Can Anyone Help Please?

Sagz_2

OH's son was using pc yesterday for MSN and various music websites and all was well...... OH went to use PC later yesterday evening and it's kaput! Avast is missing from stystem tray and won't run from programme list.
The firewall is turned off and can't be turned on
Can't get an internet connection although my pc is connected to same router and all is working.
System restore won't work.

Any ideas at all please?

and MERRY CHRISTMAS EVERYONE XXX

sunshine54

why wont restore work? Have you tried it in safe mode

Sagz_2

Restore looks like it's working but after the restart it says 'unable to complete system restore'. (have tried 3 different restore points)

Not tried in safe mode - will do so now.
thanks Sunshine x

Sagz_2

In safe mode went to start system restore and it says' system restore does not appear to be functioning on on this system. The volume shadow copy service used by sytem restore is nto working. for more info view the event log (0x81000202).

Any ideas please?

sunshine54

download some malaware scan software on your working pc, and run it to do a scan on the dodgy one. See if it finds anything. kids may have picked up something on msn. if this don't work
then reboot and tap F8 to enter safe mode.
disable firewalls and any antivirus (make sure it cant connect to the internet first) then try restore again.
if it works put security back on

aliEnRIK

Download MALWAREBYTEs to YOUR computer
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

and HIJACK THIS
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

Burn the setup files to a cd (Or put on a USB flash drive)

Transfer and install onto your sons computer

UPDATE and SCAN with malwarebytes
Post the log here AFTER youve deleted everything it finds (probably !!!!!! )
(Split into sections if need be (And im guessing you will need to))

Reboot
Scan with HIJACK THIS and post the log here

Sagz_2

Paul_R wrote: »

This will continually happen with young people using the home PC, it should not be a surprise. My best advice is to either stop them using the PC (either hanging or 2 x arm aputations?) or buy a PC just for you, theirs will pack in at least once a week, but you can carry on surfing.

Make sure yours has a removable hard drive, remove it at any time you are not there.

Thanks but as this was a one-off event I feel double amputation is a little harsh, what with it being the season of goodwill and all that!

Sagz_2

Tried transfering Malwarebytes earlier but it wouldn't run on the duff pc.

Will try running it in safe mode - thanks again sunshine xx and thanks aliEnRIK xx

aliEnRIK

If nothing works in 'safe mode with networking'
Then get the TASK MANAGER up in normal boot up mode and try to figure out which is the nasty thats running and END PROCESS
Then tru to install and run Malwarebytes

Sagz_2

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:26:22, on 25/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Safe mode
Running processes:
C:\Windows\Explorer.EXE
J:\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - !!06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - !!3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - !!761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - !!7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - !!5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?')
O4 - HKUS\S-1-5-21-2549295106-3368410719-3391052604-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O9 - Extra button: Send to OneNote - !!2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - !!2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - !!92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Broken Internet access because of LSP chain gap (#1 in chain of 26 missing)
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.sparkpea.net/controls/msnchat45.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
--
End of file - 3471 bytes

aliEnRIK

That log files missing a ton of stuff
Can you not run it off C drive?

All the same ~ FIX these ~
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - !!7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)