Computer is misbehaving--annoyingly

[wumply]

Actually, it's my son's computer but we were trying to solve the problem together and I said I'd write Techzonez for help--since System Restore would not restore.

This may be the wrong forum...but I've no clear idea whether the problem is spyware, a virus or just screwed-up XPSP2, Pro edition. We suspect a virus or spyware/

The problem began about April 8. System Restore efforts to restore back to April 6 and 7, and then to April 2 and 3 all resulted in "System Restore can't restore to these dates."

Here's what is happening:

When we are using a Videochat program (a very good one - not free), Bruce's monitor will suddenly go black, then the computer shuts down and reboots.

A NAV virus scan will in the middle of its run, result in the computer suddenly shutting down all by itself and then rebooting.

The homepage in MSIE defaults to http://www.safetydefender.com every time MSIE is called up.

Spybot, run after an update, finds nothing.

On or about April 8 two programs appeared in the Program listing. We've no idea how they got there. They are: Security Troubleshooting; url is http://youronlinesecurity.com. Then: Onlinesecurity Guide; url is http://safetydefender.com. They appeared like legitimate sites--I found the first one anyway via Google and visited the site and have had no problem. ????

Has someone run into this situation/problem and so can advise us re cause and solution?

Thanks!

[adeydas]

Looks like a Spyware problem to me, the sites are pretty flimsy.

[Stripe]

I think that you have 2 problems that may or may not be related.

PC reboots - sounds more like a bad driver or file. The PC automatically rebooting is the XP'ish BSOD. To see whats really going on, turn off the reboot. Right click the My computer icon, left click properties, click the Advanced tab, and then click the Settings button in the Startup and Recovery section. In the next Window that pops up, uncheck the 'Automatically restart' option and ok out of everything. Now try your video chat program and write down the error that occurs. Also, try the NAV and write down that error as well.

The 'mysterious programs' and the browser hijack probably just needs to be cleaned. If spybot didnt show anything, than I would try Adaware (there's a free version somewhere on that page). Once those are run (and run them a few times), then reset your browser homepage back to what you want.

[FastGame]

On or about April 8 two programs appeared in the Program listing. We've no idea how they got there. They are: Security Troubleshooting; url is http://youronlinesecurity.com. Then: Onlinesecurity Guide; url is http://safetydefender.com. They appeared like legitimate sites--I found the first one anyway via Google and visited the site and have had no problem. ????

Hi wumps, those two sites are real bad and so are the programs http://www.spywarewarrior.com/rogue_anti-spyware.htm

Yes I would say he's infested......

What should he do ? considering system restore is borked, crashes, I'd pull my important data off and reinstall XP.

You could try and remove the programs, use MS WindowsDefender, and this http://www.techzonez.com/forums/showthread.php?t=18317

[wumply]

Thanks Everyone. I'll post results when known!

[wumply]

Here's what we've tried and the results.

After down loading and installing Ad-aware it took a couple of tries to get a complete scan of the computer without it's shutting down in the middle of the scan. Once it had made it through, I found 26 critical items; all were tracking cookies which I quarantined and then removed. After that I ran the scan again and found nothing. So then I started IE and it still had the wrong home page. I changed it to the home page I used before-- Comcast---and clicked apply. Whereupon it went to a different page (Ebay). Then I clicked on the home button but it did not take me back to the Comcast web page as it should have. I have no doubt that the programs that just appeared (see initial post) in my programs list are causing this to happen but when I go in to add/remove they are not in the list. I've noticed another difference btw: a security tool bar in IE that Ido not remember being there before.

So my question is: How can I get rid of the 2 programs in the program menu if they do not show in add/remove?

After closing down IE I ran the scan again; it got about 1/2 way through before my computer shut down and restarted. Then I get the blue screen with a different problem every time I see it. But only the first time did I get any thing I could sort of understand: it said DRIVER_IRQL_NOT_LESS_OR_EQUAL. Every other time it appeared it showed me only a bunch of numbers. ?????

When, at this point, I restarted the comp again and ran the Ad-Aware scan, Ad-Aware found 24 tracking cookies. I quarantined and deleted them. Next I restarted the comp one more time, reran the scan and got the same result..

Every one is a "Data Miner"

What now?

[rik]

Try an anti-virus scan then d\l and run the free demo of Trojan Hunter from http://www.misec.net/

If it finds anything, get rid of it. Might then try running HiJack This and post the results to see if anything is lingering.

[adeydas]

Or you can backup your data and format the hard disk, it looks pretty messed up to me.

[wumply]

rik--Bruce says your 2 suggestions didn't solve the problem. He's going to try the Repair Install procedure (using the XP CD) per www.michaelstevenstech.com...if that works, he won't have to format. If it doesn't, then I guess a format is the only option left.

Well, we will see. I'm afeared, Adeydas, that your pessimism will be justified. If so, Damn!