Problems. Back up and wipe clean?

chancesare_2

I am having problems with my PC and feel it is time to give it a deep clean. Having never done it before, although I use CCleaner, I would like a bit of guidance if someone has the time.

I am in the process of doing a Windows (XP) backup. I have left the settings as all checked, so does that mean that my emails will be in tact?

Once done, how do I actually do the clean up. I have the Mesh Computers Recover CD rom for XP home.

Thanks in advance.

closed

Something like this might be easier to restore from

http://www.runtime.org/shadow-copy.htm

and/or create a disk image in case something goes wrong - using maxblast/macrium reflect free

alternatively, post a hijackthis log and details of the problem

chancesare_2

closed wrote: »

Something like this might be easier to restore from

http://www.runtime.org/shadow-copy.htm

and/or create a disk image in case something goes wrong - using maxblast/macrium reflect free

alternatively, post a hijackthis log and details of the problem

It is still backing up!

closed

what to, usb hard disk?

what is the problem with it?

chancesare_2

Firstly, I don't know why I said XP above, I meant VISTA, my other PC is XP! Sometimes when I turn the PC on it stops and tells me that windows cannot open and then that windows cannot repair. It asks me to restore and then just gives up. I turn it off and back on and it's fine. I cannot install the latest Itunes as I get an installer error message. I am sorry the text of the errors is not exactly as it is, but I haven't taken notes of them, but will if it helps.

I backed up (windows backup thingy) to my USB Seagate. It took about 6 hours!

Ive just done my Hijack this....


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:18:27, on 10/05/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Users\Home\AppData\Local\Google\Update\1.3.21.53\GoogleCrashHandler.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.orange.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.orange.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Packing Partner IE Interface - {5C802AD0-165B-11DB-86C3-0060080C38C1} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Home\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Collect Sales Records - res://C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll/HTML/PRINT.HTML
O8 - Extra context menu item: Queue Sales Records - res://C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll/HTML/QUEUE.HTML
O8 - Extra context menu item: Update Sales Records - res://C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll/HTML/UPDATE.HTML
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Queue Sales Records - {5ABDF6B0-336E-41e8-ADF2-76629F963BD6} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O9 - Extra 'Tools' menuitem: Queue Sales Records - {5ABDF6B0-336E-41e8-ADF2-76629F963BD6} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O9 - Extra button: Collect Sales Records - {5ABDF6B0-336E-41e8-ADF2-76629F963BD7} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O9 - Extra 'Tools' menuitem: Collect Sales Records - {5ABDF6B0-336E-41e8-ADF2-76629F963BD7} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O9 - Extra button: Update Sales Records - {5ABDF6B0-336E-41e8-ADF2-76629F963BD8} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O9 - Extra 'Tools' menuitem: Update Sales Records - {5ABDF6B0-336E-41e8-ADF2-76629F963BD8} - C:\Users\Home\AppData\Local\Packing Partner\Interface\lpiface.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O13 - Gopher Prefix:
O16 - DPF: {0A43D7AC-D6C1-4622-B309-BF975F427C0E} (first direct internet banking plus digital safe) - https://internetbankingplus1.firstdirect.com/ibplus/frontdoorFD.cab
O16 - DPF: {0CFA086E-6336-4D95-B6AA-90F564E99631} (TNSClicker.Clicker) - http://www.shopandscan.com/TNSClicker.CAB
O16 - DPF: {1819853F-A3CA-4BC4-AD65-EC29D7448494} (CBPLauncher Class) - http://centrebet.com/external/cust_static/activex/centrebetpokerlauncher.cab
O16 - DPF: {76392179-60A8-462D-8961-B95C14DAADF4} (PrintEngine ActiveX Control v4.2) - https://billcentre.vodafone.co.uk/bpa/content/ddiprintengine.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://canbet.microgaming.com/canbet/FlashAX.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EBB176D2-AF75-4706-832F-4C8448F72757} (TNSClickerc.Clicker) - http://www.shopandscan.com/TNSClickrc.CAB
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://canbet.microgaming.com/canbet/FlashAX2.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
--
End of file - 8820 bytes

clinteestwood

If you want to do a proper clean and you have backed up all you important information then just do a full clean reinstall. at least this way you know absolutely that there are no viruses at all and the comp has a fresh install and should be nice and quick. Also, it may also be quicker than doin a full scan using a number of different programmes

Linbox

macrium reflect free amazing for back up and restore takes over from norton/semantic ghost.
As you have been pointed to wipe your drive and start again, goggle download hiren - worth its weight as they say. Reinstall from scratch then update everything, install drivers etc. Don't install anything that you regularly update then make a backup. Down load the latest progs and install after the backup. Anything fail again you'll have a system up and running within an hour.

closed

as you have a seagate drive you can use maxblast (free from seagate website) to do a full disk image as well as a shadow copy assuming you have enough disk space, then use the factory restore partition to reinstall vista and copy your data back from the shadow copy.

if anything goes wrong, you have the disk image to recover the whole system back to the way it was.

really important data, copy to dvd as well

packing partner software?

chancesare_2

Thanks all.

Packing partner software is used for my Amazon and website, to collect names address etc and generate them into postage labels.

So, if I use the Maxblast, that will basically return everything back the way it was? Or will it bin the rubbish that is causing the problems and put my files back where they were? Sorry, am not aufait with the ins and outs!

closed

no maxblast is disk imagining (ie backup) software, which should enable you to restore the system as it is now, if your reinstall goes wrong

chancesare_2

Thanks.

So, I did that huge backup last night with Windows, but I do this Maxblast bit now and then go for the full reinstall with my Mesh CD? Just want to check I have it right.