Problem with Alureon-K, I can't get rid of it.

Viruses and worms
21

Hi,

I have not forgotten you. I am looking into getting your internet back up and running.

Have you by chance ever had ZoneAlarm on this system that you know of?

  • Click the ‘Start’ button.

  • Click “Control Panel”, or click ‘Settings’ then ‘Control Panel’.

[list][li]Click ‘Add or Remove Programs’.

  • The ‘Add or Remove Programs’ window opens.

[li]Select the ‘show updates’ checkbox at the top of the window.

  • Installed programs and updates that are currently installed are displayed.

[list][li]Scroll down to locate Microsoft security update for Windows (KB951748).

  • If it is there are you given the option to Remove?
    [/li]
22

I’ve never heard of zone alarm so I’m pretty sure we’ve never had it.

We have the widows update but are not given the choice to remove it.

I appreciate your work on this

23

Hi,

[*]Please open Notepad (Start → Run → type notepad in the Open field → OK) and copy and paste the text present inside the code box below:


ClearJavaCache::

DDS::
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
StartupFolder: c:\docume~1\doust\menudm~1\progra~1\dmarra~1\DELIVE~1.LNK -

AtJob::

File::
c:\program files\HP\HP Officejet 6500 E710n-z\Bin\HPCustPartic.exe

[*]Save this as CFScript.txt and change the “Save as type” to “All Files” and place it on your desktop.

http://img.photobucket.com/albums/v706/ried7/CFScriptB-4.gif

[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
[*]Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
[*]ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
[*]When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix’s window while it is running. That may cause it to stall.

24

Program runs but does not produce a log.

It hangs at this point:

pevFind, by Billy O’Neal III, version 1.5.6 Combofix Edition. Syntax Error.
Pass LEGAL for license information. Built Sat Jun 25 23:20:20 2011

I tried 3 times and it is always the same.

I still don’t have the microsoft windows discovery bit ddue to lack of internet connection.

25

I spoke too soon, I left it running and it has re-started the pc (again) and has now come up with the error from microsoft windows
“the system has found a serious error”

BCCode : 1000008e BCP1 : C0000005 BCP2 : F14A2BD1 BCP3 : EEE4C920
BCP4 : 00000000 OSVer : 5_1_2600 SP : 3_0 Product : 256_1

I have got a log from combofix - see attached

26

Hi,

Ok…

Please delete the current version of Combofix.exe from your desktop and download a new version from here to your desktop.

Disable your AntiVirus and AntiSpyware applications.

Right-click and Run as Administrator on the Combofix.exe and follow the prombts on your display. When finish, it will create a C:\Combofix.txt. Please post this log for further review.

27

Done - log attached

28

Hi,

[*]Please open Notepad (Start → Run → type notepad in the Open field → OK) and copy and paste the text present inside the code box below:


ClearJavaCache::

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9000:TCP"=-
"9001:TCP"=-
"9002:TCP"=-
"9003:TCP"=-
"9004:TCP"=-
"9005:TCP"=-
"9006:TCP"=-
"9007:TCP"=-
"9008:TCP"=-
"9009:TCP"=-
"9010:TCP"=-
"9100:TCP"=-
"8000:TCP"=-
"10000:TCP"=-
"9090:TCP"=-
"3483:UDP"=-
"3483:TCP"=-

[*]Save this as CFScript.txt and change the “Save as type” to “All Files” and place it on your desktop.

http://img.photobucket.com/albums/v706/ried7/CFScriptB-4.gif

[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
[*]Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
[*]ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
[*]When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix’s window while it is running. That may cause it to stall.

29

Log attached

30

Hi,

What about that internet? Is it still not working?

31

Still not working

32

Hi,

Ok we need to remove Windows Service Pack 3 and then reinstall it.

Use the hidden $NtServicePackUninstall$ folder

[*]Click Start, click Run, copy/paste the following into the open run box, then click OK.
c:\windows$NtServicePackUninstall$\spuninst\spuninst.exe
[*]When the Windows XP Service Pack 3 Removal Wizard starts, click Next.
[*]Follow the instructions on the screen to remove Windows XP SP3.

Please go here >> http://www.microsoft.com/download/en/details.aspx?&id=25129, download Windows Service Pack 3 to the computer you are having problems with and then install that to your computer. If needed, use another computer and copy Windows Service Pack 3 to CD or a USB drive and transfer it to the computer we are working on.

Once Windows Service Pack 3 is reinstalled on your system go to Start >> All Programs >> Windows Update and once there press the Express button and then download and install all updates. Continue to download and install new updates until there are none left.

Once this has been completed, let me know. Also let me know if you have any problems.

33

Tried to uninstall. It started the process but then came up with the message “the file cannot be found” then after I clicked OK (no other choices) it said that service pack 3 had not been uninstalled.

34

Hi Frenchfancy,

Let’s come back to that…please run a new scan with aswMBR and post that newly made log into your next reply.

35

aswMBR log attached

36

Hi,

I am speaking with a colleague about something before we continue.

So the only problem left with your system is you are not able to connect to the internet?

37

Yes it seems to be.

38

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

[*]Right-click and Run as Administrator SystemLook.exe to run it.
[*]Copy the content of the following codebox into the main textfield:


:filefind
*netbt.sys

[*]Click the Look button to start the scan.
[*]When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

39

log attached

40

Hi frenchfancy,

Thanks for that log. :slight_smile:

Go to Start >> Run >> type CMD and this will open the command prompt.

In the command prompt type the following:

IPCONFIG /RELEASE (press Enter)

IPCONFIG /FLUSHDNS (press Enter)

IPCONFIG /RENEW (press Enter)

Close out of the command prompt and reboot.

Try to connect to the internet now and let me know if that helped. :slight_smile: