TechSpot

Possible rootkit and others?

Solved
By DO6470
Dec 9, 2012
  1. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    Same error. [Error number: 0x80244019] When I google it I get responses saying that XP service pack 3 is no longer available through that link. Perhaps there is another link I can try?
     
  2. Broni

    Broni Malware Annihilator Posts: 47,630   +267

  3. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    That worked.
    Still have the script error on Outlook
    Most shortcuts still not working

    Here is the latest FSS log:

    Farbar Service Scanner Version: 10-12-2012 Ran by dolsen (administrator) on 12-12-2012 at 00:33:42 Running from "C:\Documents and Settings\dolsen\Desktop" Microsoft Windows XP Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=DWORD:0 System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ wscsvc Service is not running. Checking service configuration: The start type of wscsvc service is OK. The ImagePath of wscsvc service is OK. The ServiceDll of wscsvc service is OK. Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit C:\WINDOWS\system32\netman.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\srsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit C:\WINDOWS\system32\wscsvc.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\wuauserv.dll => MD5 is legit C:\WINDOWS\system32\qmgr.dll => MD5 is legit C:\WINDOWS\system32\es.dll => MD5 is legit C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= Gpc(6) IPSec(4) NetBT(5) PSched(7) SbFw(9) SBFWIMCLMP(10) SbTis(11) SYMTDI(8) Tcpip(3) Tcpip6(12) 0x0C00000004000000010000000200000003000000080000000900000006000000070000000B0000000A000000050000000C000000 IpSec Tag value is correct. **** End of log ****
     
  4. Broni

    Broni Malware Annihilator Posts: 47,630   +267

    Are we talking about Outlook or Outlook Express?

    Which shortcuts? Desktop shortcuts?

    Can you access and run Windows updates now?
     
  5. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    Microsoft Office Outlook 2003
    Desktop Shortcuts and task bar short cuts
    IE and Outlook shortcuts seem to work but no others

    Windows is updating now
     
  6. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    261 MB of updates !

    Should I install them all?
     
  7. Broni

    Broni Malware Annihilator Posts: 47,630   +267

    Yes, you have to install all updates. Always.

    You may need to reinstall Office.

    As for shortcuts you may need to create new ones.
     
  8. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

  9. Broni

    Broni Malware Annihilator Posts: 47,630   +267

    You can give it a shot but if it doesn't work reinstalling Office would be the fastest fix.
     
  10. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    Updates complete.

    Received the following error:

    EventType : visualstudio7x80update P1 : msiexec.exe P2 : 1.0.1705.5046
    P3 : kb2656370 P4 : 1033 P5 : 643 P6 : f P7 : install
    P8 : x86 P9 : 5.1.2600.2.3.0.256 P10 : 0

    This error report includes: information regarding the condition of NDP1.1sp1-KB2656370-X86 when
    the problem occured, the operating system version and computer hardware in use, and the Internet Protocol (IP) address of your computer.


    Should I run any other checks before attempting to fix Outlook?

    On the start/ all programs tab, pretty much none of the shortcuts work either as well as the destop ones.
    Tried recreating a couple on the desktop and they do not work.

    Thanks again for your help.
     
  11. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    The updates that would not install are as follows:

    Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656370)
    Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2698023)
     
     
  12. Broni

    Broni Malware Annihilator Posts: 47,630   +267

  13. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    Shortcuts Fixed!

    When trying to either update it says it cannot find the folder containing the installation package netfx.msi.
    I did an entire search on the drive and could not find that file.
    Seems like Im missing some sort of installation package for Microdoft.NET framework.
     
  14. Broni

    Broni Malware Annihilator Posts: 47,630   +267

    Let's try cleaning up your .NET framework...

    Download, unzip, and run the dotnetfx_cleanup_tool. It will remove the .NET framework from your computer so that we can reinstall it later.

    After running this cleanup tool, it should ask you to reboot. Please do so.

    Next, download and install dotnetfx35.exe. This will reinstall the .NET framework onto your computer. Note: this is a large file, and could take some time to download depending on the speed of your internet connection.

    After another reboot, download and install dotnetfx35setup.exe. This will update the .NET framework to version 3 SP1.

    If you need any more updates for the .NET framework, Windows Update should find it for you (assuming updates are set to automatically download and install).
     
  15. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    All updates complete.
     
  16. DO6470

    DO6470 TS Rookie Topic Starter Posts: 24

    Does it make sense for me to go back and update Java and Adobe now?
     
  17. Broni

    Broni Malware Annihilator Posts: 47,630   +267

    By all means.

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [emptyjava]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Check if your browser plugins are up to date.
    Firefox - https://www.mozilla.org/en-US/plugincheck/
    other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    8. Run Temporary File Cleaner (TFC) weekly.

    9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    11. (Windows XP only) Run defrag at your convenience.

    12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    13. Read:
    How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
    Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

    14. Please, let me know, how your computer is doing.
     
  18. Broni

    Broni Malware Annihilator Posts: 47,630   +267

    The issue seems to be resolved.
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.