\symidsco.sys File not found
IE - HKLM\..\SearchScopes,DefaultScope = {DFED8F93-399D-4F29-B581-A28912DA3057}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{DFED8F93-399D-4F29-B581-A28912DA3057}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes,DefaultScope = {DFED8F93-399D-4F29-B581-A28912DA3057}
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT151685
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\{DFED8F93-399D-4F29-B581-A28912DA3057}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SAVJ_enIL509
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\Google: "URL" = http://www.google.com/search?sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&q=%s
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [PCDrProfiler]  File not found
O9 - Extra 'Tools' menuitem : IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab (Java Plug-in 1.4.2)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\msdaipp - No CLSID value found
O20 - Winlogon\Notify\NavLogon: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EC2E1DEC
:Commands
[emptytemp]

And then do these things:
== please download Farbar Service Scanner from http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/
Dclick FSS.exe to start it, ensure all boxes except Windows Defender are checked and press Scan. Post the log.
Because you have network issues, you may as well run this...
==Download …

Sorry, Tori.. the weekend got in the way... :)
Lenono-Y ... :)
I must ask - did you deliberately install AMMYY [remote desktop control software]?
You have components of Norton/Symantec AV still on your machine... I suggest you get the correct cleaning tool from https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?docid=20080710133834EN&product=home&pvid=f-home&version=1&lg=en&ct=us and run it after this.
Start OTL, and in Custom Scans/Fixes paste this in, then press Run Fix button, post the log:

DRV - (SYMIDSCO) -- C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20050404.003\symidsco.sys File not found
IE - HKLM\..\SearchScopes,DefaultScope = {DFED8F93-399D-4F29-B581-A28912DA3057}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{DFED8F93-399D-4F29-B581-A28912DA3057}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes,DefaultScope = {DFED8F93-399D-4F29-B581-A28912DA3057}
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT151685
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\{DFED8F93-399D-4F29-B581-A28912DA3057}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SAVJ_enIL509
IE - HKU\S-1-5-21-3938136012-1047769790-43693901-1005\..\SearchScopes\Google: "URL" = http://www.google.com/search?sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&q=%s
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [PCDrProfiler]  File not found
O9 - Extra 'Tools' menuitem : IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab (Java Plug-in 1.4.2)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\msdaipp - No CLSID value found
O20 - Winlogon\Notify\NavLogon: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EC2E1DEC

Next, please download Farbar Service Scanner from http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/
Dclick …

.

Tori, let's see what you have got. Firstly...
==Get CCleaner from http://www.piriform.com/ccleaner or http://www.filehippo.com/download_ccleaner - and install it. You should keep this one for general use. I set the installation checkboxes only to Open and Run from the recycle bin. It's neater that way.
I also suggest you uncheck the Google Chrome installation boxes.
Run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the CCleaner options...].
If you have FireFox open the Applications tab and ensure at least that Cookies and Cache are checked.
Select the Cleaner icon, press Run Cleaner.
Run CCleaner in any other Accounts.

Next... ==Download OTL from http://oldtimer.geekstogo.com/OTL.exe to your Desktop.

• Double click on the icon to start the application.
• Press Scan All Users, Minimal Output, Standard Registry ALL, check both LOP and Purity boxes, leave other sections as they are.
• Under the Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
CREATERESTOREPOINT

• Press Run Scan.
  The scan will take maybe 5 minutes; 2 notepads will present [saved to the place from where you ran OTL.exe] - please post both.

And finally use either of...
==Kaspersky Online Scan, from http://www.kaspersky.com/virusscanner - download Kaspersky Security Scan.
==Eset Online Scanner using IE only: http://www.eset.com/home/products/online-scanner

After re-installing Opera 12 I am testing again. No change.

My advice is to get a desktop. Keyboards are better [there is a choice!], screens bigger [choice again!!] without tearing your arm joints apart. There is always somewhere to leave your mouse. Mouse? Best of all, you can go outside and not feel guilty about leaving your sys behind. It's called freedom.
PITCH - People for Inhumane Treatment of Computer Hardware. Anything else is silly.
Oh. I just remembered pet rocks.

OKay, it looks like a conflict with/inside Opera. It exists still. For example, if I copy my post above and then try to position the cursor inside the word "sometimes", it will only go at the beginning, neither arrows or mouse positionning work correctly. In the original post, it was the word "ignored" and a couple others; they work in the copy.
HMMMMmm.
Everything is fine if I use Firefox.

Sure, Dani.
If I try to correct something I have typed by moving the cursor back to that point then the action will occur one position earlier than indicated by the cursor. At point of typing.. ie the end of the current string of text then the cursor is correct - in that action it appears to be unaffected by anything after a NewLine <CR> character. But there is another effect I am trying to nail down... haven't got it, yet.
Something else... if I use the back arrow [cursor left] key then the first press is ignored, but not if I have already moved it by mouse.. ie that only happens at the end of the typed string. And if I correct the last word in a line then the cursor will sometimes jump into the first word in the next line. And some words will not let me place the cursor inside them at all!!
That is just for starters... the anomalous cursor effect is more involved that I have indicated.
I am using Opera.
Further if I attempt to post something with more than two spaces in succession then code snippet detection occurs.
This is ridiculous... I shall try a restart of my sys.

.

Can a moderator do a blanket removal of posts by daling? They are everywhere.

Lately the cursor positioning has reverted to its earlier bad behaviour where it would float a position ahead of the insertion point. Now it seems to do it only when you go back over your work to correct, insert etc. Pestilential.
I note, too, that multiple spaces in pasted items again cause invocation of the Code Snippet Detection monster. Or something is.
And I am a rare beast... I don't tweet, or stuff about on facebook. That popup is an annoyance, not because I must click to remove it, but because I think I loathe heartily what it represents, and that is people seeming to want to have a say about anything and everything whether their point is germane and interesting or not, and to be noticed. I could go on, but then I'd be blogging. Echh.
What happened to hermits?

Forums. Road rage and drive-by shootings. The aggression is not naked, it's more that the aggressor is cloaked. How little it can take to provoke.
Luv it.

Some more, Tori.
Having done a bit of a search, I have come up with this for a couple of those detections in your first attachment - there are two files which show a status of "Error: File is currently offline - it is currently not available" [that is the complete message...].
Those two have not been quarantined, and you cannot see them, likely they are hidden. Your Avast by default is set to not scan offline files because they may be on a disconnected drive, or a network and scanning would be slow. You have a lappie, and those files should be scannable but an attribute has been set on them to say they are offline. Let's get around that... :), and scan them:
Navigate to DocsnSetts\All Users\Application Data\Avastx. Avast5? Avast7? x may be 5, 7 or some other number, or nothing.
Drag the file Avastx.ini into Notepad.
At the top there is a section [Scanner]. Type or paste this into it..
ScanOfflineFiles=1
...and save the .ini file. Click Yes on the modification warning. [See?, you don't also need M$ to warn you of interference with your AV or firewall].
Now try a quick scan.

Hello, Tori.
Re my comment about not trusting executable files in c: root, you already moved them to the Avast quarantine chest. So now you have no .exe files in C:. Fine. It should be safe to empty that chest.
Re the MBAM detection of SecurityCenter|FirewallDisableNotify being reset... well, some AV products themselves do that, the reason being that they themselves monitor whether they have been interfered with, or an attempt has been made to do so, so there is no reason for XP to report on it also. That setting controls the little popup you will see if you turn off your AV or firewall [it is the M$ Security Centre warning]. Your AV is just resetting that registry value after MBAM changes it. Not a worry.
I see nothing wrong with your system, nothing detected by GMER.
What GMER does show though, and this is completely unrelated to malware, is that your hdd is being consumed by [many empty] R&R [= Rescue and Recovery] folders. You could delete the old ones if you require some more space by going into Safe Mode. I'll leave that up to you.

A note about scanning with Avast. I cannot remember when I last did a scan of any sort; what such a scan does is also check files which are not currently in use. Believe me, when something wants to use any file, executable or data, Avast will scan it before it is loaded. Same with downloads [Avast handles your downloads directly], including website script. Avast marks files it checks as safe, if unchanged next time they are to be loaded then no new scan wil be done, if they have changed in any way they will be rescanned before being loaded

-aswCmnBS.dll is sent often with virus definitions, I don't know its function [guess... to do with bit streaming?], it does change in size. Your Avast is a little different to mine [Avast5], but the file is the same. The 12120500, 12120501 are versions of updates, I don't know why you have two versions showing... 12120501 is current in mine.
Possibly a rescan will not report those files as missing.
-system32\dllcache is where the OS caches vital files, it uses them to automatically replace damaged copies in use in system32. Files in dllcache can be updated by KB downloads [fixes] from Microsoft, a copy will also go to $hf_mig folders so that your system knows what is the latest version to use.
- I think you are safe to restart to finish installing the KB... your system will not start to use the new version of tcpip.sys until you do.
- the remaining files you moved to chest are safe in there. I personally don't much trust any executable files which are in C: root... C:\ ; I think it would be safe to remove them from the chest, delete them. Any software which misses them would let you know.

Foxit.com. Free. Better.

Tori... your pic shows yor sys got whacked.
The series of files showing Error, cannot find... are all part of your Avast. Check they do exist. If those files are missing you might need to uninstall your Avast with http://www.avast.com/uninstall-utility ... and reinstall it.
Tcpip.sys is vital for net communication - it was infected and so moved to chest by you...quarantined. Good move. Because it is a protected file it was likely restored from cache, or you would not be posting. I note that the dllcache file was not infected, so you have a good copy running now.
You are running XP, right? Then you should download KB2509553\SP3QFE from Microsoft because you are missing that from $hf_mig folder.

Would a moderator please kill the two links in the first post?.... the site is viral. Malicious.

Sure. I have no idea what they are there for, but those 6 instances have a GUID of {2A9F2178-EA4A-BD24-5CC8-73B0410FC935} - that would reference a CLSID, and what that would do is anybody's guess. That GUID is not catalogued. Try this: get ShellExView from Nirsoft, the zipped, non-installing version is fine, unzip and run the executable. Look along the display until you find that GUID. Tell what information there is about it.
May be barking up the wrong tree here... :)
http://www.nirsoft.net/utils/shexview.html
Free.
Something else.... note lines 791, 73 in your first post. Those errors pop, I think, because you have too many System Restore points. You need to remove them, create a new one, and limit the space given over to points.

I think you may have a problem with those 6 shell extensions GMER picked up in registry.

This bit in your original post.. "on startup it says pxe-e61 media test failure,pxe-mof exiting pxe rom,thenbootmgr is missing," indicates that your laptop is trying to boot from a network, is probably corporate. No network boot available, so it says boot.mgr missing, and shuts - depending upon the firmware in your sys it may not allow booting from lower options in the order, like an hdd. Remove the network boot option from BIOS, put hdd first, then optical drive. Then, if you wish to reload W7, use the one-time boot selection option.

50 -60 degC. Yes, I noted that. But loggers take readings at set periods... and perhaps a load spike knocked the temp over the limit. With those coolers the fan unit must be above the cpu level, no sags in the tubes for vapour locks, hot line highest at cpu and fan unit.
All fun.

This is where you strip the setup to absolute basics. One mem module, cpu, mb with on-board graphics, and a monitor. Next add a system hdd if it can stay on for a few minutes, try to boot. Add more mem... and so on. Finally, the vid card.

There was no need to put your product key up [a moderator should delete that ,please...].
When you install Windows and enter that above product key a Product ID will be created. You can find that by looking at My Computer properties... it is in the registration information. You don't need it. A hardware identifier is also created from some of your hardware serials, models... this and the above Product ID are used to create a unique Installation ID. That is what is needed to activate by telephone, and when you go through the process of doing that, that Installation ID will be revealed to you.
To activate by internet, you need know none of the above.

I have the feeling that come end of support there will be half a billion XP systems out there, likele feeding pests into the net. Should be interesting.

You might try uninstalling Dragon? for a check, then reinstalling it. If not Dragon, then do a search for Common Software Manager in Program Files and uninstall the parent application.
If disk space is a concern try using Mydefrag to sort the bits out. It uses the Windows defragmentation APIs, but is faster, and does a better job.

Hp bloaters. I think there is some software out there that removes it. Search for it. It took me about 2 hours to clean out a HP Vista machine manually.

Nonstop beeping sounds like a RAM problem?

Am now, tumble. Those entries you skipped are fine, so TDSSKiller found nothing. It didn't even check ATAPORT.SYS.
aswMBR.exe will.
==Download aswMBR from http://www.bleepingcomputer.com/download/aswmbr/
Start it, press Scan [it will download virus definitions from Avast], wait the 3 or 4 minutes until it says Scan completed then press Save Log. Post that, please. Do NOT fix anything at this stage.
An MBR.dat file will appear on your desktop, it is a copy of your MBR. Do not delete it.
Of course, it may be a hdd problem that only appears during intensive disk use by MBAM, and not the fault of the driver...Ulp. You might like to use the manufacture's disk diagnostic software to read its SMART statistics.
Does the bluscreen appear immediatley you start MBAM, or after some scanning has occurred?

That will the result of a rootkit affecting ATAPORT.SYS.
==Download TDSSkiller from this link, save it to your desktop:
http://support.kaspersky.com/downloads/utils/tdsskiller.exe -you may need to download it to a clean computer and then transfer it to the desktop using a USB flash drive.
=Start TDSSKiller, click Change Parameters. Under Additional options check both boxes, Verify Driver Digital Signature and Detect TDLFS file system; click OK.
-click Start scan;
-if TDSSKiller finds a rootkit and prompts a Cure then press Continue [a reboot may be required];
-press Continue also on any Skip prompt for suspicious files. Do not delete or quarantine any files.
Post the log from C:.

I can do nothing about the alzheimer's.

I'm no security expert, very far from it, but I am strongly of the opinion that if you connect an interesting network into the public domain then security is just a dream. Leased lines/pipes are available. If you need to have access over the web, then let it be to some unconnected domain with vetted information available and vetted feedback before any interface.
There's been a whole history of sensitive US networks being hacked. They're just not up to their job. "Instead, the alleged offences are serious and were sustained over a lengthy period. The allegations are in respect of a hacking exercise which took place over fourteen months and involving 96 computers in five US government departments" from the article referenced in a link above. They didn't notice? Or were just incapable of responding technically? Let Gary run free.
I'm not sure that I'd be able to respond sensibly to comparisons with jewellers' shops on Main Street.

I guess they will now...
Sigh....
Ah well. I wuz never gunna rule the world with just that trick.

"Horrible suggestion, empty the recycle bin and they will be deleted and forever lost."
So not true. If you place it in the Recycle Bin, ie copy or move it there, then it is invisible if you open the recycle bin, and cannot be deleted by emptying the bin. You need admin permissions and special folder permissions to place it, and then to see, search or use/delete it.
Try it. An don jus drag it into the desktop icon.... use RECYCLER or $RECYCLE.BIN. No-one looks in those spots. Ever. They open the bin...

Encrypt them. Or place them in the Recycle Bin. No-one ever looks in there. And if they cannot see Protected Op Sys files, they won't see them if they do.
But an Admin's search finds everything.

Because you dropped it while it was running, it might be hardware/software related. From safe mode try running chkdsk, either from a command prompt:
chkdsk /r
or from Local Disk C: properties > Tools, Error checking [tick both boxes] and performn at next start.

He is possibly using a backdoor software installed via a malicious email attachment. Whatever, you should scan for such malwares and remove them. For starters, try:
Download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].

Wendy, I think explorer grows old along with an aged installation, accumulating little niggles and aches. It so happens that those radio buttons do absolutely nothing for my explorer; luckily it's running atm how I like it.
Ol folks often live in unkempt houses.

What version IE do you have installed?
The reason I posted that, Sarah, is because the navigation buttons are used by many Windows components, as well as browsers. Without checking, I believe they form some part of an IE dll, and as such are likely used by third party browsers. You might try removing all IE addons.

What version IE do you have installed?

Sounds like W7 has not found your network adapter. In Device Manager (Start, Run devmgmt.msc) click Scan for Hardware Changes button, then try to install the Intel driver.

And then of course there is the registry...
Secret squirrels use FF or Opera and their private browsing sessions.