Today [2]

[ilikefree]

All last night I spent removing a trojan.goldun and root kit from my computer.
Couldn't work out why it kept comming back. Root kit made a registry file called
HKLM-Software\Microsoft\WindowsNT\Current Version\Winlogon Taskman
which was found with Super-Antispyware and removed manually.
Trojan.Goldun was found by MalwareBytes and was trying to steal passwords.
Waste of time here as only forum passwords are on this computer.
After removal I did scans with Super-Antispyware,MalwareBytes,E-Set Nod32,Trend Micro Housecall,BlackLight anti root kit and had nothing found.
Made 3 restore points and did a disc cleanup leaving the last restore point only.
I have scanned the whole computer 5 times and think it is all clear now.
Didn't feel like going to sleep so it was good to have something to do other than watching movies.

 

[niemiro]

Somehow, as busy as SF was, nobody came back to me overnight! Ah well! Anyway, someone has come back to me now, and I have fixed one of their two failing updates, now for the other one!

 

[niemiro]

Got a nice gentle start!

=================================
Checking System Update Readiness.
Binary Version 6.1.7600.20822
Package Version 10.0
2010-12-05 01:42

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Manifest All Zeros    0x00000000    winsxs\Manifests\amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.20753_none_c35b3960c9fe4842.manifest    amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.20753_none_c35b3960c9fe4842    
(f)    CSI Manifest All Zeros    0x00000000    winsxs\Manifests\amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.16634_none_c2e83cb7b0cf89ed.manifest    amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.16634_none_c2e83cb7b0cf89ed    

Summary:
Seconds executed: 346
 Found 2 errors
  CSI Manifest All Zeros Total count: 2

Unavailable repair files:
    winsxs\manifests\amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.20753_none_c35b3960c9fe4842.manifest
    winsxs\manifests\amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.16634_none_c2e83cb7b0cf89ed.manifest

Customer Experience report successfully uploaded.  Thank you for participating.  For more information, see the Microsoft Customer Experience Improvement Program on the Microsoft web site.

Perfect log to start off with!

 

[Smurfyy]

^ Looks complex and confusing. Lol.
Today I'll probably be up in the loft again, we're installing a ceiling fan in our bathroom since it gets really steamy in there.
Kinda shocking how much you know you're own home; I went up there and found a hidden area of lost space, there's nothing in there, and the guy that done our plumbing for the new bathroom made a real nice job of it *sarc* I'll post a pic of what I mean when I get up there later.

 

[niemiro]

lol. We have something like that in our loft! Our house has a normal roof, except for a tiny bit of flat roof at one point. A few years ago it leaked. Got some builders in and told them to build a normal roof, and not a new flat roof, and then to replaster the ceiling. This they did.

Ceiling looked good, roof looked good, no more leak. The builders had been quite nice and quite efficient. Paid them and that was all fine.

A few days later we went into the loft. Crawled into that section of roof, and OMG! The old lead roof was still there! lol

Builders!

 

[Lorien]

You had/have a LEAD roof? Why in heaven's name would anyone use lead for roofing? I mean, it's pretty much the heaviest element so it would require really strong joists and thus walls and ceilings, and so on. Plus it's dangerous to be around (I mean, lead-based paint is outlawed here - but a lead roof would be so far out of the question it's not even close). And it's not particularly strong (hence leaks don't surprise me). I suppose it's not possible to remove it at this point with the other roof and ceiling installed and you don't want to cut it up and create lead dust to get into your lungs. But I'll bet you didn't tell them to remove and take away the old roof when you explained the job - so they weren't going to do any more than they were under contract to do. I learned a long time ago to be very, very specific and detailed when getting estimates and approving contracts - having experienced a few things of a similar nature myself.

Oh, and are system files, winsxs. registries, and sfc all that different in W7 than Vista? It sounds like they're close enough that what you know from Vista applies there as well. Do they have anyone like Flavius over there in case we really get stuck or are you now as good as anyone else they have doing this over there?

 

[niemiro]

You had/have a LEAD roof? Why in heaven's name would anyone use lead for roofing? I mean, it's pretty much the heaviest element so it would require really strong joists and thus walls and ceilings, and so on. Plus it's dangerous to be around (I mean, lead-based paint is outlawed here - but a lead roof would be so far out of the question it's not even close). And it's not particularly strong (hence leaks don't surprise me). I suppose it's not possible to remove it at this point with the other roof and ceiling installed and you don't want to cut it up and create lead dust to get into your lungs. But I'll bet you didn't tell them to remove and take away the old roof when you explained the job - so they weren't going to do any more than they were under contract to do. I learned a long time ago to be very, very specific and detailed when getting estimates and approving contracts - having experienced a few things of a similar nature myself.

Oh, and are system files, winsxs. registries, and sfc all that different in W7 than Vista? It sounds like they're close enough that what you know from Vista applies there as well. Do they have anyone like Flavius over there in case we really get stuck or are you now as good as anyone else they have doing this over there?

Lead is actually used quite a lot as it is very soft and mailable, and people were able to make rooves out of it years and years ago. Same with drainpipes. Lead is actually not that dangerous on a roof. It is really an accumulated hazard, and as far as I know is not too much of a problem on a roof. Very occasionally you get lead downpipes, and these are much more of a problem. These at street level have to be boarded up. We have never had any of those. However, the new plastic downpipes are also poisonous. Don't EVER drink water out of a downpipe made of that matt black plastic. That (apparently) is really quite poisonous.

W7 and Vista are EXACTLY the same for what I am doing. No Flavius over there. Saw some very "curious" advice, and decided to give them a hand. Having quite a lot of success actually! I am on my own now! Doing well, but on my own.

I am quite enjoying it actually. From a purely (very, very) selfish point of view, it is almost good for me, because Flavius has taught me what can be taught, and now with him out of the way I am free to get experience. I know this sounds really heartless, selfish, and nasty, and I didn't mean it like that. You know what I mean.

 

[Lorien]

I understand and I'm glad you no longer feel contrained by having someone you considered that much better holding you back from what you could do all along if you gave yourself the chance. Don't take this the wrong way, but in a way you and some others do that to me here sometimes - but the difference is that I sometimes don't already have the skills and would need to learn them first, so it's not being held back from doing what I CAN do as much as being held back from trying what I MIGHT be able to do if I worked harder at it knowing I didn't have a net.

It's interesting to always see pretty much the same people logged on when I logon - then again, I am up a bit later than normal (5AM vs. 2AM) - but sometimes even that doesn't matter (though we then often have a few more like ilikefree and mitchell from the other side of the world at 2AM). In a few more hours, more of the regulars will arrive as usual (like Richard and Shawn and patonb and Imperfect1 and Chase and Carmine and Joan and Tom and a few others - sorry if I missed you, I was just doing this off the top of my head and thinking of those who tend to stay on pretty much all the time or a lot of the time or back and forth often once logged in). And it doesn't seem to matter if it's a weekday or a weekend or even a holiday - everyone still shows up and goes to their normal places and does their normal things (some answer much more than others, some mostly hang out in Chillout and occasionally post elsewhere, some seem to mostly view and post only on occasion, some focus on certain forums or certain types of questions while others seem to post in many or even most, some post assists even when a thread is covered or when seeing someone struggling and others tend to avoid such threads,...). The same seems to happen in EF (though I haven't been there long enough to tell for sure). I have no idea about SF as I've only posted 2-3 times there so far - but plan to increase that eventually (even if I don't have W7).

BTW, I've been out of the USA only twice - once 20 years ago on our honeymoon in Cancun and once about 15 years ago to Amsterdam. While I travelled a great deal on my first career (VP of Operations at Citibank) inside the US, those days are over (I've paid my travel dues) and we really don't have plans to go anywhere beyond one-day car distance possibly ever again - so I don't think I need to worry about black plastic water pipes or cholera or open warfare in the streets (where I would find it hard to obtain appropriate weapons for us being out of the country) or language barriers (though that sometimes happens here with a lot of people who speak only Spanish - but not many where I live), or driving on the wrong side of the road or anything like that. And given my condition, I really would prefer to be close to US medical facilities where I have a bit more faith.

 

[niemiro]

It is 11:30AM where I live. Some of my Polish relatives are coming over. Some of them are really slightly mad! They brought us a present. Swedish foodstuff. What do they bring? Fermented Herring. I am so scared! Anyone know the reputation of this stuff?

 

[Lorien]

I know now Surströmming - Wikipedia, the free encyclopedia. And not in a million years.

 

[niemiro]

To put it into perspective, here are two true stories from a Swedish neighbour of ours:

To put into perspective the smell:

There were two Swedish men who decided to man up and eat some. They didn't want to ruin there house, so they went into their kitchen, sealed all of the doors and everything, switched on the hob extractor fan, and opened the tin. After a few seconds, they forced the first spoon of the putrid stuff down. After 10 minutes they were feeling really very ill. They bagged up the rest of the tin, and left the extractor fan on, and went to bed. 20 minutes later there was a ring on the doorbell. They struggled downstairs, to find two police men on their front door. The policemen explained that their neighbours had complained of the smell of a rotting corpse in the vicinity, and the policemen had smelt their way to their house!

Next story soon to come!

 

[niemiro]

We have got to dispose of the stuff now! There is absolutely no way we are opening it, present or not!

 

[niemiro]

Today I might write some Windows Update Posting Instructions if I get time.

 

[niemiro]

No one is online!

 

[Lorien]

All last night I spent removing a trojan.goldun and root kit from my computer.
Couldn't work out why it kept comming back. Root kit made a registry file called
HKLM-Software\Microsoft\WindowsNT\Current Version\Winlogon Taskman
which was found with Super-Antispyware and removed manually.
Trojan.Goldun was found by MalwareBytes and was trying to steal passwords.
Waste of time here as only forum passwords are on this computer.
After removal I did scans with Super-Antispyware,MalwareBytes,E-Set Nod32,Trend Micro Housecall,BlackLight anti root kit and had nothing found.
Made 3 restore points and did a disc cleanup leaving the last restore point only.
I have scanned the whole computer 5 times and think it is all clear now.
Didn't feel like going to sleep so it was good to have something to do other than watching movies.

These type of infections (especially these types - trojans and rootkits) are insidious and can live on despite their removal by having already modified, added, or otherwise affected your system and/or program files. I would recommend the following:

1. Download and run Hijack This HijackThis - Trend Micro USA (the full version and not the beta) and save the report to your desktop.

2. Post this situation in the Security Forum attaching the Hijack This file and let Jacee take a look - include all the infection names and locations like you did here (maybe even just copy this as a start and add to it there) - (I'll look as well, but I'm not really qualified to read it though I'm getting better each time - especially after reading Jacee's analyses of other reports). We're all (you know, I mean the regulars) pretty good at this type of thing, but none of us are in her league - not even Richard who is probably the closest. You may also want to send her a PM requesting her to check out the thread (she'll then get an e-mail and will probably show up quicker) and provide any advice or opinions or suggestions she sees appropriate - I've found she sometimes is away for quite a while if she gets no alerts, but an e-mail with your PM should get her here ASAP. She has many tools we don't consider or know about or are "above our pay grade" that may help either confirm you're OK or identify any problems that remain. She may also tell you to do a clean install - but better to have her help and opinion than risk a problem that still exists and may be getting worse all the time despite the "clean" scans. If she does suggest a clean install, it doesn't mean you have to do it - it just means that if you don't you're running a risk which you may or may not be willing to take.

She helped me when I was infected - but it turned out to be minor (yours does NOT sound minor IMHO). Still, she showed me some tricks and I now have tools I didn't know about before for the next time (and to help prevent the next time).

Anyway, I think she can either help you or set your mind more at ease (or both) and strongly recommend you do this. But, as always, it's up to you. You probably think all is now well and it's over. I would be genuinely concerned and would absolutely without question seek her assistance.

I sincerely hope you take my advice.

Best wishes!

 

[aceofspades]

Today I am driving to Ky. to do a video test run for a movie idea I came up with. Anxious to see what kind of results I get.

 

[Chase]

Today, Sunday, preparing for tomorrow, Monday.

 

[niemiro]

Today, Sunday, preparing for tomorrow, Monday.

Today, weekend, preparing for next weekend.

 

[Chase]

Today, Sunday, preparing for tomorrow, Monday.

Today, weekend, preparing for next weekend.

That too. lol.

 

[niemiro]

Today I solved my very first Windows Update issue which was caused by manifest corruption over at SF. I feel very special! You remember that log I posted, here is the next run:

=================================
Checking System Update Readiness.
Binary Version 6.1.7600.20822
Package Version 10.0
2010-12-05 11:59
 
Checking Windows Servicing Packages
 
Checking Package Manifests and Catalogs
 
Checking Package Watchlist
 
Checking Component Watchlist
 
Checking Packages
 
Checking Component Store
(f)	CSI Manifest All Zeros	0x00000000	 winsxs\Manifests\amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.20753_none_c35b3960c9fe4842.manifest 	 amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.20753_none_c35b3960c9fe4842 	
(fix)	CSI Manifest All Zeros	CSI File Replaced	File:  amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.20753_none_c35b3960c9fe4842.manifest  From: C:\windows\CheckSur\v1.0\windows6.1-rtm-client-enus-amd64.cab
(f)	CSI Manifest All Zeros	0x00000000	 winsxs\Manifests\amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.16634_none_c2e83cb7b0cf89ed.manifest 	 amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.16634_none_c2e83cb7b0cf89ed 	
(fix)	CSI Manifest All Zeros	CSI File Replaced	File:  amd64_microsoft-windows-diskdump_31bf3856ad364e35_6.1.7600.16634_none_c2e83cb7b0cf89ed.manifest  From: C:\windows\CheckSur\v1.0\windows6.1-rtm-client-enus-amd64.cab
 
Summary:
Seconds executed: 364
 Found 2 errors
 Fixed 2 errors
  CSI Manifest All Zeros Total count: 2
  Fixed: CSI Manifest All Zeros.  Total count: 2
Customer Experience report successfully uploaded.  Thank you for  participating.  For more information, see the Microsoft Customer  Experience Improvement Program on the Microsoft web site.

What is shows is 2 unfixable errors, followed by the fix because I put replacements in the drop box.

Maybe this was a pointless post, but it has made my evening.