[beenthere7659]

Came across this at WXPNEWS-- Could it be pertinent to my situation?
***
News, Hints, Tips and Tricks

The XP SP3 vicious reboot cycle

SP3 is finally out, but some folks are reporting that after installing it on some computers, the system goes into continuous reboot mode. This happens because something in SP3 (on some hardware configurations) causes the computer to crash during the boot process and the OS is set to automatically reboot after a crash. This recently happened to Jesper Johansson, a fellow Enterprise Security MVP, and his blog contains an excellent discussion of what the problem (s) might be and what to do about it:
http://www.wxpnews.com/Q7QJE3/080513-SP3-Reboot


Warning: you can't roll back to IE 6 after installing SP3

If you're running IE7 on your XP computer and you install Service Pack 3, it appears you won't be able to go back to IE6 afterward. At least that's the word from Jane Maliouta on the MSDN web site. Same thing applies if you've installed a beta of IE8 - there'll be no going back to IE7 after installing the service pack. So if you want to roll back your browser, you need to do it before installation of SP3. Read more here:
http://www.wxpnews.com/Q7QJE3/080513-Rollback-Browser


Office 2007 SP1 coming to automatic update near you

Service Pack 1 for Office 2007 has been available for download for months, but if you don't want to install it for some reason, be aware that it's to be released to Automatic Update in June, so you'll need to take steps to prevent it from being installed automatically (such as setting your computer to download updates but not install them until you give permission).
http://www.wxpnews.com/Q7QJE3/080513-Office-2007-SP1

To download SP1 now, go to
http://www.wxpnews.com/Q7QJE3/080513...7-SP1-Download


XP SP3 Support Site

Microsoft is providing unlimited installation and compatibility support for XP SP3, valid until April 2009. You can get support via email, live chat or telephone. To find out more, see the support web site at http://support.microsoft.com/oas/def...id=11273&gprid

[beenthere7659]

Rog--

I'm ready to follow your instructions - but - I'm too uninformed to come up with an application to install. I have concluded that I want to wait on installing SP3 until the dust settles. I was previously unable to uninstall IE7 and go back to IE6 so those are out. I'm looking for a suggestion of some sort of harmless program to use for this test. It appears that any program will not install so anything should be useful for this, but I'm to uninformed to know what is available.
May I have a suggestion please?

[Rollin' Rog]

Go ahead and follow the instructions anyway.

Then try to install the pending "office" updates from Windows Update.

Or download one manually (probably best), such as this if you don't have it >>

http://www.microsoft.com/downloads/d...displaylang=en

[beenthere7659]

My delay in responding--

I successfully installed MS Office Accounting 2008 SP1 KB949426
Plus two additional reccomended downloads.
I do not intend to download SP# for a while until others are recommending it.
Then--
The MSN Live that had been popping up in the tray successfully downloaded and installed. Finally-- The popup Installer error that plagued Outlook has not appeared in two days.

I don't know what was accomplished, but the problems appear to have left my computer. You and CookieGal may as well take credit for it!

My last Question--
Given all that, am I safe in deinstalling the tools you two have had me put on my Desktop:
Hijackthis
Easy Spy Remover
Smitfraud
mbam-setup.exe
Malwarebytes' Anti-malware
Combofix
SetupAPI

Thank you both for your patience and instruction.
Beenthere7659

[Rollin' Rog]

That's great -- what was the last "fix" or attempt at resolution you ran -- just so we might have some clue as to what might have worked?

I'll let Cookiegal have the final word -- but there is nothing I have had you install that you need to keep.

HijackThis is always good to have around -- but i wouldn't keep it on the desktop if that's where you are running it from.

[Cookiegal]

I'm glad to hear you guys got this sorted out.

I certainly didn't have you install Easy Spy Remover as that's a rogue program so definitely remove it from your desktop.


Please post a new HijackThis log so I can be sure all is well.

[beenthere7659]

Came across this at WXPNews---
Sounds a lot like my problem WAS. Haven't replied until now to see that all appears to be running properly. I have "Easy Spy remover.exe on my desk top but it is NOT listed in my add/remove list. I'll run hijack this and send in the next message-------------


QUESTION:
I use IE7 on my XP Pro machine. Recently something went wrong with the program and tabbed browsing does not work. If I try to open a second tab, it says "Connecting ...", and there it stops. Explorer won't close. I tried to uninstall IE7, but there is no such option. What should I do? - Jaco T.

ANSWER:
This seems to be a common problem and usually the cause is an IE add-on. But first, make sure you aren't running XP in classic mode. If you're running XP Pro, it's possible (although unlikely if you haven't been editing Group Policy) that a policy is forcing Windows to run in Classic view. To check that, run gpedit.msc to open the Group Policy Editor (note that this does not work in XP Home). Navigate to User Configuration | Administrative Templates | Windows Components | Windows Explorer | Force Classical View. Ensure that this policy is disabled.

Next we'll consider that an add-on may be doing it. Not all add-ons have this effect, but computer users have reported that it happens with some of them. The first thing I would do is go to Tools | Manage Add-ons and select Enable or Disable Add-ons. This will show you a list of all the add-ons that are loaded in IE. You may be surprised at how many there are. You can click the name of an add-on and click the option button to disable it, without uninstalling it. This will let you test, one at a time, to see if it's an add-on that's causing your problem.

If that's not the culprit, you might have a damaged IE installation. There are two files that need to be in the System 32 folder: xmllite.dll and ieui.dll. If these are missing, you need to restore them. You can down an update package for xmllite at
http://www.wxpnews.com/Q7QJE3/080603...abbed-Browsing

If all else fails, you should be able uninstall IE 7 (so you can reinstall it) by using the Add or Remove Programs applet in Control Panel or by running Spuninst.exe. For more info on how to use both methods, see KB article 927177 at
http://www.wxpnews.com/Q7QJE3/080603-Re-install-IE7

[beenthere7659]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:30:31 PM, on 6/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wfxsnt40.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Express ClickYes\ClickYes.exe
C:\Program Files\My Book\WD Backup\uBBMonitor.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\ACT\act.exe
C:\PROGRA~1\MICROS~4\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\internet explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.techguy.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Express ClickYes] C:\Program Files\Express ClickYes\ClickYes.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Controller.LNK = C:\Program Files\Symantec\WinFax\WFXCTL32.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WD Backup Monitor.lnk = C:\Program Files\My Book\WD Backup\uBBMonitor.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.02.0000.1007\en-us\bin\WindowsSearch.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/def...x.1.0.0.67.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1135186932531
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1121183721218
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = workgroup
O17 - HKLM\Software\..\Telephony: DomainName = workgroup
O17 - HKLM\System\CCS\Services\Tcpip\..\{C14FE8EC-0A4B-454C-8108-C949F9DD1E46}: Domain = gilmores
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = workgroup
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gilmores,belkin
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = workgroup
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gilmores,belkin
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gilmores,belkin
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE

--
End of file - 9996 bytes

[Cookiegal]

I trust you've removed EasySpy Remover from your desktop.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 6.
• Scroll down to where it says Java Runtime Environment (JRE) 6 Update 6. The Java SE Runtime Environment (JRE) allows end-users to run Java applications (the fifth one in the list).
• Click the "Download" button to the right. A new page will open.
• Select your platform and check the box that says: I agree to the Java SE Runtime Environment 6 License Agreement.
• Click Continue.
• Click on the link under Windows Offline Installation (jre-6u6-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager.
• Go to Start - Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Close any programs you may have running - especially your web browser.
• Then from your desktop double-click on the download to install the newest version.

Here are some final instructions for you.

The following program will remove the tools we've used and their associated files and backups and then it will delete itself.

Please download OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Make sure you have an Internet Connection.
• Double-click OTMoveIt.exe to run it. (Vista users, please right-click on OTMoveIt2.exe and select "Run as an Administrator")
• Click on the CleanUp! button
• A list of tool components used in the cleanup of malware will be downloaded.
• If your firewall or real-time protection attempts to block OTMoveIt2 to reach the Internet, please allow the application to do so.
• Click Yes to begin the cleanup process and remove these components, including this application which will delete itself.
• You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on My Computer and click on Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on Start – All Programs – Accessories – System Tools and then select System Restore.

In the System Restore wizard, select Create a restore point and click the Next button.

Type a name for your new restore point then click on Create.


I also recommend downloading SPYWAREBLASTER for added protection.

Read here for info on how to tighten your security.


Delete Temporary Files:

Go to Start - Run and type in cleanmgr and click OK.
Let it scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
Press OK to remove them.

[beenthere7659]

You wrote, "I trust you've removed EasySpy Remover from your desktop." I have not. It shows, "Eastspyremover_setup.exe" on my desktop, but I found no such program in my ContolPanel Add/Remove list. I searhed for the file and the only listing is on my desktop. It is not listed as a "short cut". Will I be rid of it by just deleting the desktop icon? -- Or going to the search results and deleting the file listed there?

[beenthere7659]

Firewall query-- I have a 2-station LAN. Previous techies (a year ago) recommended not using a firewall because it often hampers communications. I have purchased and installed AVG and that install program encouraged me strongly to install their firewall. I did not. What is your suggestion and comment please.

[Cookiegal]

You already uninstalled it via Add/Remove programs early on in this thread. Drag the file from your desktop to the recycle bin and then delete this folder if it still exists:

C:\Program Files\Easy SpyRemover

Then empty the recycle bin.

[Cookiegal]

If you're using a router then you would be fine with just the XP firewall which should not interfere. Otherwise, you should have a third party firewall. If configured properly a firewall should not be a problem.

[beenthere7659]

"Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on Start – All Programs – Accessories – System Tools and then select System Restore.

In the System Restore wizard, select Create a restore point and click the Next button.

Type a name for your new restore point then click on Create."

All went well. System restore shows "off" after reboot.
--BUT --
I can find no "Start – All Programs – Accessories – System Tools " to click?

[Cookiegal]

You don't have a Start menu?