Solved email address in system restore folder

[macx]

XP Home, sp3

Not sure if I have some kind of virus or malware or what, but something's way wrong.

It seemed to start when I added 2gb of RAM, and at the same time my Firefox was upgraded automatically, altho I had just upgraded it a couple days previous.

Everything would appear to be working normally during boot up until it got past the Windows screen. Then instead of a short pause before the home page would show, all I'd get is a black screen. A couple of times I let it run a long time and after more than a minute, the home screen would finally come up and then things worked OK.

I tried starting in Safe Mode, but F8 had no effect. I tried F10 Setup, but couldn't
see anything that appeared wrong, not that I know what it all means. But at least
the boot drive sequence was correct. A couple times it went from that to a normal
boot and startup, but now it doesn't do that any more either.

The last time I got it to start up completely, I went into System Restore and went
back to a time before I installed the additional RAM and before that automatic Firefox update happened.

System Restore informed me it had changed the name of a couple of files -
actually all within a folder. And it was within Windows. That's what made me
suspicious.

The name of the folder was an email address and within it were several files that had what appeared to be some kind of program or application files, sure weren't emails!

I pulled them out of Windows folder and temp moved them to the desktop.
Also during that session, my Avira free quit working - I could open the app but the protection had been inactivated and clicking on Restart Protection didn't do anything.

I then tried to uninstall it with the thought of downloading and installing a fresh version, but it shut down and now won't start no matter what I try. Same thing -
goes past the Windows screen OK but then stalls at a black screen instead of completing Windows startup.

Anybody any idea what's going on? And how to get back into Windows and then what to do?

I had just done an Avira scan a couple startups ago and nothing showed up.

I'm using PC Tools Firewall Plus which seems to have been working fine.

Thanks for any help!

EDIT: (I'm on my wife's computer) I just did a search for this artur.dubovoy.com thing and supposedly he's the guy that made the
Flash Video Downloader add-on for Firefox. I do remember I allowed an update to that lately, too, altho I don't know how that would
directly cause the problems I've described, unless there was something embedded in it.

EDIT (2): I had left it attempting to load Windows while I typed this post. When I returned to see if it had started, I found that
CHDSK had begun running and was in the process of checking drive G (I have C, E & G) for consistency. I don't know if it
also checked C & E, or went straight to G. Progress is very slow, something like only a few % points in 5 minutes.
Any correlation? I wouldn't think "consistency" problems (whatever that really means) on G drive would have anything to do
with startup problems on C drive?

 

[Bobbye]

Much of your description sound more like it's system related.

This is normal and happens frequently. It does not indicate malware:

System Restore informed me it had changed the name of a couple of files -actually all within a folder.

And how to get back into Windows and then what to do?

You would usually get in by accessing a restore point, booting into Safe Mode if necessary:
Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

You do not tell me what the problem was getting into Safe Mode.
=============================================
Here you go- the publisher for the Flash Video Downloader is Artur Dubovoy>> Note spelling correction.
http://www.yasni.com/artur+dubovoy/check+people/Video Downloader
This addon was listed on here: Result of the people search to Artur Dubovoy by Yasni, directly incorporated from www.giveawayoftheday.com/soft/4190588

You can find it listed here: Flash Video Downloader (Youtube Downloader) 2.0.21> https://addons.mozilla.org/en-US/firefox/addon/flash-video-downloader-youtube/
by pos1t1ve, Artur Dubovoy

Information about his user name pos1t1ve
https://addons.mozilla.org/en-US/firefox/user/963217/
=====================================================
The Avira problem sounds more like it's malware related. You might try to boot into Safe Mode, locate the Avira program file and check the configuration.
====================================
If you would like us to check the system for malware, please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

When you have finished, leave the logs for review in your next reply .
NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.

Note: I am not sure what you status is with the system. If chkdsk is automatically coming on, it means that are errors that need to be checked. You should let it run to completion. The system will reboot when finished. This can take a while, especially of you don't run chkdsk during your regular maintenance. And the number of files on the system also affects the time it takes. Don't sit there and watch it! It won't seem like it's doing anything. Usually, the first 3 parts go quickly, 4th is a bit slower and the last takes quite a while. This is normal.

 

[macx]

Well, I'm back.

I had tried to F8, but it would never get to that - the Advanced Option window would never come up.

You are apparently correct about a system problem, to some degree at least. While I was on my wife's Mac (why does she never have problems like this while I have a major problem about every 3 or 4 months both on my laptop and my desktop) posting this, I had left it "churn" after going into the black screen after the Windows screen. When I got back to it, I found it had gone into CHDSK and had already found some errors on the G drive - but nothing that I could see indicated it had done anything with the C drive.

Anyway, it worked thru the G drive and found a number of errors of some type or other, language I had no clue about. And that's a nearly new top of the line drive. And strictly data storage - no applications. Anyway -

After it finally finished repairing the errors, Windows opened up and so far appears to operate properly.
As I said I had uninstalled Avira when it stopped being active and I couldn't reactivate it in the Avira control window.

After Windows opened up again after the CHDSK repairs to G drive, I was able to log onto the net and download and install a fresh version of Avira.

I've had very bad experiences with Registry Cleaners so shy away from them. The only thing I ran was the 06 Beta version of AVG Anti Rootkit, and it didn't find anything. I looked for an update but then found it is only now available as part of a paid subscription.

re: Dubovoy - yes, as in my EDIT in the original post, he's the author of Flash Video Downloader Firefox add on as I found with a search.

I use SUPER Antispyware and Malware Bytes and will do a full scan with both when I am done with this post.

As I said, I had done a full scan of the C drive with Avira just before this all started and nothing was found.

Could the problem files on the G drive have caused the startup problems with the C drive?

I'll post if I find anything with the malware scans or if I have any more problems.
Thanks for the input!

 

[macx]

Did full scans of C drive with Malware Bytes and SUPER Anti Spyware. SAS came up with some Adware tracking cookies, that was all. (I do also use No Script, AdBlock Plus, Better Privacy, Firefox Ad Killer, History Block, Key Scrambler, Track Me Not, Webmail Ad Blocker, and WOT, and hook up thru a router). Actually was surprised to see them, with all the blockers I use.

Anyway, that was with my E and G drives disconnected. Windows booted normally and started up fine with those 2 drives disconnected. Now I will shut down, reconnect 1 drive at a time, and see if that has any effect.

 

[Bobbye]

Regarding problem with G Drive affecting C Drive, probably not. But chkdsk should be a part of the routine maintenance on AL drives on the system.

Let me know your status please. I don't think it's malware related.

The subject you gave this thread is the email address of the person you had already identified. It really didn't have anything to do with the problem.

 

[macx]

You turned out to be absolutely correct, not malware.

I've got 3 hard drives, so thought if I could get just the C drive started I'd scan it with virus & malware, then hook up one of the other drives & scan, then the other & scan.

After unplugging the other 2, the C drive started right up no problem. Didn't find anything in the scans.

Plugged one of the other drives in, started up fine after CHKDSK auto-started and cleaned up a few problems, found a few adware tracking cookies, cleaned them up. So far so good.

Plugged the other drive in, it wouldn't start beyone the windows screen.

Just to try all the possibilities, I took the SATA cable off of the 2nd drive and hooked it into the 3rd drive and then it started up fine. Found a couple adware cookies, cleaned that up.

That got me thinking about the cables and the sockets on the board. Tried the working cable on both sockets, everything was OK. Tried the other cable, same no-start problem.

So I can startup OK and open either drive with one cable, but when I use the other cable I have the same problem. So apparently a bad SATA cable.

At least that's easy to fix!

I had just added 2gb of RAM before this started, so was afraid I'd gotten bad RAM or something. Apparently not, working fine now.

I also had been thinking malware when I did a previous point good setup and was informed that the folder with that name had been renamed.

When I did a search, I finally found that's the guy that wrote the flash downloader for firefox which I had recently updated. Probly why it had to be renamed when I went back to a restore point before the upgrade.

I've had major problems a few times over the years and it always starts out with something like this, so got "real nervous" about this problem when it first surfaced.

Maybe now I can go another 3 or 4 months without more major problems. Seems that's the best I can ever get out of either the desktop or the laptop without some kind of major problem.

Thanks for all your input! I at least learn something when this kind of thing happens.

 

[Bobbye]

So there are no malware related problems now- correct?

 

[macx]

Correct. Thank you.

 

[Bobbye]

Thank you for the update. If the system problems recur, you might consider posting in the Windows OS or BSOD forum.