[SOLVED] Pop-Ups

[notter87]

Hi. I'm extremely sorry I haven't responded to this sooner. I was in the hospital for part of last week and was released today.

Here is the report from Kaspersky. Now, should I also post a HijackThis log?

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, January 23, 2008 5:52:07 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 23/01/2008
Kaspersky Anti-Virus database records: 528347
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 106902
Number of viruses found: 3
Number of infected objects: 5
Number of suspicious objects: 0
Duration of the scan process: 01:27:21

Infected Object Name / Virus Name / Last Action
C:\Deckard\System Scanner\20080115215109\backup\WINDOWS\temp\NSIS_Install_igb.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.NaviPromo.ce skipped
C:\Deckard\System Scanner\20080115215109\backup\WINDOWS\temp\NSIS_Install_igb.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.ce skipped
C:\Deckard\System Scanner\20080115215109\backup\WINDOWS\temp\NSIS_Install_igb.exe NSIS: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\comodo\Firewall Pro\cfplogdb.sdb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\011A491F.dll Infected: not-virus:Hoax.Win32.Renos.dj skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Application Data\Last.fm\Client\Last.fm.log Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Application Data\Last.fm\Client\LastFmHelper.log Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Application Data\Last.fm\collection.db Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Temp\etilqs_87nrFcfp3WM2Y5W Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Nathan Garnica\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nathan Garnica\ntuser.dat Object is locked skipped
C:\Documents and Settings\Nathan Garnica\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Data\master.mdf Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Data\model.mdf Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Data\modellog.ldf Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Data\templog.ldf Object is locked skipped
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\LOG\ERRORLOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP311\A0139950.exe Infected: not-a-virus:Client-P2P.Win32.Share.a skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{897021FB-829D-472D-83E5-8AEFB1A99EA3}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_6ac.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_918.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\change.log Object is locked skipped

Scan process completed.

[tetonbob]

Hi, sorry to hear about your stay in hospital, I hope all is well now.

Yes, please also post a new HijackThis log.

[notter87]

Thank you. I'm doing better.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:01:10 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\PROGRA~1\MOZILL~1\plugins\NPSWF32_FlashUtil.exe -p
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {8CC1A67E-3A50-49A7-9B11-DAE86A6A3501} (mu-mo Download Manager) - https://secure.mu-mo.net/download/mu...oadManager.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 8804 bytes

[tetonbob]

What happens if you try to install the new java before uninstalling the old versions?

[notter87]

About the Windows Installer problem

I tried Method 1 on this page
http://support.microsoft.com/kb/315346

but once I got to the following step:

d. In the Value data text box, type the location of the Msiexec.exe file that you determined in step 1, followed by the value of /V, and then click OK.

I got a error message. I cant remember all of it but it said something like "unable to invoke the subscribers" at the end of it.

I had gotten this error before with the other microsoft support link you gave me so I went on to Method 2

In Method 2 I proceeded to the following step:

5. Type ren msiexec.exe msiexec.old, and then press ENTER.

I accidentally typed a "v" instead of a "c" in "msiexec.exe" It seemed that right when I typed in the "v" I got a message telling me something had been changed and the old settings needed to be returned and I had to insert my Windows XP disc. I believe the options were "Retry" and "Cancel" and "Retry" just brought up the same message so I hit "Cancel", returned to the command prompt, and finished step 5. I made sure to fix my typo.

But then step 8 says:

8. At the command prompt, type exit, and then press ENTER.

I had accidentally skipped step 7 did step 8, thinking it was talking about the same command prompt. Although that was an error, they have you do the exact same thing. So, in the end, I should have been able to proceed to the real step 8, but in step 7 you exit the command prompt, and no prompt for step showed up anyway.

I restarted my computer as directed and now when I restart Im getting a message that has "IMJPMIG.EXE - Unable to locate component" as the title and the message says: "This application has failed to start because Msi.dll was not found. Re-installing the application may fix the problem."

I tried downloading and installing "WindowsInstaller-KB893803-v2-x86.exe" from http://www.microsoft.com/downloads/d...ng=en#filelist but when I double click the file and check "I Agree" > "Next" > "Next", in the end it just says, "You have successfully completed the KB893803v2 Setup Wizard. To close this wizard, click finish." Thats all that happens.

[tetonbob]

Originally Posted by tetonbob

What happens if you try to install the new java before uninstalling the old versions?

[notter87]

I get the following message:

Java(TM) could not be installed because the Windows Installer 2.0 Engine is not installed on this system. Please download and install Windows Installer 2.0 or higher from the Microsoft web site.

I think its from renaming the files as I was told do in that link that I had in my previous post.

I've tried downloading Windows Installer 3.1 v2 but it wont work.

[tetonbob]

I've tried downloading Windows Installer 3.1 v2 but it wont work.

Can you be more specific about "won't work", please? I'm not in front of your machine. Exact error messages are helpful.

Open notepad and copy/paste the text in the quotebox below into it:

vfind -ltf "%systemdrive%\msiexec.*" >log.txt
notepad log.txt

Save this as peek.bat Choose to "Save type as - All Files"
It should look like this:
Double click on peek.bat & allow it to run. A notepad file will open. Copy that information into your next reply, please.

[notter87]

I tried downloading and installing "WindowsInstaller-KB893803-v2-x86.exe" from http://www.microsoft.com/downloads/d...ng=en#filelist but when I double click the file and check "I Agree" > "Next" > "Next", in the end it just says, "You have successfully completed the KB893803v2 Setup Wizard. To close this wizard, click finish." Thats all that happens. When I restart my system, nothing is changed.

The notepad file:

-c--a-w 78,848 2005-05-04 21:45:36 C:\i386\msiexec.exe
-c----w 77,312 2004-08-04 12:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe
----a-w 22,428 2008-01-24 03:11:30 C:\WINDOWS\Prefetch\MSIEXEC.EXE-330626DC.pf
----a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\msiexec.exe
-c--a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\msiexec.old
-c--a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\dllcache\msiexec.exe
-c--a-w 77,312 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msiexec.sym1

Entries: 7 (7)
Directories: 0 Files: 7
Bytes: 492,444 Blocks: 962

[tetonbob]

Let's try dial-a-fix

http://wiki.djlizard.net/Dial-a-fix

• Download/save the program and extract to it's own folder.
  
• In the MSI area click the button Fix Windows Installer
  
• Then click the Go button.

Follow any prompts, reboot the machine, and see if the issue is resolved.

[notter87]

hi. sorry I haven't posted sooner. I'm experiencing internet trouble right now and a tech is supposed to be coming out tomorrow. I'm posting from my phone right now.

I will try the dial-a-fix once the internet issue is resolved.

[notter87]

After I clicked "Go" I received 2 prompts saying that 2 files werent found. Im pretty sure its because when I used Method 2 from http://support.microsoft.com/kb/315346 it had me rename the original files so dial-a-fix was not able to find them.

If you can guide me through reverting the files to their original name im sure dial-a-fix would work after that.

[tetonbob]

What two files weren't found?

msiexec.exe is present where it belongs. Your renaming had no effect.

----a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\msiexec.exe
-c--a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\msiexec.old

If it's these files:

4. Type ren msi.dll msi.old, and then press ENTER.

6. Type ren msihnd.dll msihnd.old, and then press ENTER.

Go back in to System32 and rename them.

Or, go to start > run and type sfc /scannow

Let it scan. If it finds any files missing/corrupted, it may ask for the Windows CD.

We're really getting far away from malware removal at this point, and your issues with this may be better resolved in the Windows XP forum.

[notter87]

It gave me the following message twice

The application has failed to start because msi.dll was not found. Re-installing the application may fix this problem.

[tetonbob]

What gave you that message?

Did you read my last post, look for and rename those files again?

Open notepad and copy/paste the text in the quotebox below into it:

vfind -ltf "%systemdrive%\msi*.*" >log.txt
notepad log.txt

Save this as peek.bat Choose to "Save type as - All Files"
It should look like this:
Double click on peek.bat & allow it to run. A notepad file will open. Copy that information into your next reply, please.

[notter87]

I renamed the files. There was already another msihnd.dll file for some reason (maybe when I tried re-downloading and installing windows installer?)

I then tried start > run and type sfc /scannow and it kept asking for the disc. Problem is, I dont have one, Dell never sent one with the computer.

Heres the notepad file

----a-w 16,384 2005-08-20 00:34:43 C:\Documents and Settings\Nathan Garnica\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
-c--a-w 2,890,240 2005-05-04 21:45:32 C:\i386\msi.dll
-c--a-w 108,452 2004-08-04 10:00:00 C:\i386\msi.mfl
-c--a-w 165,430 2004-08-04 10:00:00 C:\i386\msi.mof
-c--a-w 158 2004-08-04 10:00:00 C:\i386\msicw.isp
-c--a-w 51,712 2004-08-04 10:00:00 C:\i386\msident.dll
-c--a-w 6,656 2004-08-04 10:00:00 C:\i386\msidle.dll
-c--a-w 14,848 2004-08-04 10:00:00 C:\i386\msidntld.dll
-c--a-w 248,832 2004-08-04 10:00:00 C:\i386\msieftp.dll
-c--a-w 78,848 2005-05-04 21:45:36 C:\i386\msiexec.exe
-c--a-w 271,360 2005-05-04 21:45:36 C:\i386\msihnd.dll
-c--a-w 198,736 2004-08-04 10:00:00 C:\i386\msimain.sdb
-c--a-w 4,608 2004-08-04 10:00:00 C:\i386\msimg32.dll
-c--a-w 16,384 2005-08-20 00:29:32 C:\i386\MSIMGSIZ.DAT
-c--a-w 60,416 2004-08-04 10:00:00 C:\i386\msimn.exe
-c--a-w 884,736 2005-05-04 21:45:36 C:\i386\msimsg.dll
-c--a-w 159,232 2004-08-04 10:00:00 C:\i386\MSIMTF.dll
-c--a-w 145,191 2004-08-04 10:00:00 C:\i386\MSINFO.DL_
-c--a-w 44,271 2004-08-04 10:00:00 C:\i386\msinfo32.chm
-c--a-w 39,936 2004-08-04 10:00:00 C:\i386\msinfo32.exe
-c--a-w 3,677 2004-08-04 10:00:00 C:\i386\msinfo32.inf
-c--a-w 2,950 2004-08-04 10:00:00 C:\i386\MSIPBTP.MI_
-c--a-w 5,925 2004-08-04 10:00:00 C:\i386\MSIPRIP2.MI_
-c--a-w 273,920 2004-08-04 10:00:00 C:\i386\msiprov.dll
-c--a-w 98,304 2004-08-04 10:00:00 C:\i386\msir3jp.dll
-c--a-w 1,875,968 2004-08-04 10:00:00 C:\i386\msir3jp.lex
-c--a-w 15,025 2004-08-04 10:00:00 C:\i386\MSIREGMV.EX_
-c--a-w 163,897 2004-08-04 10:00:00 C:\i386\MSISAM11.DL_
-c--a-w 15,360 2005-05-04 21:45:36 C:\i386\msisip.dll
-c--a-w 50,040 2004-08-04 10:00:00 C:\i386\LANG\MSIR3JP.DL_
-c--a-w 698,666 2004-08-04 10:00:00 C:\i386\LANG\MSIR3JP.LE_
----a-w 124,248 2007-08-29 18:57:52 C:\Program Files\Apple Software Update\plugins\MSIInstallPlugin.dll
-c--a-w 39,936 2004-08-04 10:00:00 C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe
-c--a-w 158 2004-08-04 12:00:00 C:\Program Files\Internet Explorer\Connection Wizard\msicw.isp
----a-w 810,320 2006-09-01 00:33:00 C:\Program Files\MSN Messenger\msidcrl40.dll
-csha-w 60,416 2004-08-04 10:00:00 C:\Program Files\Outlook Express\msimn.exe
----a-w 2,854,400 2007-04-18 16:14:43 C:\WINDOWS\$hf_mig$\KB927891\SP2QFE\msi31.dll
-c----w 2,804,224 2004-08-04 12:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msi.dll
-c----w 77,312 2004-08-04 12:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe
-c----w 331,264 2004-08-04 12:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msihnd.dll
-c----w 884,736 2004-08-04 12:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msimsg.dll
-c----w 44,032 2004-08-04 12:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msisip.dll
-c----w 2,890,240 2005-05-04 21:45:32 C:\WINDOWS\$NtUninstallKB927891$\msi.dll
-c--a-w 198,736 2004-08-04 12:00:00 C:\WINDOWS\AppPatch\msimain.sdb
-c--a-w 44,271 2004-08-04 12:00:00 C:\WINDOWS\Help\msinfo32.chm
-c--a-w 3,677 2004-08-04 12:00:00 C:\WINDOWS\inf\msinfo32.inf
-c--a-w 9,952 2006-06-16 00:48:53 C:\WINDOWS\inf\msinfo32.PNF
-c--a-w 605,184 2006-06-03 06:58:45 C:\WINDOWS\Installer\MSI11.tmp
----a-w 135,168 2007-02-10 19:54:15 C:\WINDOWS\Installer\MSI12.tmp
-c--a-w 605,184 2006-06-03 06:59:03 C:\WINDOWS\Installer\MSI17.tmp
----a-w 134,656 2007-02-07 18:50:42 C:\WINDOWS\Installer\MSI2.tmp
----a-w 134,656 2007-02-07 18:50:52 C:\WINDOWS\Installer\MSI9.tmp
----a-w 135,168 2007-02-10 19:53:57 C:\WINDOWS\Installer\MSIB.tmp
-c--a-w 376,320 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
-c--a-w 2,501 2006-06-18 04:03:18 C:\WINDOWS\pchealth\helpctr\System\sysinfo\msinfo.htm
-c--a-w 371 2006-06-18 04:03:18 C:\WINDOWS\pchealth\helpctr\System\sysinfo\msinfo.xml
-c--a-w 582 2006-06-18 04:03:18 C:\WINDOWS\pchealth\helpctr\System\sysinfo\msinfohss.css
----a-w 5,606 2008-01-29 03:10:03 C:\WINDOWS\Prefetch\MSIEXEC.EXE-330626DC.pf
----a-w 2,854,400 2008-01-29 03:24:26 C:\WINDOWS\system32\msi.dll.old
-c--a-w 51,712 2004-08-04 12:00:00 C:\WINDOWS\system32\msident.dll
----a-w 6,656 2004-08-04 12:00:00 C:\WINDOWS\system32\msidle.dll
-c--a-w 14,848 2004-08-04 12:00:00 C:\WINDOWS\system32\msidntld.dll
-c--a-w 248,832 2004-08-04 12:00:00 C:\WINDOWS\system32\msieftp.dll
----a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\msiexec.exe
-c--a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\msiexec.old
----a-w 271,360 2005-05-04 21:45:36 C:\WINDOWS\system32\msihnd.dll
-c--a-w 271,360 2005-05-04 21:45:36 C:\WINDOWS\system32\msihnd.dll.old
----a-w 4,608 2004-08-04 12:00:00 C:\WINDOWS\system32\msimg32.dll
-c--a-w 884,736 2005-05-04 21:45:36 C:\WINDOWS\system32\msimsg.dll
----a-w 159,232 2004-08-04 12:00:00 C:\WINDOWS\system32\MSIMTF.dll
-c--a-w 132,880 2004-03-09 04:00:00 C:\WINDOWS\system32\msinet.ocx
-c--a-w 13,767 2004-08-04 10:00:00 C:\WINDOWS\system32\msipbtp.mib
-c--a-w 34,317 2004-08-04 10:00:00 C:\WINDOWS\system32\msiprip2.mib
-c--a-w 98,304 2004-08-04 10:00:00 C:\WINDOWS\system32\msir3jp.dll
-c--a-w 1,875,968 2004-08-04 10:00:00 C:\WINDOWS\system32\msir3jp.lex
-c--a-w 40,960 2004-08-04 12:00:00 C:\WINDOWS\system32\msiregmv.exe
-c--a-w 15,360 2005-05-04 21:45:36 C:\WINDOWS\system32\msisip.dll
-c--a-w 16,384 2005-08-20 00:29:32 C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
-c--a-w 2,804,224 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msi.sym1
-c--a-w 51,712 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msident.dll
-c--a-w 6,656 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msidle.dll
-c--a-w 14,848 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msidntld.dll
-c--a-w 248,832 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msieftp.dll
-c--a-w 78,848 2005-05-04 21:45:36 C:\WINDOWS\system32\dllcache\msiexec.exe
-c--a-w 77,312 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msiexec.sym1
-c--a-w 271,360 2005-05-04 21:45:36 C:\WINDOWS\system32\dllcache\msihnd.dll
-c--a-w 331,264 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msihnd.sym1
-c--a-w 198,736 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msimain.sdb
-c--a-w 4,608 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msimg32.dll
-cs-a-w 60,416 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msimn.exe
-c--a-w 884,736 2005-05-04 21:45:36 C:\WINDOWS\system32\dllcache\msimsg.dll
-c--a-w 159,232 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msimtf.dll
-c--a-w 376,320 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msinfo.dll
-c--a-w 39,936 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msinfo32.exe
-c--a-w 273,920 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msiprov.dll
-c--a-w 98,304 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msir3jp.dll
-c--a-w 1,875,968 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msir3jp.lex
-c--a-w 40,960 2004-08-04 12:00:00 C:\WINDOWS\system32\dllcache\msiregmv.exe
-c--a-w 15,360 2005-05-04 21:45:36 C:\WINDOWS\system32\dllcache\msisip.dll
-c--a-w 108,452 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\msi.mfl
-c--a-w 165,430 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\msi.mof
-c--a-w 273,920 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\msiprov.dll
-c--a-r 73,689 2000-12-08 20:54:14 C:\WINDOWS\system32\wbem\mof\good\msioff10.mof

Entries: 103 (101)
Directories: 0 Files: 103
Bytes: 37,611,903 Blocks: 73,477

[tetonbob]

This file needs to be renamed

----a-w 2,854,400 2008-01-29 03:24:26 C:\WINDOWS\system32\msi.dll.old

remove the .old extension.

[notter87]

Alright dial-a-fix didnt ask for those files anymore but when it got to the re-registering part of fixing Windows Installer I got a message pop-up saying "An event was unable to invoke any of the subscribers."

I had also gotten this message when trying to fix Windows installer with the Windows support link you had given me and the one I found.

[tetonbob]

I'm going to pass you back to your open thread in Windows XP.

Other than this Java and Windows Installer issue, your logs are clean. This issue is better suited to that forum, where you'll get broader exposure to those who can help.

Some parting instructions for the malware cleaning

Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:

• Microsoft Windows Update - http://www.windowsupdate.com
  Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• SpywareGuard to catch and block spyware before it can execute.
  
• IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
    
  • Click Next, click Next, select the option:
    "Show Extracted files", click Finish
    
  • This will open the newly created hosts folder on your Desktop.
    
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    
  • Once updated you should see another prompt that the task was completed.
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
  
  Do not install more than one AntiVirus program because they will conflict with each other.
  
  
• FIREWALL
  Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here
  
  Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.

• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• HOW DID I GET INFECTED IN THE FIRST PLACE?
• MAKING INTERNET EXPLORER SAFER

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[notter87]

I already deleted the combofix program on my desktop a few days ago. Does that make a difference?

alright. thanks alot for all the help youve provided to me