This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

XP Defender has corrupted computer. HELP!

38 min read

This thread's last reply is from May 2, 2010, 7:38 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

I need to have my son-in-law turn off the router and re-set it. He's been out of town but is back. They have a wireless house alarm system that is run by the computer and I don't want to trip the alarm. As soon as I get him to follow your instructions (this evening) I will complete the steps and re-post.

Thanks in advance!
O.K. I followed all instructions. Reset the router, etc., but still cannot access the internet. I tried several times and kept getting a message saying it was connecting, then another message would flash at the bottom quickly that said something about an "I.E. frame error". There was more to the message but it disappeared from the task bar too quickly to copy. So I re-set the default settings for internet (tools, internet, advanced, security, etc.) but it didn't help. I checked the WAN network and LAN network and nothing showed up as a problem. Next I tried to run ComboFix. The machine doesn't have the recovery console so I couldn't install it but the program said it would run anyway and might take twice as long as the normal 10 minutes if it was heavily infected. About 3-4 minutes into the program the computer rebooted itself and re-started McAfee. I tried ComboFix a second time and it did the same thing. The computer also seems to hang on almost all programs. When trying to access the internet it will show the page that says the connection could not be completed but when I try to close the window the machine just sits there. Same thing with most other programs. By the time I click on task manager and the screen comes up the machine seems to clear itself.
Did Combofix produce any logs? If so please post them on your next reply along with a new HJT log.

You can find the logs under c:/ Combofix

Do you have the disks for this machine?
There were no logs as ComboFix didn't complete the cycle. I tried twice.

It is a Dell machine, about 5 years old, so I'm not sure about the disks. I will ask my daughter. As a last resort there is an IT department where I work and they've offered to wipe it clean and reload Windows and the other software if necessary.
It is a Dell machine, about 5 years old, so I'm not sure about the disks. I will ask my daughter. As a last resort there is an IT department where I work and they've offered to wipe it clean and reload Windows and the other software if necessary.

If it is 5 years old and never had a fresh install, well let’s just say that is not such a bad idea. It is amazing how much junk accumulates over the years.

In the meantime let’s look at something else.

1. Download and Run ATF Cleaner
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
Make sure that all browser windows are closed.
    Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.
    (If you use FireFox or the Opera browser,To keep saved passwords, click No at the prompt.)
    Click Exit on the Main menu to close the program.


2. GMER Rootkit Scanner
Download GMER Rootkit Scanner from here.
  • Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO


    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
  • Save it where you can easily find it, such as your desktop, and post it in reply
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries


3. Re run RSIT only one log will be produced this time, post on your next reply.

Please reply with:-
  • RSIT log
  • GMER Log
a lack of response,