Scanned for malware lately?

 

What version of XP, including Service Pack number , is on the hard drive? Do you have your Dell XP Reinstallation CD, and what version and service pack is on that CD?

 

Try booting in Safe Mode (F8 before XP starts to load). If you don't experience any problems starting or shutting down, then you may have a corrupted hardware driver.

 

Ron 

Peter,

Run adaware and spybot. 

 

You have to contact Dell Tech Support in UK to see if they'll send the disks to you. I suppose you could try requesting them through the US site, but I don't know if that will work.

 

<>Let's try something different, assuming adaware and spybot don't find anything. Go here and download the file to your desktop with the name: "save.reg" (without the quotes).  Log off the net and close everything that's running in the background. Then:

 

Start>run

type in: regedit

click ok

 

Click "My Computer" at the very top of the list in the left pane. Then click File>export on the toolbar. Give it a name and let it export a complete copy of your registry to a folder location you'll remember on the hard drive (it'll be a big file). Exit regedit without changing anything. This is just a precaution in case something else goes seriously wrong. ;)

 

Now double-click on save.reg you downloaded from Kelly's Korner. Accept the offer to modify the Registry. This will rewrite the entries in the Registry required to "Save settings on exit".

 

Shut down normally and reboot. Now go here and download User Profile Hive Cleanup Service, free from Microsoft, onto the desktop. Double-click it to install; you won't see any response from XP after it runs. Now shut down normally and reboot.

 

Hopefully that will fix the problems.

 

Ron

 

Ron - thank you very much indeed for your response.

 

(1)  I am running ZoneAlarm Security Suite which does a regular weekly check on Fridays.  I also have Spybot and Adaware but haven't run these recently.

 

(2)  On my hard drive I have Win XP Media Centre 2002 Edition, Service Pack 2.  I do not

unfortunately have any Dell XP Reinstallation CD which was not supplied when my pc was new.  I have been trying to find out where to obtain this disk from in the UK and have asked on the other thread (PC Restore which I posted on 09/18/08) but sadly, no-one has replied.  I seem to be going around in circles!! 

 

(3)  I tried booting in Safe Mode as you suggested.  I could get as far as the long list of drivers which the pc was trying to load, but it got stuck there and after 10 minutes I did a manual shut down.  When I started it up again, it began a check of the file system without being asked (plain blue screen with a dark blue top):

 

............Checking file system  NTFS

            the volume is dirty.

CHKDSK is verifying files

File verification complete

CHKDSK is verifying Indexes          .............then a mention of "descriptors" but I couldn't copy it down quickly enough.

Cleaning up index entries followed by a long list.              .............then that all disappeared and the pc started up normally.

 

I would dearly love to be able to go back to a Restore Point, but this has not been possible, due to the inability to do a reboot successfully (it gets stuck at the "Saving your files").  Then I thought about doing a PC Restore, but that facility appears to be damaged (see the other thread, which has now gone cold).

 

Can you offer any further help please?

Peter

 

Ron

 

Very many thanks for your help and support.

 

(1)  I have contacted Dell Tech Support in UK (not as straight forward as you might think!) to request reinstallation disks.  No, this won't work via the US site.

 

(2)  I ran Spybot and Ad-aware.  There were a number of "nasties" present which Spybot found including Smitfraud-C.gp, Spyhunter, MywayMywebSearch, Zlob.downloader.bs etc.

 

(3)  Just to be on the safe side I also saved a copy of the Registry onto the desktop, and then downloaded the modification from Kelly's Korner for the registry.  Then the User Profile Hive Cleanup Service.  This all now appears to have done the job. 

  

At the end of your recommended actions I did an automatic shut down which was eventually successful after a long pause.  When switching back on again I got an error "System Settings Protector detected an error and needs to close - send Report?".

 

Do I have to retain the copy of the Registry on the hard drive and also the UPHC on the desktop which I downloaded, or can they be deleted?

 

Peter

Progress!

 

I can believe it's difficult to get the CDs from Dell-UK. I'm trying to help another forum member get the CDs from Dell-France.

 

Are you running a firewall? A good firewall should have caught those nasties and stopped them from invading your system. I'd cut the fingers off anyone caught distributing malware so they can't ever use a PC again. I'd make a good dictator! :D

 

If you want to be paranoid, post a HijackThis log on that forum and have one of the resident experts over there review it to make sure your system is really clean now. Be sure to click the red link at top of that page and read all the FAQs before posting your HJT log.

 

You can delete UPHC from your desktop. The service should be permanently installed into Windows now and you don't need the installer. If you want to confirm UPHC is actually working:

 

click start>run

type in: services.msc

click ok

Look for User Profile Hive Cleanup on the list that appears and confirm that it says "started" next to the name. Exit without changing anything.

 

I'd hold onto the Registry backup a bit longer. If you need the space, burn it on a CD and delete it from the hard drive.

 

After that error message, can you still get to the desktop and use the PC or does it just crash/burn? The message apparantly comes from Spybot's Teatime, so read this. You may have to uninstall it and install the latest version of Teatime.

 

Ron

Ron 

 

Yes I am running a firewall - ZoneAlarm Security Suite contains one which is operative.

 

UPHC - yes I have checked that this is working, as you suggested.

 

< this . You may have to uninstall it and install the latest version of Teatime.>>

 

Yes, I can still get to the desktop and use the pc. I have installed the latest version of Teatime but couldn't see how to uninstal the old version because it seems to be hidden. 

 

This shut down problem is still recurring as I had to do a manual shutdown again yesterday. I ran Spybot and Ad-Aware again today and when I rebooted, there was a wait of about 4 mins at the "Windows is shutting down" stage before it rebooted.  I can't update Ad-Aware and I get the message "error retrieving update".    I therefore believe there are still problems.

 

I meant to mention that the system tray often does not appear.

 

I haven't as yet done the HijackThisLog on the other forum but I will do, if you don't want me to try anything else first.

 

Peter

Can you run TeaTime and ZoneAlarm Suite at same time? Sometimes antiviral software conflicts with each other.

 

You may have to uninstall all of Spybot to get rid of TeaTime. Then reinstall Spybot and the latest TeaTime.

 

I get the same error message trying to download Adaware updates too. Have no idea why...

 

What version of XP, including Service Pack number, is on the hard drive? And do you have your Dell XP Reinstallation CD?

 

You might want to post the HijackThis log sooner than later. If the system is infected, no amount of twiddling is going to make it right again until it's clean.

 

Ron

 

 

 

 

Ron

 

I did a HijackThis scan earlier today but when I tried to post a copy of the scan log onto a new message in the HJT forum, I received a warning message to say that the body of my message contained prohibited content **********    "you must remove this content before submitting your post".  I checked the log twice and I couldn't see where the bad letters were; they absolutely MUST have been somewhere in that Log.   I then wrote to you here with the suspect content where the asterisks are above, but I separated the letters concerned by spaces.  That message to you has been removed, and I have received a warning from Dell as apparently it violates the Dell Community Terms of Service.  I am absolutely appalled by this as I would never intentionally transmit anything objectionable, least of all to someone like you who has been so kind and helpful to me.   So I am stuck.

 

Your other queries:

 

Yes, I do seem to be able to run ZoneAlarm at the same time as Spybot/Teatime. I hadn't actually realised what Teatime was.  Anyway the error warning I was getting at start-up seems to have gone away now.

 

I am running XP Media Centre 2002 edition S/P 2

 

No, I haven't got my Dell re-installation CD.  As you know, I was trying to obtain it from UK Technical Support who I emailed last Saturday.  No-one has replied yet as to how I obtain the disks but I do have a Case number.

 

a rather confused Peter.

Peter,

I saw that one of your messages had been deleted from this thread. The Dell censor gets crabby some times. I'll see what I can do about that. You can try to send me a PM with the prohibited text but I don't know if the censor will object there too. Click the envelope near the top of the forum screen and see if you can get it to me. That way, I'll see what the Moderators can do...

 

Glad that error has disappeared. So aside from not having the XP CD and not being able to post the HJT log, is the system working ok now?

 

Edit: One of the gurus in Dell's HJT forum suggested you post your HJT log on spyhammer. Some of the same experts that work Dell's HJT forum also work over there. You'll have to register to post your log there, but you won't have Dell's stupid censor to deal with. ;)

 

Ron

I see you posted a HJT log on SpywareHammer. At least I think it's you with a slightly different nom de plume. I heard through my contacts that it may take a bit of time before anyone can to go through your log in detail over there, so please be patient. But at first glance they didn't notice anything obvious.

 

You have a LOT of stuff running in the background, so you might want to disable things at startup (but not your antiviral software or firewall!) to see if that speeds it up.

 

It also appears you still have SP2 on your hard drive. In that case maybe a windows system file check will solve your other problems.

 

Click start>run

Type in: sfc /scannow

(space between sfc and /)

Click OK

Insert XP CD if sfc requests it and reboot when it's done.

 

Ron