Re: multiple windows opening

OneCare (in WinXP and Vista) includes its own firewall and its own version of Defender. When you install OneCare, it will automatically disable the Windows Firewall and Defender on its own.

NB: Do not use or trust any HJT interpretation sites or tools like hijackthis.de. (It couldn't tell that OneCare was installed but disabled by the rootkit!)

village idiot wrote:
Oh nutz!!!!!!!!!!

I have had windows live one care from the first setup of this laptop. When
I open it, it shows that the firewall is on, the virus thing is on.......
all systems go.....

But, when I went to control panel security just now, it showed that the
firewall was off. Windows defender is also off.

When I had XP and windows one care, I remember that I was told to turn off
windows defender because it conflicted with one care. That is on my
desktop...XP.

I thought that in vista, and one care, that windows defender was integrated.
So, do I need to turn on the firewall and windows defender through control
panel security?

I will wait for PA Bear to reply before I post my hjt log to the site that
you listed.

Thanks!
village idiot

"~BD~" wrote:

Hi!

I copied and pasted your HJT log into www.hijackthis.de

A comment I noticed was .......

"It seems that you don't use an anti-virus scanner or your scanner is
not active. Only an anti-virus scanner can protect you against new
viruses. You can look here for a good anti-virus scanner. "

We didn't detect any active process of a firewall on your system.
Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don't use any firewall at all.
We recommend you to use a firewall. Download and install one or activate
windows xp´s own one. In case you got questions or you want us to add
the firewall you use to our database, contact us at our forum.

*****

Try posting your log there for yourself!

--
Dave


"village idiot" <villageidiot@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:393652CB-642F-4BDD-9099-19A9479F4DA4@xxxxxxxxxxxxxxxx
HI PA!

AAARRRGGGHHHHHHHH and OH NO. So, I will have to do something to my
desktop
too?..... before I take care of my laptop??????

Okay........ here is the link to my hijack log. I posted it on the
15th. I
first posted one on Jan. 2nd, and got no response, so I did a new hjt
on the
15th, and reposted. Still no replies.
http://www.lavasoftsupport.com/index.php?showtopic=22914

Will be waiting for your wonderful help. Uh, the hjt log from the
15th was
before I cleaned the registry...... if that matters.

Thanks so much!!!!!!!
village idiot

"PA Bear [MS MVP]" wrote:

I have had one care from the beginning. Ad-aware found the first
and only
critical thing that was the PWSmapper thing. It removed it. I
have
cleaned
my registry. I have run onecare and ad aware everyday for weeks
now.
Nothing has worked.

Please give us a link to the forum thread where you've posted your
HijackThis log.

[Think your Registry needs "cleaning" or "repairing"? Read
http://aumha.net/viewtopic.php?t=28099 and draw your own
conclusions.]

No, the hidden Recovery/Restore partition had not been affected.

Second question is......... is it possible that my desktop
transferred
this
problem to my laptop? Desktop has been just as slow as my laptop
is now,
for quite a while. I'm pretty sure it was s-l-o-w before I got my
laptop.
Is it possible that my laptop could have "caught" something from
the
router
that is connected to my desktop?

Yes, no question about it (cf.
http://aumha.net/viewtopic.php?f=30&t=36886
and http://aumha.net/viewtopic.php?f=48&t=37919).
--
~PA Bear

village idiot wrote:
Too late PA!

I have gone through all of your articles, downloads, google
searches,
etc..
I have had one care from the beginning. Ad-aware found the first
and only
critical thing that was the PWSmapper thing. It removed it. I
have
cleaned
my registry. I have run onecare and ad aware everyday for weeks
now.
Nothing has worked. My laptop still opens continuous multiple
windows at
times, about once every few days. It freezes. And, it is slower
than my
first computer in 1995 that had dial up. I am using comcast cable
with a
router from my desktop now.

So, before I lose my mind, I have decided that I should probably
just do a
full recovery.

My HP laptop is new since Aug 08. I have no important files or
downloads.... nothing that I cannot lose..... (other than my mind).

I have 2 major questions before I start this.

I did not make recovery discs, so I will be doing a recovery using
HP
recovery manager using the partition thingy. BIG QUESTION
is......... is
it
possible that whatever is causing my problems got into this
partition
recovery part of my computer??????????????

Second question is......... is it possible that my desktop
transferred
this
problem to my laptop? Desktop has been just as slow as my laptop
is now,
for quite a while. I'm pretty sure it was s-l-o-w before I got my
laptop.
Is it possible that my laptop could have "caught" something from
the
router
that is connected to my desktop?

Can't wait to hear your reply to this! hehe

THE village idiot



"PA Bear [MS MVP]" wrote:

Slow down, bucko! <wink>

1. You are NOT to install OneCare, just run the Safety scan here:
http://onecare.live.com/site/en-us/center/howsafe.htm (I assume
you
already
have an anti-virus application installed.

In any event, *should* you choose to replace your current
anti-virus
application with OneCare, it's safe to ignore the false warning
about
Ad-Aware: Both can reside nicely on your machine.

2. You do NOT have to purchase Ad-Aware 2008. Just click on the
green
DOWNLOAD button on the left-hand side of
http://www.lavasoft.com/single/trialpay.php; you'll then be
redirected to
the mirror site
http://www.download.com/Ad-Aware-2008/3000-8022_4-10045910.html.
(Yes,
the
first page is a little confusing.)

3. After complete Steps #1 and #2 in my first reply, following the
instructions at http://aumha.net/viewtopic.php?t=4075, then
Register and
begin a new thread in this forum:
http://aumha.net/viewforum.php?f=30

Don't try to overthink this, OK?

PS: Thanks for your kind words.

village idiot wrote:
OH NO!!!!!!!!!!!!! I rebooted b4 I started the processes on
mvps.org,
and
one care tells me that I need to remove ad-aware because it is
interferring
with one care, and could cause problems.
<paste>
Thanks so much for the input. I am still working my way through
all of
the
articles and advice you gave. I bought ad-aware 2008, and
evidently the
scan did not finish. So per the lavasoft folks, I uninstalled
and
reinstalled. The scan found win32.TrojanPWS.mapper
I clicked remove.

My first big question is this.......... If this is a password
stealer,
as
i
have read here somewhere....... is it safe to continue using my
old pws,
or
do I need to change all of my pws????!!!!!!!!!!!!!!!!

I still have strange things happening, such as, when I request a
pw and
it
is sent to my email, I will find in my spam folder, an email re
"my
password
trouble" at same time I sent the request for pw. I don't open
the spam
email, I just see the first sentence, and note that the time is
the
same.

After the reinstall, ran a quick scan, and there were only
cookies. I
have
not run a full scan again yet. I wanted to find out this.......

Is it normal for full scans to take 2 hours?????? When I run
one
care,
it
always takes this long.....from the first scan on my NEW computer
after
I
had used it for only a couple of weeks.

And, my first ad-aware scan last night, that stopped b4 it was
finished
(per
its log, I stopped the scan.. I did not,, and hence the unistall,
reinstall)
That scan was set to "full scan" and it had taken about an hour
before
it
shut down.

I don't mind the time........ IF it is supposed to take that
long. But,
I
need to know, because I worry that it takes too long because of a
problem.
Please let me know!!!

I am fixing to run through the procedures from the mvps site you
listed,
but
I wanted to ask those questions first.

Oh......... this is happening on my new laptop. I got a router
from
comcast, that is connected to my desktop. Could this problem
come from
my
desktop to my laptop? And, if not, do you think it is safe to
use my
desktop at sites where I have to use my passwords?????
</paste>

"PA Bear [MS MVP]" wrote:

Chances are that you're seeing the affects of a hijackware
infection.

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

2. Run this online scan (in safe mode w/networking, if need be):
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run additional checks for hijackware, including posting your
hijackthis
log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred
tool to
use
(in conjuction with some other utilities). HijackThis will NOT
fix
anything on its own, but it will help you to both identify and

.