>> When was OneCare installed, before this problem started or after?<<
After. School policy prohibits any 3rd party anti-virus or firewall program
except the provided Norton AV Corp edition, which had been fully disabled by
the virus. The Live OneCare scan at installation was clean, but the problems
with security web site access and anti-virus program startup or installation
persisted.
I was able to complete a full MSRT scan which came up clean. I was also able
to run the Onecare HowSafe scan which also came up clean: "no viruses or
spyware found" & "0 ports open" for results. Following these results, I tried
to again install SuperAntiSpyware and HijackThis from a CD, with the same
error results described in the previous post.
>> You may have to use an uninfected machine to download your tools (but not SAS, I'm afraid) then transfer them (e.g., hijackthis.exe) to the infected machine via, e.g., a USB key.<<
I am not sure what you mean here. I have downloaded the .exe files to CD
from another computer and try to run them on the infected machine. The MSRT
file ran fine. HowSafe I could access directly via the web link. Most
security related web sites, however, will not load. Most security related
program installations also fail.
With my results, I am guessing she still has a virus that is fully masked,
or we eliminated the virus but not the protection layer the virus employed.
Is there a registry file I can access to see why some web addresses are
directed to 207.0.0.1 before failing to load, while other no-security related
web sites load fine?
Thanks for all your help ...
"PA Bear [MS MVP]" wrote:
> > ...she has Live OneCare installed on her computer and it
> > appears to be up to date.
>
> When was OneCare installed, before this problem started or after?
>
> > ...Wouldn't the MSRT be part of the normal Live
> > OneCare Virus scan?
>
> Apples & oranges: MSRT scans for a very limited number of known-hijackers;
> OneCare's scans are more robust.
>
> > ...Any time I try to install SuperAntiSpyware or HijackThis, I get
> > an error message...
>
> Another symptom of the hijackware infection, I'm afraid. You may have to
> use an uninfected machine to download your tools (but not SAS, I'm afraid)
> then transfer them (e.g., hijackthis.exe) to the infected machine via, e.g.,
> a USB key.
>
>
> Bandit292 wrote:
> > The MSRT is now running a full scan on her computer. I will let you know
> > the
> > results. Until then, she has Live OneCare installed on her computer and it
> > appears to be up to date. Wouldn't the MSRT be part of the normal Live
> > OneCare Virus scan?
> >
> > I have not yet tried the online scan, but HijackThis will not install (see
> > other post). Any time I try to install SuperAntiSpyware or HijackThis, I
> > get
> > an error message with a send error report option. I thought it might do
> > the
> > same thing with MSRT, but so far so good.
> >
> > "PA Bear [MS MVP]" wrote:
> >> You have much more work to do.
> >>
> >> 1. See if you can download/run the MSRT manually:
> >> http://www.microsoft.com/security/ma...e/default.mspx
> >>
> >> 2. Run this online scan (in safe mode w/networking, if need be):
> >> http://onecare.live.com/site/en-us/center/howsafe.htm
> >>
> >> 3. Run additional checks for hijackware, including posting your
> >> hijackthis
> >> log to an appropriate forum.
> >>
> >> Checking for/Help with Hijackware
> >> http://aumha.org/a/parasite.htm
> >> http://aumha.org/a/quickfix.htm
> >> http://aumha.net/viewtopic.php?t=5878
> >> http://mvps.org/winhelp2002/unwanted.htm
> >> http://inetexplorer.mvps.org/data/prevention.htm
> >> http://inetexplorer.mvps.org/tshoot.html
> >> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> >> http://defendingyourmachine2.blogspot.com/
> >> http://www.elephantboycomputers.com/...moving_Malware
> >>
> >> When all else fails, HijackThis v2.0.2
> >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
> >> (in conjuction with some other utilities). HijackThis will NOT fix
> >> anything on its own, but it will help you to both identify and remove any
> >> hijackware/spyware with assistance from an expert. **Post your log to
> >> http://spywarehammer.com/simplemachi...php?board=10.0,
> >> http://forums.spybot.info/forumdisplay.php?f=22,
> >> http://aumha.net/viewforum.php?f=30, or another appropriate forum for
> >> review by an expert in such matters, not here.**
> >>
> >> If the procedures look too complex - and there is no shame in admitting
> >> this isn't your cup of tea - take the machine to a local, reputable and
> >> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> >> =====================
> >> Start a free Windows Update support incident request:
> >> https://support.microsoft.com/oas/de...spx?gprid=6527
> >>
> >> Support for Windows Update:
> >> http://support.microsoft.com/gp/wusupport
> >>
> >> For home users, no-charge support is available by calling 1-866-PCSAFETY
> >> in
> >> the United States and in Canada or by contacting your local Microsoft
> >> subsidiary. There is no-charge for support calls that are associated
> >> with
> >> security updates.
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >> AumHa VSOP & Admin http://aumha.net
> >> DTS-L http://dts-l.net/
> >>
> >>
> >> Bandit292 wrote:
> >>> I just cleaned out several virus & keyloggers from my daughter's
> >>> computer
> >>> and can no longer access the Microsoft Update or Windows Update pages.
> >>> She
> >>> runs WinXP. One of the viruses was blocking anti-virus software and
> >>> disabling the firewall on her computer, and may have also been
> >>> redirecting
> >>> access to Win/MS Update by pointing to another site. Is there a registry
> >>> setting I can set to regain access to the Win/MS Update sites? Other web
> >>> sites load normally.
> >>>
> >>> Thanks,
> >>> Bandit292
>
>