some websites think i'm not using firefox, acting strange

[Marin85]

maybe there's a NOD32 setting i can adjust? i was happy with nod32 for a while, and only recently i have 2 problems with it now!?

If I was you, I would have been too

can we be sure the free AV software Avira Antivir is just as good?

No, we can´t. All one can know are some AV rankings based on some tests. For that matter, Avira actually received very good opinions in some recent reviews.

ah, while on the topic, is it generally recommended to have live active spyware protection? i usually just use those softwares for periodic scans, not live protection...

Yes and No. It all depends on one´s paranoia levels and what one does on his ThinkPad. No, because installed as active protection such programs tend to mess with windows components, can make things slow and even break a system at some point.


Marin

[wild_bill]

I have a T60p and I fix laptops for a living at work. I have never had any problems out of NOD32, so I would forget that red herring. I'll tell you what is the most common cause I see when working on these computers acting weird or freezing up, and that is DUST.

my suggestion is to use the T60 hardware maintenance manual available at lenovo.com and make sure you are wearing all cotton clothing, barefooted, and then carefully open your computer by following the instructions on removing the battery, palm rest and keyboard in that order, then take a new 1" trim paintbrush and a vacuum cleaner and get busy all over the inside of your system, especially in the CPU fan area! don't forget the exhaust area in the back left corner outside the case near the Esc key

you might be quite surprised with the how the computer runs!

If that doesn't solve it, then one of the following will:

1. check the voltage of the CMOS battery and replace if below 3.1V
2. clean CPU and apply very thin coat of Arctic Silver and reinstall heat pipe assembly (if working on tiny things is not your forte, then this step is not for you)
3. a clean install of the OS

cheers! wild bill

[allen]

avira pauses the entire scan if it finds something!? forget that!?
i don't sit at my computer the whole time it scans, so silly, removing it and trying avast. i couldnt do anything to get eset to let my internet connect!? maybe i can go back to 3.0.650, i'll keep trying

oh i wanted to mention, avira found 2 things that aren't viruses, and it seems i have some bugs...
when i try to open regedit now, it restarts explorer.exe instead, and when i go to avira, avast, and other av comparison sites, the site i want gets skipped to a suspect looking site, and i have to hit back to get to the site i want...

[GomJabbar]

IMO, you need to do the following. It is important to be in SAFE MODE when you do the following.

Boot up into SAFE MODE and uninstall all antivirus and antispyware applications that you have installed. While still in SAFE MODE, run a scan of Malwarebytes' AntiMalware. See what it finds. Depending on what malware you were infected with, you may have to run some other more specialized virus removal tools.

Once done with that, while still in SAFE MODE, from a command prompt run sfc /scannow
http://support.microsoft.com/kb/310747

Once done with that, reset the Winsock: http://support.microsoft.com/kb/811259

To repair Winsock if you have Windows XP Service Pack 2 (SP2) installed, type netsh winsock reset at the command prompt, and then press ENTER.

I would think the above would be enough, but you might have to uninistall Firefox, then reinstall it.

Reinstall your preferred antivirus software. Do not install multiple antivirus software programs, as they can conflict with one another. Personally I recommend Avira AntiVir, but there are other good ones out there too.

If the above is insufficient, then I suggest you go to http://www.bleepingcomputer.com/ where they specialize in these sorts of problems.

[allen]

hey, thanks for the advice gomjabbar, i was going about your suggeestions, i removed all antivirus software, i only had one installed at a time, i tried avira and avast and don't like either. i ran malwarebytes, and from marin's suggestion, downloaded and ran WinsockxpFix.exe in safe mode.

when i start windows in safe mode w/ command prompting, first, explorer doesnt startup unless i hit ctrl alt del, and run explorer.exe. but from there, i can't get start>run to run cmd, or sfc /scannow, and it crashes exlplorer.exe sometimes.

in regular mode, not safe mode, i was able to get sfc /scannnow to run by typing sfc /scannnow in the run field, and it ran for a bit and i think finished... not sure if it did everything it would've in safe mode or not.

is netsh winsock supposed to work in xp pro sp3 as well? is it better than using WinsockxpFix.exe? does it take some time? when i try netsh winsock, a command prompt window flashes and is gone instantly.

and if i do start>run and type cmd and hit enter, explorer.exe still crashes.

this is all very strange to me, what now!?
i can't believe this problems have gotten so complex!?

i think my main issue to tackle right now is getting cmd to run... in safe and regular modes

[GomJabbar]

It might be best to cut your loses, copy all your important files to DVD's or CD's, and reinstall Windows XP and your programs. Before you copy any files back to your system, be sure and run a virus scan on those DVD's or CD's.

That Winsock reset command should work in XP SP3. It does work in Vista afterall.

[allen]

[censored], come on, there must be a way to fix cmd?

is windows xp pro really this vunerable?

[GomJabbar]

Good luck to you. With enough effort you might get everything working properly again.

The questions you have to ask yourself are:
How much time have you spent so far?
How much more time may you yet spend?
Will you end up with everything working properly?
vs.
How much time will it take to reinstall XP, do all the Windows updates, reinstall your software, and copy over your files?

Try using Microsoft Help and Support search feature and Google to look for answers if you wish to press ahead on your present course. I am not saying that I am the last word on this. I am just giving my opinion. Several years ago, our family PC got infected with CoolWebSearch because my daughter downloaded and installed some smilies from smileycentral.com. I got rid of coolwebsearch, but XP still was not working properly. After a couple of days at this, I just reinstalled XP and never looked back.

EDIT: You might find the following old post of mine informative. In addition to what I wrote there, in XP I have a Power Users account for day to day computer use. I reserve the default Administrator account for administrative tasks. Also, make sure you keep all software that uses the internet fully up-to-date and patched. This includes things such as Adobe Flash, Adobe Reader, Java, Web browsers, E-mail clients, Antivirus software, etc.
http://forum.thinkpads.com/viewtopic.php?t=13180

[allen]

ah. There's just so much setting up and configuring of preferences when reinstalling everything.

I read the other post. And i thought i had a pretty solid system going. but all those methods can get bugs, or slow down the system too much. And all background stuff scanning and keeping everything up to date...

How well do i have to be versed in how much extra software just to function? How much money or software pirating is needed? Firewalls gave me problems with conferencing, so i didnt use one. Av software i had, Then acted up after i got a virus and got rid of it. I never had spyware live protection. I thought doing periodic scans was enough. And for 2yrs it was with ccleaner and registry mechanic. If i get it setup again, who's to say in 2 yrs something similar won't happen again?

[GomJabbar]

I have not had any viruses or spyware on my personal computer running XP since I got it (in 2005). I keep everything up-to-date security wise. I used to use a software firewall, but for the past year or so, I only use the built-in Windows firewall. I use Avira AntiVir for my antivirus software.

As I mentioned earlier, I have a Power Users account setup in XP for my day to day use. This alone can prevent infections. Microsoft itself recommends not using an Administrator account for everyday use. A restricted Users account is more safe than a Power Users account, but I find too many problems running as a restricted User.
http://www.microsoft.com/protect/comput ... count.mspx
http://technet.microsoft.com/en-us/libr ... 56992.aspx

I am very careful with emails. Anything suspicious at all I choose View > 'Message Source'. This opens the email in a text only mode for my inspection. I use Mozilla SeaMonkey for my email client. For my browser I primarily use Opera, although sometimes I will use SeaMonkey. I try to use Internet Explorer the least because I don't trust it all that much - security wise.

[Marin85]

I once happened to get a rootkit on my ThinkPad (!) (I hope not a BIOS one...) and it took a while to get rid of it. In the end the system was so broken that even from an aesthetic point of view it was worth reinstalling... (partly due to naive use of reg cleaners, partly due to the rootkit I believe) After that I moved to Vista and I was lucky because in the mean time AVG became really a very good AV and has never let me down. I have to admit I deal with lots of torrents and I think I have seem quite a lot of what is called malware. Especially when looking for some rare stuff, there are always some kids that would put a trojan into it. Some folks put malware in pics, in movies, in software installers, archives (oh, yes, archives are very popular among such folks) or virtual images... Anyway, later on I moved to Visza x64 and just for the sake of experiment I tried to run several malware programs (with no AV installed and win defender disabled), they couldn´t even start, no symptoms, no weird behavior, nothing... Maybe I have simply picked the wrong malware, but it was an interesting observation...

Just my 0.02$

Marin

[allen]

ugh, how does one go about approaching a rootkit? from a quick google it looks impossible.

do i really want something popping up everytime i go to a rare site not known by a firewall? puke. i just put bitdefender on.
scans seem to take way longer than with eset nod32, which was much easier to setup as well.

making a separate user? this is all absurd to me, maybe after a couple days of acclimating to such ideas i'll have to go for it.

[Marin85]

ugh, how does one go about approaching a rootkit? from a quick google it looks impossible.

There are specialized tools for this. It also requires some time...

Marin

[GomJabbar]

You sound like a candidate for Linux. Maybe you should consider using one of the Linux distros instead of Windows. You could do a dual boot and see how it works out.

[GomJabbar]

I pointed another forum member to the following site, and they were able to help (I just found out today). You could give them a shot.

http://www.hijackthis-forum.de/english-help/

[allen]

thanks again for all the help.
How does photoshop work on linux?
Seems like having a more rare os would get in the way of things.
And how's learning linux compared to learning how to manage all the maintenance spyware methods on xp?
How bout windows 7?

Anyone care to write out a reformat guide?
If i'm pirating antispy and virus software, updating definitions usually works, but it seems i can't get the brand newest versions...

I'll see if that other forum helps before reformating

[GomJabbar]

If you have Linux questions, I suggest that you post them in the Linux forum here. Generally speaking, Linux distros have their own versions of all manners of software such as Photoshop. One example would be GIMP. I do not use Photoshop or GIMP, so I am not really qualified to provide a better answer.

Some Windows programs can be run under Linux using WINE. Another alternative is to use something like Virtual Box to run Windows within Linux.

Viruses are virtually unheard of on Linux systems. That doesn't mean you still shouldn't be prudent and keep up with security updates though.

Many Linux distros are easy to use, and not all that different from Windows for many common tasks.

Windows 7 or Vista should be more secure out of the box than XP if you leave UAC (User Account Control) turned on. You still need to keep all software that interacts with the internet constantly up to date (including Windows) to avoid security holes.

[Marin85]

You may also find this thread Linux alt. to Windows apps useful. Virtual Box (free) and VMware workstation (shareware) seem to work quite fast under Linux, some folks say that the windows performance in a VM is for lots of tasks pretty close to the one of a real windows installation. If you don´t use CS4 with gpu acceleration, you might be actually happy with its performance in a windows VM under Linux... (at least probably something to try out).

Linux is a completely different platform than windows, it doesn´t share anything with windows. That means that in general you won´t be able to install your windows applications under Linux, here I don´t count what GomJabbar mentioned about Wine. For some windows apps Wine is a great port, but particularly the most recent ones probably won´t work or the heavy ones will have not so great performance, it also requires some tweaking. I believe the performance of windows applications in a VM is still better than with wine, not to mention compatibility.

As for pirated spyware or AV I would never use such a thing for the simple reason that in most cases it´s a somehow modified version of the original one, which makes its detecting capabilities extremely questionable. Sometimes such modifications decrease this capabilities on purpose. Moreover, most of these pirated versions come with some malware included which you don´t have a chance to detect when installing because in the general case you don´t have a AV/anti-malware installed yet. Better go for some free AV than for pirated!

Just my 0.02$

Marin

[allen]

i thought pirated software just tricked the license and definition upgrading, i didn't think it'd be altered in ability to detect.
and i have always scanned the software package before installing, i had symantec first, and used that to scan, and each time before switching, had something else to scan the new thing with.

i'm already done considering linux, too many things i use won't work.

all the av softwares i've searched have flaws, avira, avast, whether it's false positives, slow scans, resource hogging, etc. i thought eset was good be obviously it let something in. i'd like to have one picked before reformatting the system. i have nightmares of reformating and still having the same problem.
i hope nobody's going to tell me i can't keep using microsoft office xp / 2004, which as far as i can tell i like much better than newer versions.

i'm posting this one last hijack this log. since i have different symptoms now, website skipping, and cmd prompt crashing explorer.exe, maybe i have something different, and malwarebytes and bitdefender total security 2009 aren't finding anything.

Code: Select all

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:14:13 PM, on 2/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\TPFanControl\TPFanControl.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\WINDOWS\StartupMonitor.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\ColorVision\Utility\ColorVisionStartup.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com/welcome/thinkpad
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234664086937
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: AwayNotify - C:\Program Files\Lenovo\AwayTask\AwayNotify.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c981dcebdd7b1e) (gupdate1c981dcebdd7b1e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Power Manager DBC Service - Unknown owner - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: TPFanControl - troubadix - C:\Program Files\TPFanControl\TPFanControl.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

--
End of file - 10881 bytes

[allen]

i've browsed some of the threads here regarding doing a fresh install of xp, but i still have these questions:

if i don't use my recovery disks,
a) i won't have the recovery partition right? but what does that partition even really do?
b) i would need some sort of xp pro installation cd, how can i get one? and can i get one that skips straight to sp3?
c) i only want a few thinkvantage softwares, will i have issues manually finding those and drivers needed?

if i do use recovery disks,
a) do i want to make new recovery disks since mine are 2 yrs old? would they be different from the newest version of R&R?
b) there's no way to do have custom options and select only the thinkvantage softwares i want?

so far i'd prefer not to use the recovery disks...

thanks again and again

[Marin85]

Your HijackThis log doesn´t indicate IMO any problems. And I think you should STOP using pirated software over and over again. As you see, it results in problems and more problems... AV and anti-spyware tools are not a Panacea...

If you reformat the whole disk while installing XP, yes, you will loose the hidden recovery partition. I believe though that it´s possible to keep it if one sets the partition for XP before starting the installation to keep the hidden partition (then you install XP on the same partition thus preserving the recovery one). However, one needs the predesktop area to access the hidden partition and I really have no idea if it will be preserved or remain bootable...

The purpose of the recovery partition is to (custom-)restore the factory contents of your laptop. For that purpose one has to boot in the predesktop area by pressing the blue ThinkVantage button after powering on the machine, then one is presented various restore options, one of them is restore to factory state.

I don´t know if SP3 was officially included in the latest installation media of XP, but one can slipstream SP3 into an XP installation by using a program called nLite. In the end it will create an iso image of the XP installation that you will have to burn on a CD as image. However, you will need some XP installation media as a source for the main files. I think the easiest way for you to apply SP3 would be via windows update. And please don´t use the pirated custom modified versions of XP with SP3 included available as torrents. Many of them include security holes or malware within the installation on purpose!

You can find all the ThinkVantage software and all Lenovo XP drivers on Lenovo website under support. Also, depending on what you are going to install, you will need to keep some order of the installations. Alternatively, if you still keep the recovery partition, you can perform a custom-restore of the factory contents, so you can keep only those Lenovo programs you really need. It´s pretty automatic, so you don´t have to watch it. However, if you decide to go for a clean XP installation, you may want to use System Update. It will find all drivers and programs needed for your ThinkPad, then you can select which ones you want to install.

As a last resort for your virus problems, you can try out AVG 8 free. I don´t like it as much as my AVG 7.5, which unfortunately is nowhere available for download. But I believe AVG 8 still shares some of the good features of AVG 7.5 (well, it´s somewhat slower and produce bloated feeling...) You will have to uninstall NOD32 and other AV software if you have some (you shouldn´t have more than one AV installed (!) ), you can keep spybot and spydoctor though. For your sake I hope AVG will find something...

Cheers,

Marin

[allen]

http://www.oldversion.com/AVG-Anti-Virus.html

have you ever seen this site?

custom restore from the recovery partition sounds like a good choice.

everytime i look at the sites for freeware av, they point out a feature that's missing from their pro version, and it makes it look insufficient.
what about gettin trial versions and cracks for 'em?

what i'd really like to figure out before doing this is, what protection softwares i'm going to use for av, i'm thinking windows firewall, and i guess something for antispyware live detection? what else is really needed?

[Marin85]

http://www.oldversion.com/AVG-Anti-Virus.html

have you ever seen this site?

Thanks, I wasn´t aware of the existence of this website. However, I keep a copy of every piece of software I might have found useful at some point

Here is my opinion to your questions:

Don´t take it as offence, but I don´t want to convince you in anything. I´m telling you what works, what can be trusted and what can´t be trusted and what makes problems. The use of pirated software has led to this whole mess on your ThinkPad, not mine, yet you still keep on asking about cracking software. If you want to discuss such subject, go to the corresponding places. As far as I´m concerned, I´d like to keep this forum clean from such discussions. What is even more important, such discussions are against the forum rules, which FYI have been determined by forum´s owner. Speaking honestly, if I was a forum mod or admin, I would have locked that thread at least twice by now.

For one last time, shareware is supposed to work as shareware. After the trial period has expired, it is not supposed to work as a full version. hence some or all features get locked until one purchases a valid license. Cracking such software means to unlock this features, in other words to suppress or bypass the built-in validation process. Since the validation processes of modern AV software are made on purpose to be complex for apparent reasons, the result of the cracking, i.e. the cracked AV, tends to exhibit erratic behavior in some situations. Considering the various interdependences and interactions between AV and OS, cracked AV is simply a great invitation for problems of various nature.

I think both Avira and AVG (I still use AVG 7.5 (!) ) are excellent free AV´s and I don´t really see what so much you may miss from the Pro versions...

If you keep on using pirated software, no anti-spyware, no AV and no firewall will be able to save your @$$.

Just my 0.02$

Marin

[allen]

hey, i do appreciate all the info you're providing, info on pirated software is new to me, and i honestly don't have moral issues with not paying for software or talking about it, especially since part of me believes the software makers are making viruses to keep selling software, i'm glad you understand the frustration i've been going through, i'm not taking offense, i'm really trying to find the best solution, and i am taking all things into consideration.

the features missing from free versions, which i didn't used to think i needed, but now do, are things such as, rootkit(which i haven't heard of til now) and spyware live scanning and protection

do i need something more than free avg and windows firewall?

and for periodic cleanup scans? malwarebytes free and ccleaner, sufficient?

[Marin85]

the features missing from free versions, which i didn't used to think i needed, but now do, are things such as, rootkit(which i haven't heard of til now) and spyware live scanning and protection

do i need something more than free avg and windows firewall?

and for periodic cleanup scans? malwarebytes free and ccleaner, sufficient?

Ok, onto the subject:
(1) Rootkits: Taken for itself rootkit is not malware. There are "normal" programs that use rootkit techniques for their work. However, rootkits can be used for malicious purposes because they offer great potential to do so and can help for executing other malicious activities. Now, all these features for rootkit removal that you see included in the pro versions of some standard AV software are rather for advertising... Most of the standard AV tools (even in pro edition) don´t have the capabilities to remove badass rootkits, they can rather remove some standard and pretty outdated forms, they even tend to produce false positives (especially when there is a program installed using similar to rookit techniques) and break software. etc, etc, etc. My point is only that you won´t miss the rootkit feature from any AV, so this shouldn´t be a reason for you to give up some good free AV´s out there.

(2) Regarding AV, if I was you, I would go with Avira Antivir instead of AVG 8 free. As much as I like AVG 7.5, I have to admit that Avira is better IMO than the *new* version of AVG. Sorry, I didn´t really understand what you didn´t like about Avira.

(3) Regarding windows firewall, you may or may not need windows firewall. There are some good ones, you can search the forum, we have here a few long and good threads on the firewall subject. In any case, a software firewall is just an additional piece of software that interacts with your OS and thus could cause various problems, mostly software compatibility issues. If you are behind a router (with built-in firewall), you may want to skip the firewall part.

(4) Since you tend to get viruses etc , I think having malwarebytes permanently installed won´t hurt you. This way you will be able to scan your ThinkPad every day or two for problematic bits. IMO malwarebytes is a good piece of software that seems to have saved a few forum members so far... So, you can´t go wrong with it.

(5) Regarding CCleaner, it´s a program that aims to clean up the junk from your computer and thus optimize its performance. If I was you, I would stay from the built-in reg cleaner though! Also, no regular cleaning is needed as you have quite powerful machine, so the performance degradation is not so fast. CCleaner is actually meant to be performed say once a month or two.

And, yes, that should do

Good luck

Marin

[allen]

apparently the avg 7.5 from oldversion.com, is either corrupted or not compatible with my system.
that site i found randomly by googling, and read that it was safe. i scanned the file w/ malwarebytes before using it. i knew i was taking a chance, but i was gearing up to do a reformat anyhow.

so i tried it out before doing a reformat, and it was half working, but was finding "issues" that when healed, crashed windows. i thought my system had been affected by a virus in a way that prevented proper installation, and it eventually led to not being able to start windows, even in all safe modes. i then used the thinkvantage button on startup, to restore to factory settings, and succesfully copied files i wanted to an external usb harddrive.

i was glad to be able to restore only "preload" partition and keep the 2nd partition i have on the drive.

however, i can't access the files on my ultrabay disk, the disk is reading, but the folder that holds everytihng on it was set as private documents for my previous user account, which was an administrator account. i've tried to make the same user account, with same name to access it, but no luck, even in safe mode signed in as administrator either. the ultrabay disk has all my imporant files... am i missing a step?

back to the avg 7.5 installation file from oldversion.com,
after restoration, i installed avg 7.5 and it found about 23 issues, and crashed my system again, now i'm running from "last known good configuration"
so now i'm downloading direct from free.avg.com, the newest version. i guess it'll be slower than the 7.5 everyone likes?
i didn't like avira because it would pause the entire scan process when it found something, and found 2 false positives. are there settings in avira around that?

i am also planning on making a separate power user account to do mose computing, after i do another restoration to fix the corrupt avg7.5 issues. i read that i can copy a user account, so i'm hoping i can set up my administrator account with all the settings i like, then copy it and change it to a power user account? so i don't have to set up all my preferences twice!?

with all the steps required to get a brand new thinkpad windows system running securely, i'm surprised there's not a setup guide somewhere written by members of this forum, with the best way to set up partitions, user accounts, av, antispyware, firewall, etc. or did i just not find it? most of the work for me seems to be deciding what methods to use, and not use.

[Marin85]

If it was a proper copy of AVG 7.5, after applying all the updates available from Grisoft there shouldn´t have been any problems. FYI AVG 7.5 has been always flawless for me on XP, Vista and Win 7, and all in both 32bit and 64bit It´s true that AVG 7 had at the beginning a few problems with false positives, that´s why it is important to apply all available updates before starting a scan. If the updated AVG 7.5 detects something that you haven´t made yourself (resp. from a trusted person), then you can be pretty sure that you don´t need that thing on your computer no matter what some folks on the torrent sites may say about AVG 7.5... I´ll download the *AVG 7.5* from your link and will have a look at it (rather out of curiosity).

That AVG has made your windows crash both surprises me and doesn´t surprise me Your system seems to be deeply affected by malware.

If you still can´t access that drive, you can try downloading some Linux LiveCD like Ubuntu 8.10, burn it as image (not file) to a CD, put the drive in question in the main bay, connect the other one via USB and boot into Linux from the LiveCD. You should be then able to access both drives and perform any operations like copying etc. without problems (yes, recent Linux can work with NTFS). Ubuntu 8.10 is very user-friendly (no work in linux cmd will be needed for the simple operations you want to accomplish), so you shouldn´t have any problems there either.

Regarding the guide, there is already a guide how to clean-install windows XP. There are also good threads about all this stuff like AV, anti-malware and firewalls, which are even better than "guides" because there you can find different opinions. AV and firewalls are not a subject of one conclusive and universal solution. Everyone has his own preferences, some people don´t even install AV and firewalls (I don´t install firewalls).

Hope this helps

Marin

[allen]

avg 8 seems to work ok, i think the 7.5 from that site was corrupt.

it seems rescue and recovery isn't letting me restore to factory settings again, (to fix issues caused by that avg7.5) after hitting the thinkvantage button during startup, it seems to load up, but none of the options on the left react when they're pushed...

seems like i should to a recovery from the set of disks from 2 yrs ago now...
for that, and something like ubuntu 8.10 booting from cd, sounds like changing boot order is necessary?

[Marin85]

it seems rescue and recovery isn't letting me restore to factory settings again, (to fix issues caused by that avg7.5) after hitting the thinkvantage button during startup, it seems to load up, but none of the options on the left react when they're pushed...

I know that problem. Apparently, the predesktop area is broken. I believe, if R&R gets somehow affected, this can break the predesktop area as well (in my experience). BTW, if your laptop is still under warranty, you can call Lenovo because of the broken predesktop area and request recovery CDs from them at no charge. At least this was how I got mine.

for that, and something like ubuntu 8.10 booting from cd, sounds like changing boot order is necessary?

I believe on your system there is no need to change the boot order from within BIOS. It should automagically recognize that there is a bootable media in the CD/DVD drive and ask you to press any button to boot from it. (If it doesn´t, then just go to BIOS -> startup ->startup sequence (or something similar) -> put the CD/DVD drive on the top.)

[allen]

i have a knoppix live cd, v.5.0 something.
which i used when i got the system to split the preload partition, it proved very useful to do so,
can knoppix likely read my drive that i've been denied access?
or can ubuntu also split an existing partition?

i just did a recovery from discs from late 2006, r&r version 3, which didn't let me keep my partitions.
i'm hoping this fixed my predesktop area, so that i can do a 3rd and final recovery leaving out all this lenovo junkware, and keep my partitions.