Re: multiple windows opening

PA Bear is right, I believe, about OneCare incorporating Defender and
it's own firewall.

How he *knows* you have a Rootkit is beyond me (unless he knows how it
got there - food for thought!) Perhaps he'll tell *you* if you ask him!
;)

I noticed this entry in your HJT log

O23 - Service: Symantec Core LC - Unknown owner -
C:\PROGRA~2\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe (file missing)

Copy and paste that whole line into Google and explore the results you
get (I get 151 hits!)

Did you have Norton/Symantec installed on your computer before OneCare?
--
Dave


"village idiot" <villageidiot@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:35B7884A-E287-4E39-A2A9-D96E991A1295@xxxxxxxxxxxxxxxx
Oh nutz!!!!!!!!!!

I have had windows live one care from the first setup of this laptop.
When
I open it, it shows that the firewall is on, the virus thing is
on....... all
systems go.....

But, when I went to control panel security just now, it showed that
the
firewall was off. Windows defender is also off.

When I had XP and windows one care, I remember that I was told to turn
off
windows defender because it conflicted with one care. That is on my
desktop...XP.

I thought that in vista, and one care, that windows defender was
integrated.
So, do I need to turn on the firewall and windows defender through
control
panel security?

I will wait for PA Bear to reply before I post my hjt log to the site
that
you listed.

Thanks!
village idiot

"~BD~" wrote:

Hi!

I copied and pasted your HJT log into www.hijackthis.de

A comment I noticed was .......

"It seems that you don't use an anti-virus scanner or your scanner is
not active. Only an anti-virus scanner can protect you against new
viruses. You can look here for a good anti-virus scanner. "

We didn't detect any active process of a firewall on your system.
Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don't use any firewall at all.
We recommend you to use a firewall. Download and install one or
activate
windows xp´s own one. In case you got questions or you want us to add
the firewall you use to our database, contact us at our forum.

*****

Try posting your log there for yourself!

--
Dave


"village idiot" <villageidiot@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:393652CB-642F-4BDD-9099-19A9479F4DA4@xxxxxxxxxxxxxxxx
HI PA!

AAARRRGGGHHHHHHHH and OH NO. So, I will have to do something to my
desktop
too?..... before I take care of my laptop??????

Okay........ here is the link to my hijack log. I posted it on the
15th. I
first posted one on Jan. 2nd, and got no response, so I did a new
hjt
on the
15th, and reposted. Still no replies.
http://www.lavasoftsupport.com/index.php?showtopic=22914

Will be waiting for your wonderful help. Uh, the hjt log from the
15th was
before I cleaned the registry...... if that matters.

Thanks so much!!!!!!!
village idiot

"PA Bear [MS MVP]" wrote:

I have had one care from the beginning. Ad-aware found the
first
and only
critical thing that was the PWSmapper thing. It removed it. I
have
cleaned
my registry. I have run onecare and ad aware everyday for weeks
now.
Nothing has worked.

Please give us a link to the forum thread where you've posted your
HijackThis log.

[Think your Registry needs "cleaning" or "repairing"? Read
http://aumha.net/viewtopic.php?t=28099 and draw your own
conclusions.]

No, the hidden Recovery/Restore partition had not been affected.

Second question is......... is it possible that my desktop
transferred
this
problem to my laptop? Desktop has been just as slow as my
laptop
is now,
for quite a while. I'm pretty sure it was s-l-o-w before I got
my
laptop.
Is it possible that my laptop could have "caught" something from
the
router
that is connected to my desktop?

Yes, no question about it (cf.
http://aumha.net/viewtopic.php?f=30&t=36886
and http://aumha.net/viewtopic.php?f=48&t=37919).
--
~PA Bear

village idiot wrote:
Too late PA!

I have gone through all of your articles, downloads, google
searches,
etc..
I have had one care from the beginning. Ad-aware found the
first
and only
critical thing that was the PWSmapper thing. It removed it. I
have
cleaned
my registry. I have run onecare and ad aware everyday for weeks
now.
Nothing has worked. My laptop still opens continuous multiple
windows at
times, about once every few days. It freezes. And, it is
slower
than my
first computer in 1995 that had dial up. I am using comcast
cable
with a
router from my desktop now.

So, before I lose my mind, I have decided that I should probably
just do a
full recovery.

My HP laptop is new since Aug 08. I have no important files or
downloads.... nothing that I cannot lose..... (other than my
mind).

I have 2 major questions before I start this.

I did not make recovery discs, so I will be doing a recovery
using
HP
recovery manager using the partition thingy. BIG QUESTION
is......... is
it
possible that whatever is causing my problems got into this
partition
recovery part of my computer??????????????

Second question is......... is it possible that my desktop
transferred
this
problem to my laptop? Desktop has been just as slow as my
laptop
is now,
for quite a while. I'm pretty sure it was s-l-o-w before I got
my
laptop.
Is it possible that my laptop could have "caught" something from
the
router
that is connected to my desktop?

Can't wait to hear your reply to this! hehe

THE village idiot



"PA Bear [MS MVP]" wrote:

Slow down, bucko! <wink>

1. You are NOT to install OneCare, just run the Safety scan
here:
http://onecare.live.com/site/en-us/center/howsafe.htm (I assume
you
already
have an anti-virus application installed.

In any event, *should* you choose to replace your current
anti-virus
application with OneCare, it's safe to ignore the false warning
about
Ad-Aware: Both can reside nicely on your machine.

2. You do NOT have to purchase Ad-Aware 2008. Just click on
the
green
DOWNLOAD button on the left-hand side of
http://www.lavasoft.com/single/trialpay.php; you'll then be
redirected to
the mirror site
http://www.download.com/Ad-Aware-2008/3000-8022_4-10045910.html.
(Yes,
the
first page is a little confusing.)

3. After complete Steps #1 and #2 in my first reply, following
the
instructions at http://aumha.net/viewtopic.php?t=4075, then
Register and
begin a new thread in this forum:
http://aumha.net/viewforum.php?f=30

Don't try to overthink this, OK?

PS: Thanks for your kind words.

village idiot wrote:
OH NO!!!!!!!!!!!!! I rebooted b4 I started the processes on
mvps.org,
and
one care tells me that I need to remove ad-aware because it is
interferring
with one care, and could cause problems.
<paste>
Thanks so much for the input. I am still working my way
through
all of
the
articles and advice you gave. I bought ad-aware 2008, and
evidently the
scan did not finish. So per the lavasoft folks, I uninstalled
and
reinstalled. The scan found win32.TrojanPWS.mapper
I clicked remove.

My first big question is this.......... If this is a password
stealer,
as
i
have read here somewhere....... is it safe to continue using
my
old pws,
or
do I need to change all of my pws????!!!!!!!!!!!!!!!!

I still have strange things happening, such as, when I request
a
pw and
it
is sent to my email, I will find in my spam folder, an email
re
"my
password
trouble" at same time I sent the request for pw. I don't open
the spam
email, I just see the first sentence, and note that the time
is
the
same.

After the reinstall, ran a quick scan, and there were only
cookies. I
have
not run a full scan again yet. I wanted to find out
this.......

Is it normal for full scans to take 2 hours?????? When I
run
one
care,
it
always takes this long.....from the first scan on my NEW
computer
after
I
had used it for only a couple of weeks.

And, my first ad-aware scan last night, that stopped b4 it was
finished
(per
its log, I stopped the scan.. I did not,, and hence the
unistall,
reinstall)
That scan was set to "full scan" and it had taken about an
hour
before
it
shut down.

I don't mind the time........ IF it is supposed to take that
long. But,
I
need to know, because I worry that it takes too long because
of a
problem.
Please let me know!!!

I am fixing to run through the procedures from the mvps site
you
listed,
but
I wanted to ask those questions first.

Oh......... this is happening on my new laptop. I got a
router
from
comcast, that is connected to my desktop. Could this problem
come from
my
desktop to my laptop? And, if not, do you think it is safe to
use my
desktop at sites where I have to use my passwords?????
</paste>

"PA Bear [MS MVP]" wrote:

Chances are that you're seeing the affects of a hijackware
infection.

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

2. Run this online scan (in safe mode w/networking, if need
be):
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run additional checks for hijackware, including posting
your
hijackthis
log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred
tool to
use
(in conjuction with some other utilities). HijackThis will
NOT
fix
anything on its own, but it will help you to both identify
and


.

Relevant Pages

  • Re: multiple windows opening
    ... would not send me a laptop w/o it, ... I open it, it shows that the firewall is on, the virus thing is ... Windows defender is also off. ... When I had XP and windows one care, I remember that I was told to ...
    (microsoft.public.security)
  • Re: multiple windows opening
    ... I have had windows live one care from the first setup of this laptop. ... do I need to turn on the firewall and windows defender through control ...
    (microsoft.public.security)
  • Re: multiple windows opening
    ... When you install OneCare, it will automatically disable the Windows Firewall and Defender on its own. ... I have had windows live one care from the first setup of this laptop. ...
    (microsoft.public.security)
  • Re: multiple windows opening
    ... When you install OneCare, it will automatically ... I have had windows live one care from the first setup of this laptop. ... I open it, it shows that the firewall is on, the virus thing is ...
    (microsoft.public.security)
  • Re: multiple windows opening
    ... I have had windows live one care from the first setup of this laptop. ... I open it, it shows that the firewall is on, the virus thing is ...
    (microsoft.public.security)