Unsolved
This post is more than 5 years old
23 Posts
0
34884
June 5th, 2006 15:00
Inspiron 6000 - Spyware caused computer crash
Inspiron 6000: I accessed a site thru IE 6 that downloaded Trojan on the machine. I immediately ran Lavasoft free version on my machine and saw 61 files and processes were infected. I deleted all of them from the laptop. However, I continued to get the message below.
Warning! Spyware threat detected! System error #1752
Your computer has several fatal errors due to spyware activity.
Your IP address is ------------ and via this address an unauthorized
access was gained by another computer. It is strictly recommeded
to install an anti-virus software to close all security breaches.
Your computer has several fatal errors due to spyware activity.
Your IP address is ------------ and via this address an unauthorized
access was gained by another computer. It is strictly recommeded
to install an anti-virus software to close all security breaches.
Your IP address:----------- They know you're using:Internet Explorer Your computer is:Intel(R) Pentium(R) 4 CPU 3.00GHz, 510.07 MB of RAM
Risk status for further investigation: VERY HIGH RISK
To protect your computer from spyware attacks - click ---- (here)
To erase the tracks of your internet activity - click ----- (here
Due to panic, I used the Power button to switch off and on the laptop multiple times. This caused multiple problems. I cannot view the "Start" button and the bottom bar. I also lost all my desktop icons. I just get a blank screen with the Dell logo. At starting, I got the message "Explorer.exe unable to exceute. Click ok to terminate"
I tried using Task manager (Ctrl+Alt+Del) to open up application. I was able to open MS files as well as IE through Task manager/New application. IE by default went to secure.htm and showed the message below, however when I typed a url it allowed internet access.
However before I could back up my data yesterday, I got the message "Task Manager disabled by administrator". Therefore, I am not able to do anything now as I have no icons / menu bars to access any application.Dell did not ship any Windows XP CD along with my computer ( I am not sure whether thats the standard process) Also, the DVD R/W drive that came bundled with the software had been giving problems from Day 1 and at the time I got Trojan, this drive was not being recognized by my computer. I do not have a floppy drive. I do have 128 MB USB drive and ports. Would appreciate a help. I am not under warranty.
No Events found!
bamajim
10.4K Posts
0
June 5th, 2006 15:00
deep2818
The first thing we need to do is see if we can get you somehwhat operational.
See if we can get to safe mode. Reboot your pc, then begin tapping the F8 key twice a second before the Windows splash screen appears. It should bring you to a menu. Select "Last known good configuration" and hit enter.
Then see if your pc will restart normally.
Do this while disconnected from the internet.
And one question, are you posting from another PC?
bamajim
Training at Malware Removal University
bamajim
10.4K Posts
0
June 6th, 2006 12:00
deep2818
23 Posts
0
June 6th, 2006 12:00
Bamajim,
I am accessing the dell community through my work desktop and I have my laptop next to me.
I tried tapping F8 and select "Last known good configuration" three times. Everytime, it gave me a different message.
Yesterday evening, I got the message - "system32\system file is corrupted. Please insert Windows Xp CD and press r on next screen to repair" On selecting r (without CD, i do not have one), I got some message saying "unable to rapair"
Today morning, I have tried twice. The first time, I got the message system32\ntoskrnl.exe is corrupted. Please reinstall the file"
I rebooted the machine and second time, when I do F8 and last known good config, its starting Windows XP (as it was 2 days back) giving message for explorer.exe "The application failed to initialize properly (0xc00000005). click ok to terminate". WHen i click ok, it takes me to a blank desktop screen with dell logo.
Please let me know what to do. today I have the laptop with me and I will be able to respond to your instructions real time.
deep2818
23 Posts
0
June 6th, 2006 12:00
Bamajim,
For the first time since the problem started, I was able to view the login screen and I was able to click on my user profile. On the next screen, I am getting a message as follows:
"Windows is running in Safe mode. The special diagnostics mode of Windows enables you to fix a problem that may be caused by network or harware settings. Make sure these settings are correct in Control Panel and then try starting Windows again. While in Safe mode, some of the devices may not be available. To proceed to work in safe mode, click Yes. If you prefer to use System restore to restore your computer to a previous state, click No"
Which button should I click?
bamajim
10.4K Posts
0
June 6th, 2006 12:00
deep2818
Select Yes
bamajim
Training at Malware Removal University
Message Edited by bamajim on 06-06-200609:07 AM
deep2818
23 Posts
0
June 6th, 2006 13:00
Bamajim,
I am able to view the desktop and all the items (icons, files). Also able to view the lower task bar with "Start" button.
The word "Safe mode" appears on all 4 corners of the screen. To test, I opened one of the text files which opened without a hitch. The mouse shows an arrow with a flickering sand dial.
What should be done next.
Regards
bamajim
10.4K Posts
0
June 6th, 2006 13:00
deep2818
Thats good news. We must proceed with caution, I don't want to lose what we have so far.
Please do not reboot.
1. Click Start->>All programs->>Accessories->>Cmd Prompt
The cmd prompt window should open. At the C:\ prompt type in CHKDSK and hit enter. Reply with the results.
Question, do you have a USB key (some call it a memory stick) in case we need to upload tools to the problem pc?
bamajim
Training at Malware Removal University
deep2818
23 Posts
0
June 6th, 2006 14:00
deep2818
23 Posts
0
June 6th, 2006 15:00
Bamajim,
I was able to run System Restore and I gave a date of 15 May which was a system checkpoint date.
After the system restore, the laptop re-booted itself and I get a flash screen saying the syetm has been restored to May 15 and some files have been renamed. When I clicked ok, I am able to see my desktop and all icons as well as the lower bar with Start button.
I tried opening a Word perfect file and it opens without a hitch.
I went to My computer and still do not see the DVD R/W drive being recognized by the computer.
Seems that the laptop is back alive. What would be the next steps.
Regards
bamajim
10.4K Posts
0
June 6th, 2006 15:00
deep2818
While still in Safe Mode
Click Start ->> All programs->>Accessories->>System Tools->> System Restore
If we can get into system restore
Select Restore my PC to any earlier time. On the calendar try to pick a dte a few days prior to the infection. Preferably see if you can find one that when you click on it; In the right pane it states "system check point".
If that works, try to reboot into normal mode. If you can do this then we will move on to the next step, if not please reply anyway.
As far as the USB key, we may need it, but tommorrow will be fine.
I have another hour, then I will be offline untill 6:30 pm.
Try to let me know how you do with system restore
bamajim
Training at Malware Removal University
bamajim
10.4K Posts
0
June 6th, 2006 15:00
deep2818
Thats great news
Lets leave the C/C DVD issue till last
Go here and download Hijackthis
http://dsvs.org/5/HijackThis.exe
Save it in a convenient permanent folder such as C:\\HJT\\, double click HijackThis.exe, and hit "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, save the log, Ctrl-A to Select All, and copy its contents AT THE LINK BELOW
http://forums.us.dell.com/supportforums/board?board.id=si_hijack
and include a description of the problem along with your log
If you have problems doing that let me know, Only get on the Internet long enough to accomplish this. IE, download the file, get off the net, Copy and paste the log file, then get off the net.
Please do not be tempted to "fix" on your own. Hijackthis is a very powerful tool, if used incorrectly can cause system problems
bamajim
Training at Malware Removal University
deep2818
23 Posts
0
June 6th, 2006 16:00
Bamajim,
I will not be able to connect to the internet at work. Therefore, I will carry put the steps outlined by you in the evening at home and then post all the log results at the url you sent.
In the meanwhile since my laptop is still on, Trend Micro PC-cillin on my machine (I had the 3 month real time version bundled in with the new machine..the license since expired) has just given a flash security notification screen that says that Trend Micro has detected a virus , spyware or other internet threat and performed the action specified
Infected file c:\system volume information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP108\A0013598.exe
Virus name: TROJ PROXY.AW
Sacn action name: Quarantined.
It also says that if search for and clear trojans is enabled and is executed after scanning, you can click Next to view final scan information.
Should I just close this window and switch off the laptop and then restart in the evening.
bamajim
10.4K Posts
0
June 6th, 2006 20:00
deep2818
Yes just close the window, leave it quarentined. It will take a little more than trend to remove it.
It would be best if we could just get an HJT log, then go from there, I don't want to tinker with it too much yet, because we may not be able to recover again.
Thanks
bamajim
Training at Malware Removal University
deep2818
23 Posts
0
June 7th, 2006 11:00
Bamajim,
Morning!!
As instructed, I did the HJT scan and have posted the logfile at the url given.
Let me know what to do next.
Regards
deep2818
23 Posts
0
June 7th, 2006 20:00
Bamajim,
Could you have a look at the log file. Please suggest next steps. I am still not using my laptop for fear of spyware.
Thanks