Random Pop-ups when IE Browser Closed + Multiple Iexplore.exe in Taskbar

[chibikaz]

Here are the three logs requested.

Thanks!

 

[Bobbye]

The logs look clean to me- with one exception. SAS is still showing Bearshare. I suggest you search for all Bearshare related entries and delete them:

C:\OLD SYSTEM\PROGRAM FILES\BEARSHARE\BEARSHARE.EXE
C:\PROGRAM FILES\BEARSHARE\BEARSHARE.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\BEARSHARE.LNK
C:\DOCUMENTS AND SETTINGS\KRISTY WARREN\DESKTOP\BEARSHARE.LNK

(Sorry for the uppercase letters. I did a copy and paste from SAS)

Are you having any of the original problems now? Random Pop-ups when IE Browser Closed + Multiple Iexplore.exe in Taskbar? If not, I think we can remove the cleaning programs and old restore points.

* Download OTCleanIt (http://download.bleepingcomputer.com.../OTCleanIt.exe)

* Click the CleanUp! button.
* It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).

Clear your existing System Restore points and establish a new clean restore point:

Go to Start > All Programs > Accessories > System Tools > System Restore> Select Create a restore point> OK.
* Next, go to Start > Run and type in cleanmgr
"Ensure the selection is on C:\ and click on OK"-
* Select the *More options* tab
* Choose the option to clean up System Restore and OK it.
* This will remove all restore points except the new one you just created.

It's been a pleasure working with you. Please let us know if you need further help.

 

[chibikaz]

The original problem appears to be gone. I had avoided using Internet Explorer during our removal process since the Adaware.Lop seemed to kick on the ads once iexplore had been opened once. I haven't received any random pop-ups after opening Internet Explorer, and upon checking the Task Manager, only one iexplore is running!

A few quick questions:
1) I disabled start up functions for all non-Symantec programs as requested a while back. Are there any I should renable after I set up the clean restore point? I could provide a screencap of the program listing if you'd like.

2) When you say it removals all tools, I'm a little confused what all that entails. Could you please clarify what type of tools/programs? Do you mean it removes Anti-Malware Bytes, Super Spyware, etc downloaded just for this session? Do you mean it deletes any sort of tool program dealing with spyware (e.g. Windows Defender, Spybot), or do you mean it deletes any extraneous program with a tool-like designation (e.g. keyboard control programs)?

3) I just tried to go to the site http://download.bleepingcomputer.com, but received 404 messages and a "problem loading page" message. Despite clicking on the link, the full address never popped up, which might be the problem the loading page message. It came up in the address bar as:
"http://download.bleepingcomputer.com.../OTCleanIt.exe" I tried deleting the ellipsis and received a 404 error.

It has been an absolute pleasure working with you as well, and thank you so much for taking the time and effort to help me restore my computer and identify potential future hazards. I can't tell you how much I appreciate it!

 

[kimsland]

OTCleanIt.exe

http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

@Bobbye please update your link to OTCleanIt

 

[chibikaz]

Thank you very much! I was going to ask if I should just manually uninstall some of the programs. What exactly does this clean?

I do have a different set of problems, however. When attempting to turn System Restore back on--I turned it off during removal as advised by the steps to remove malware--I keep getting an error message saying:

"System Restore encountered an error trying to enable/disable one or more drives. Please restart your machine and try again."

I did, to no avail. It also failed to run Scan Disk, saying it didn't have access to some files needed that would only be available on start up, but I'm sure it would be the same issue as with the System Restore--that upon reboot it still would fail to do so. Something that should be running is definitely not.

Could this be the result of having some of the start programs Bobbye had me disable during removal still disabled? Or some of the services the computer tech guy disabled? I can take screen shots of both screens if that would help in diagnosing the issue.

Please let me know. Thanks.

 

[Bobbye]

Could this be the result of having some of the start programs Bobbye had me disable during removal still disabled?

No

Or some of the services the computer tech guy disabled?

Possibly

"System Restore encountered an error trying to enable/disable one or more drives. Please restart your machine and try again."

Control Panel> System> System Restore tab> check Status and make sure System Restore is monitoring the hard drive,

 

[chibikaz]

Status: It says C is turned off.

 

[Bobbye]

If 'C' is the Local Drive, that's what System Restore needs to be monitoring. If there is a check in 'Turn off System Restore', UNCHECK it.

Post #27 gave directions for dropping the old restore points and setting a new one. Did you do that? Could you have checked the 'turn off' then?

 

[chibikaz]

Unfortunately, I had already tried do to that several times before posting here.

When attempting to turn System Restore back on--I turned it off during removal as advised by listed steps to remove malware--I keep getting an error message saying:

In that earlier post, I was saying that I received that error message when attempting to turn on System Restore after it was disabled via the checkmark method. I turned it off when following Symantec's removal instructions of BackdoorTidserv!inf, the first step of which is disabling System Restore. The problem didn't stop there though and I realized through your posts at TechSpot here that Adaware Lop was also an issue.

I just tried to manually start the service via the Services (Local) panel, but it told me it started and then stopped. Also, other discussions of System Restore problems discuss a list of available drives, but all my System Restore page says is C Monitoring Turned Off and Turn on/Off System restore text box with a min or max space allotment.

 

[chibikaz]

Here are screen shots of the two error messages I've received for Windows functions:

Check Disk Error in being able to scan files

Unable to turn on System Restore

I think there is a fair possibility some service was disabled along the line that messed this up because the tech personnel did say he disabled a lot of services.

Please advise what I should do to restore functionality. I'm very uncomfortable not having System Restore enabled or being able to check for errors with check disk.

 

[Bobbye]

because the tech personnel did say he disabled a lot of services.

Argggggggggggg!

The Services are a finely tuned group of functions that must be set correctly because of the Dependencies. A tech should know this, but many don't. They whack them off and don't check the Dependencies- other Services that need this Service o run, OR they don't take into consideration what other Services THIS Service need to run.

Some MUST be set to Automatic, because they need to start on boot. Many can beset to Manual, in order to start up only when needed. And some CAN be Disabled, but it must be carefully done, with the Dependencies considered for each one.

Start> Run> services.msc> right lick on 'System Restore Service> Properties> Set startup to Automatic> Start the Service. There is only one Dependency, RPC, which should already be set to Automatic- not much works without it.

saying it didn't have access to some files needed that would only be available on start up,

You'll be please to know that what you are seeing for Chkdsk is not an error. When you check both boxes on the Error Checking screen, it requires you to reboot to start. Rather than schedule it 'for the next boot' I do it then. All you have to do is reboot and the Error Check should start in 9 seconds. Let it complete.

Let me know status after handling these two functions.

 

[chibikaz]

*head desks* Ugh, that could very well have been what happened then!

I went into the Services panel and System Restore was set to Automatic, but when I attempted to start it, I got a message saying it started and then stopped, and when I went to check on the System Restore tab, it is still listed as turned off, with a status of C monitoring off.

I looked for RCP (Remote Call Procedure, correct?) and saw that the RCP was set to Automatic and Started, and the RCP Locator was set to manual and started.

Should I change that to automatic?

That's great news about the Check Disk, and thank you for the heads up on that!

 

[Bobbye]

I looked for RCP (Remote Call Procedure, correct?) and saw that the RCP was set to Automatic and Started, and the RCP Locator was set to manual and started.

Those are good settings- leave them. Be sure the Workstation Service is set to Manual.

 

[chibikaz]

Work station was listed under automatic, so I changed it to manual.

I still can't enable System Restore.

 

[Bobbye]

Three weeks and we've removed malware, but now have problem with System Restore. Please follow:

System Restore Troubleshoot:

Q.What should I do if System Restore does not work?
A.Try these steps if System Restore does not appear to work:

1.Ensure the System Restore service is running. For more information, see: How can I verify that the System Restore services are running on my machine? (see site)

2.Verify that you have enough free space on all your drives as required by System Restore. If the free space on any partition system restore is monitoring falls below 50 MB, System Restore will suspend and purge out all restore points to free up disk space. It will automatically reactivate when 200 MB+ free space is available. For more information, see How the System Restore Tool Handles Hard-Disk Space Usage. (see site)

3.Examine event logs for any system restore-related errors that could help you identify the problem.

http://www.microsoft.com/technet/prodtechnol/winxppro/plan/faqsrwxp.mspx

If you go through the above steps and the feature is still not working:

Registry Edit: NOTE: Backup the Registry before making any changes:
An alternative to the usual method of enabling and disabling Windows XP's System Restore feature is to use the registry. To use this alternative, perform the following steps: Start the registry editor (regedit.exe).

Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore.
If a "DisableSR" value doesn't exist, go to the Edit menu, select New, DWORD value, and create the value.
Set the value to 1 to disable System Restore or 0 to enable System Restore.

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr to prevent the System Restore service from starting.

Double-click Start, and set the value to 4 to stop the service from starting or to 0 for normal startup. Close the registry editor.
Source: KellysKorner

 

[chibikaz]

I read through the trouble shooting with System Restore. It keeps mentioning being able to view the available drives list, and I wanted to note that I do not have this option. On my System Restore tab, I cannot view the list of drives and ensure that the drive I want to be monitored is selected.

I have 80 Gig free on this computer so the drive space is not an issue.

The first method said it started System Restore successfully, but it's still listed as turned off when I go into the tab and it is still not showing up as started in the Services tab.

I read through the event logs, but didn't see any sr for sr services listed, just System Control Manager information.

Also, I went through the error logs and was alarmed to see so many errors listed throughout December, some of which have multiple listings on different days:

A) Error code 000000ea, parameter1 896b2020, parameter2 8972b710, parameter3 89561bd8, parameter4 00000001.

B) TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

C) The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

D) The Intel® Quick Resume Technology Drivers service hung on starting.

E) Printer Driver Microsoft Office Document Image Writer Driver for Windows NT x86 Version-3 was added or updated. Files:- mdigraph.dll, mdiui.dll, mdiui.dll.

F) Printer Microsoft Office Document Image Writer is pending deletion.

**Does this just mean the printer was deleting a document? Because it makes it sound like the whole printer connection was being deleted.

G) The driver ialmrnt5 for the display device \Device\Video0 got stuck in an infinite loop. This usually indicates a problem with the device itself or with the device driver programming the hardware incorrectly. Please check with your hardware device vendor for any driver updates.

H) DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

I'm particularly concerned about A, B, D, G, and H. It looks like these errors occurred in December after the Tech came by, and we had started the cleaning process. My computer has installed some Automatic updates since that time as well.

What do you suggest I do? Would any of this be remedied by going to see if there are more Automatic updates to install? I'd prefer to wait on that until I have System Restore running, so I'm heading onto the next method of restoring that.

 

[chibikaz]

I didn't add this question into the other post because the first post is monstrous as is:

When getting advice on how to do a registry back up here and here, the back up relies on System Restore being able to be used, which is a problem. I tried exporting, but it suggests doing that only for specific branches. The second site references being able to back up the entire registry and links to the first article, but that too seems to rely on System Restore.

Any suggestions? Do I need to download another utility like ERUNT?

 

[Bobbye]

This thread is now 3 weeks old and over 40 posts later. We completed the original malware cleaning and you are wanting to handle Service changes and random Events- some of which may not actually be Errors. Listing Errors randomly without respect to what you were doing at the time or what was happening at the time is not recommended.

When using the Event Viewer to look for Error that correspond to a particular problem, this should be done:
Start> Run> type in eventvwr

Do this on each the System and the Applications logs:
1. Click to open the log>
2. Look for the Error>
3 .Right click on the Error> Properties>
4. Click on Copy button, top right, below the down arrow
5. Paste here (Ctrl V)

Ignore Warnings and Information Events. Copy the Error itself hich will include the Event ID#, the Source and the Description. You have only given the Description. Those 3 pieces of information are taken together to find a resolution.

Ignore Errors that state: ""This service cannot be started in Safe Mode "

Some Services DO NOT start in Safe Mode, so if you were in Safe Mode at the time the Error was logged, you tried to do something that required the Service but it wasn't available. Ignore 'H'.

A. Windows Event ID 1003 from System Error code 000000ea
See: http://support.microsoft.com/?kbid=293078&sd=RMVP

B. TCP/IP has reached the security limit
You tried to connect and failed three times.

C. The system clock is unsynchronized.

Right click on clock> Adjust time and date> Time Zone tab> make sure zone is correct> CHECK 'auto adjust for DST.> Internet Time tab> CHECK 'auto sync with internet time server> paste this server into the dialog box:
tick.usno.navy.mil
Click on Check now> Allow the setting> Apply> OK

D. Full Error:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7022
Date: 5/9/2006
Time: 9:08:52 AM
User: N/A
Computer: DELLSERVER
Description:
The Intel® Quick Resume Technology Drivers service hung on starting.
Make sure this Sevices is set to Manual or Automatic:
O23 - Service: Intel® Quick Resume Technology Drivers (ELService)
Check the Dependency tab and make sure any Services it depends on are set to Manual or Automatic.

Need full Error copy for these: They sound like Information Events, not Errors.

E. Printer Driver Microsoft Office Document Image Writer Driver for Windows NT x86 Version-3 was added or updated. Files
F. Printer Microsoft Office Document Image Writer is pending deletion.

G. The driver ialmrnt5 for the display device \Device\Video0 got stuck in an infinite loop.

1. What app, if any, were you running when the error occurred?
2. What version of the driver are you running?
3. What chipset does your machine currently have?
Possible help here:
http://secunia.com/advisories/18286/

After you resolve these, if you require further help, please start a new thread in the Windows or Software Forum. Tell us what the problem is, what you are doing at the time and paste a copy of the corresponding Event Error.

 

[chibikaz]

Thank you, Bobbye.

I see. I will begin a thread in the Windows or Software forum if I continue to be unable to enable System Restore or have issues with other services.

Thank you and kimsland again for all of your help.

 

[Bobbye]

You're welcome.

Happy Holiday!

 

[papaken4]

Need Help Please

Bobeye,

I have the same problem with Chibikaz is having except I it when I have random adverstings that pops up in audio files and random music files play that I don't own. When I open task manager see approx. 30 ixplorer windows running the background and I can't stop them. I have Norton 360 and it doesn't seem to see anything on my computer. Should I follow the same steps listed above. I don't know where to find log's etc to show you data from my computer. Please help.

 

[papaken4]

here is the log that HJT created. It advised me not to change any settings and allow more experienced folks look at it.

 

[Bobbye]

This thread is for the use of chibikaz only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our Virus and Malware Removal Forum.

papaken4
If you suspect malware, start a new thread and please follow the Steps in the Viruses/Spyware/Malware Preliminary Removal Instructions: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Attach the logs to the new thread with comment on problems. We will then review the three logs.