Solved Possible rootkit and others?

[DO6470]

Same error. [Error number: 0x80244019] When I google it I get responses saying that XP service pack 3 is no longer available through that link. Perhaps there is another link I can try?

 

[Broni]

Try to download standalone SP 3 file: http://www.microsoft.com/en-us/download/details.aspx?id=24 and see if it'll install.

 

[DO6470]

That worked.
Still have the script error on Outlook
Most shortcuts still not working

Here is the latest FSS log:

Farbar Service Scanner Version: 10-12-2012 Ran by dolsen (administrator) on 12-12-2012 at 00:33:42 Running from "C:\Documents and Settings\dolsen\Desktop" Microsoft Windows XP Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=DWORD:0 System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ wscsvc Service is not running. Checking service configuration: The start type of wscsvc service is OK. The ImagePath of wscsvc service is OK. The ServiceDll of wscsvc service is OK. Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit C:\WINDOWS\system32\netman.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\srsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit C:\WINDOWS\system32\wscsvc.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\wuauserv.dll => MD5 is legit C:\WINDOWS\system32\qmgr.dll => MD5 is legit C:\WINDOWS\system32\es.dll => MD5 is legit C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= Gpc(6) IPSec(4) NetBT(5) PSched(7) SbFw(9) SBFWIMCLMP(10) SbTis(11) SYMTDI(8) Tcpip(3) Tcpip6(12) 0x0C00000004000000010000000200000003000000080000000900000006000000070000000B0000000A000000050000000C000000 IpSec Tag value is correct. **** End of log ****

 

[Broni]

Are we talking about Outlook or Outlook Express?

Which shortcuts? Desktop shortcuts?

Can you access and run Windows updates now?

 

[DO6470]

Microsoft Office Outlook 2003
Desktop Shortcuts and task bar short cuts
IE and Outlook shortcuts seem to work but no others

Windows is updating now

 

[DO6470]

261 MB of updates !

Should I install them all?

 

[Broni]

Yes, you have to install all updates. Always.

You may need to reinstall Office.

As for shortcuts you may need to create new ones.

 

[DO6470]

Going ahead with updates.

What do you think about this on the Outlook problem

http://support.microsoft.com/?id=329930

 

[Broni]

You can give it a shot but if it doesn't work reinstalling Office would be the fastest fix.

 

[DO6470]

Updates complete.

Received the following error:

EventType : visualstudio7x80update P1 : msiexec.exe P2 : 1.0.1705.5046
P3 : kb2656370 P4 : 1033 P5 : 643 P6 : f P7 : install
P8 : x86 P9 : 5.1.2600.2.3.0.256 P10 : 0

This error report includes: information regarding the condition of NDP1.1sp1-KB2656370-X86 when
the problem occured, the operating system version and computer hardware in use, and the Internet Protocol (IP) address of your computer.


Should I run any other checks before attempting to fix Outlook?

On the start/ all programs tab, pretty much none of the shortcuts work either as well as the destop ones.
Tried recreating a couple on the desktop and they do not work.

Thanks again for your help.

 

[DO6470]

The updates that would not install are as follows:

Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656370)
Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2698023)

 

[Broni]

Received the following error:

When?

As for shortcuts....
Re-run Windows Repair tool (my reply #19) but in "Step 4" additionally checkmark following items:
- Repair icons
- Repair.lnk (Shortcuts) File Association

As for those two updates download and install them manually:
http://www.microsoft.com/en-us/download/details.aspx?id=29364
http://www.microsoft.com/en-us/download/details.aspx?id=35705

 

[DO6470]

Shortcuts Fixed!

When trying to either update it says it cannot find the folder containing the installation package netfx.msi.
I did an entire search on the drive and could not find that file.
Seems like Im missing some sort of installation package for Microdoft.NET framework.

 

[Broni]

Let's try cleaning up your .NET framework...

Download, unzip, and run the dotnetfx_cleanup_tool. It will remove the .NET framework from your computer so that we can reinstall it later.

After running this cleanup tool, it should ask you to reboot. Please do so.

Next, download and install dotnetfx35.exe. This will reinstall the .NET framework onto your computer. Note: this is a large file, and could take some time to download depending on the speed of your internet connection.

After another reboot, download and install dotnetfx35setup.exe. This will update the .NET framework to version 3 SP1.

If you need any more updates for the .NET framework, Windows Update should find it for you (assuming updates are set to automatically download and install).

 

[DO6470]

All updates complete.

 

[DO6470]

Does it make sense for me to go back and update Java and Adobe now?

 

[Broni]

By all means.

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

14. Please, let me know, how your computer is doing.

 

[Broni]

The issue seems to be resolved.