[Solved] W7 installation on a 64 bit Dell

[mij]

I have tried this today today on SWMBO's studio one Dell computer. I have had all sorts of stumbling blocks - mainly from naughty browser add ons that refuse to allow you to access google etc sites. I want to access an Epson site to get an updated driver for the XP202 printer that we have here. You might remember my problem with them from before.

 

What happens is I get to the site and when i type any thing the screen then goes milky/cloudy and when I left click anything nothing happens. Ok so something takes over...... but what? I cannot see anything in the control panel?

jim

Oh I forgot the usual.....

new W7 home premium

64bit (was vista)

I am now using plusnet for the ISP

anything else?

Jim

[Starbuck]

Hi Jim,

 

I have had all sorts of stumbling blocks - mainly from naughty browser add ons that refuse to allow you to access google etc sites.

If you think it's the addons that are causing the problem, we can take care of that.

But let's check first.....

 

Try running Internet Explorer and Firefox without any addons...... see if this works when doing the Google searches.

 

Internet Explorer:

Click Start >>All Programs >> Accessories >> System Tools >> Internet Explorer (No Addons)

 

Firefox:

Open Firefox, then click on the Help tab and select: Restart with Addons disabled

 

Let me know if there's any improvement.

[mij]

Thanks very much for that - it worked! For some reason it wont download firefox which I much prefer for my use of the computer, but IE works fine in that mode. That is with out the browser add-ons. I have only started this today and it has taken all this time fiddling with somebody else's add-ons to try and get this thing working. Oooh I am annoyed. How do I get rid of them as I do not think they show in control panel - remove programs....

jim

[Starbuck]

Hi Jim,

 

Ok let's have a look and see what we have here.

 

Step 1

Download RogueKiller and save it to your desktop.

• Close all the running processes
  
• Double click RogueKiller icon to run the program
  Vista/Win7 users should right click the icon and select Run as Administrator.
  
• Wait for the Prescan to finish.
  
• Now click the Scan button.
  
• Please copy and paste the report in your next reply.

A copy of the RKreport.txt can be found on your desktop.

 

Note:

If RogueKiller is blocked, do not hesitate to try running it again.

If it still fails to run, right click on the downloaded icon and select 'Rename'.....rename it to winlogon and try again.

 

 

Step 2

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
  
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete depending on your system's specifications.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message.
  

 

 

Step 3

• Download OTL to your desktop.
  right click on the link and select 'Save Link/Target As'.
   
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/Otllatest.png

 

Now copy the lines in bold below.

 

netsvcs

msconfig

%SYSTEMDRIVE%\*.*

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system32\*.exe /lockedfiles

%systemroot%\System32\config\*.sav

%PROGRAMFILES%\*

%USERPROFILE%\..|smtmp;true;true;true /FP

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

hklm\software\clients\startmenuinternet|command /rs

hklm\software\clients\startmenuinternet|command /64 /rs

CREATERESTOREPOINT

 

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

 

 

In your next reply, please submit:

RKreport.txt

JRT.txt

and both reports from Otl

 

Note:

I'm move this thread to the Malware Removal forum for now.

 

Thanks.

[mij]

Thanks for that and the links. It is very difficult to understand what is legit and what are blind allies on the computer.

The RK log seems to have vanished - that was probably me.

This is on the infected Dell. I am reading the instructions from my computer.

I'll have to send this in separate posts as I have little wordprocessing on this computer yet.

jim

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.5.7 (09.01.2013:1)

OS: Windows 7 Home Premium x64

Ran by helen on 02/09/2013 at 7:42:59.05

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

~~~ Services

 

~~~ Registry Values

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installcore

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\visualbee

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitsearchscopes

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\crossrider

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\pricegong

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\visualbee

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3287810

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110311391106}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311391106}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\conduitchecker_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\conduitchecker_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mconduitinstaller_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mconduitinstaller_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\conduitchecker_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\conduitchecker_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\mconduitinstaller_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\mconduitinstaller_RASMANCS

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CDFC44B8-1AA6-4B1E-A656-03EDCF5277EB}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2316C625-B487-4410-A1A5-FF040B65245F}

 

~~~ Files

Successfully deleted: [File] "D:\end"

 

~~~ Folders

Successfully deleted: [Folder] "D:\ProgramData\visualbee"

Successfully deleted: [Folder] "D:\Users\helen\appdata\local\conduit"

Successfully deleted: [Folder] "D:\Users\helen\appdata\local\visualbeeexe"

Successfully deleted: [Folder] "D:\Users\helen\appdata\locallow\conduit"

Successfully deleted: [Folder] "D:\Users\helen\appdata\locallow\pricegong"

Successfully deleted: [Folder] "D:\Program Files (x86)\conduit"

Failed to delete: [Folder] "D:\Program Files (x86)\webconnect"

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 02/09/2013 at 7:47:09.84

End of JRT log

[mij]

Ok so far hopefully I can attach the OTL file.....

 

OTL logfile created on: 02/09/2013 08:08:18 - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = D:\Users\helen\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

2.75 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 66.64% Memory free

5.50 Gb Paging File | 4.45 Gb Available in Paging File | 80.96% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)

Drive C: | 451.07 Gb Total Space | 400.66 Gb Free Space | 88.82% Space Free | Partition Type: NTFS

Drive D: | 14.65 Gb Total Space | 0.03 Gb Free Space | 0.21% Space Free | Partition Type: NTFS

 

Computer Name: HELEN-PC | User Name: helen | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

[mij]

Now the other file.....

That seems to be ok, I hope this gets to you ok.

jim

 

 

OTL Extras logfile created on: 02/09/2013 08:08:18 - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = D:\Users\helen\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

2.75 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 66.64% Memory free

5.50 Gb Paging File | 4.45 Gb Available in Paging File | 80.96% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)

Drive C: | 451.07 Gb Total Space | 400.66 Gb Free Space | 88.82% Space Free | Partition Type: NTFS

Drive D: | 14.65 Gb Total Space | 0.03 Gb Free Space | 0.21% Space Free | Partition Type: NTFS

 

Computer Name: HELEN-PC | User Name: helen | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- D:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- D:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "D:\Windows\System32\rundll32.exe" "D:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "D:\Windows\System32\rundll32.exe" "D:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{002ECBD9-E6B3-4CCE-9724-54F0CC0012B6}" = rport=139 | protocol=6 | dir=out | app=system |

"{0ABC6C5D-A5E0-40B9-A316-5F979DA13EB9}" = lport=138 | protocol=17 | dir=in | app=system |

"{10B27E20-7BBC-49FE-B59D-E37C07E993A4}" = lport=139 | protocol=6 | dir=in | app=system |

"{16A23CEF-E6F2-444C-A732-5E426FFA4922}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{239F2B0D-2DB8-456D-B711-8E8C9CED4CFF}" = lport=10243 | protocol=6 | dir=in | app=system |

"{2522D380-61BC-4A16-A984-9483D418CD8F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{3CB740BD-B133-4F31-9CA8-547E564A4FC7}" = rport=138 | protocol=17 | dir=out | app=system |

"{411C44C6-B297-4C96-9085-105C0590D8E0}" = lport=137 | protocol=17 | dir=in | app=system |

"{4EB86BE4-281F-479F-A919-17DDBAD61642}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

"{7D3AC1C3-A2C0-4F6A-8A09-7923045932DD}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{86F93841-6C84-4EEA-9B03-85C0E455EF03}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{A728CCF0-1D7A-4E42-A42D-B962963A8A2B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{AA709708-A291-47C0-BCC5-389CAB5164B4}" = lport=2869 | protocol=6 | dir=in | app=system |

"{B986B8E6-0664-4BFB-B5A8-E126952C5FF7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{C64478FB-FBC7-4638-AD57-D58ED826D9A2}" = lport=445 | protocol=6 | dir=in | app=system |

"{CC3AF72D-A47B-4BDC-ACCE-6699C5CAD14A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{CDF11B5F-94B8-45B1-AAEC-96253A94111E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

"{D5E6C75A-8C1B-4B04-A6CA-4079F6305EB1}" = rport=445 | protocol=6 | dir=out | app=system |

"{D742FEB3-0E26-43D4-9E05-D1C232E482B5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{DFCF2274-1FDD-41CB-963A-10681F821051}" = rport=137 | protocol=17 | dir=out | app=system |

"{E2147EF5-2A20-4A4F-8DEF-5B5A6E0A356A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{EA34CC2F-719D-4DA8-9F46-BD70056AE3A3}" = rport=10243 | protocol=6 | dir=out | app=system |

"{F3093CAB-1727-4550-BF9C-2871F75426C2}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{145474A0-ED2D-4415-95BB-EED2A921AF3B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{185B0330-2430-4673-9100-C8CC4A1179C3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{4526CE81-6E29-4D0C-9302-C7CADCA40140}" = dir=in | app=d:\program files (x86)\windows live\messenger\msnmsgr.exe |

"{4BC0F8B2-6E3E-4EC5-A309-DD70089DEA36}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{644F45B2-73D5-4EB4-A391-B7EA289F5618}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

"{6FC617E7-732B-403C-82F9-5D8C965BB459}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{7E6D9D4E-006D-47AC-A5C2-38F06FBB581E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{80359190-599F-4FB9-8F48-A33C472669CC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{8F91ECA6-A5AB-4354-80E3-C0031F1A35B8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{9EA6EDFC-F866-4095-84AC-D962D6750424}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

"{A015DEC7-3A11-4670-A2AE-67359958A595}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{A604CFC8-7C9E-48F9-B80D-46F495B3A581}" = protocol=6 | dir=out | app=system |

"{A7048121-A849-4659-B2EA-F6B95D72E822}" = dir=in | app=d:\program files (x86)\windows live\contacts\wlcomm.exe |

"{B7239FDA-A8C0-44A9-90DB-6797F19C6434}" = dir=in | app=d:\users\helen\appdata\local\microsoft\skydrive\skydrive.exe |

"{BC7F2861-EE1F-41C7-8ADE-A33B3C81F0FE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{C16A7CBA-D405-46DE-8D2D-55070413A823}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{C5C2D143-CCD9-4D57-96B2-BD0DC298FD7F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{CA22BA2F-CC00-4919-80E7-EBFB9C0DC01B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{D4C80E28-51F7-4DC7-906E-01D1D73C7366}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{F668F07F-94B9-4E23-BC12-4EE8B7990231}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

"{F7A8BD47-6E0D-4696-A83A-C211B9605317}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |

"{F82E729B-14AB-4091-A1B0-586ADF0CFD41}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{2FD0FA0A-7A21-4C4A-B268-1142B54E035E}" = Windows Live Family Safety

"{5EEC477F-8E9B-4420-8829-16E7426227DB}" = Windows Live MIME IFilter

"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 311.06

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 311.06

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 311.06

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant

"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"WebConnect" = WebConnect 3.0.0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{03D562B5-C4E2-4846-A920-33178788BE00}" = Windows Live Communications Platform

"{0F929651-F516-4956-90F2-FFBD2CD5D30E}" = Photo Gallery

"{0FF9CC94-EF23-401E-BDBD-37403D1A2B38}" = Windows Live SOXE Definitions

"{10640F6D-6AB0-401E-9FC6-A94D19C580BC}" = Windows Live UX Platform Language Pack

"{147FBA18-A6BB-4AD5-8F0A-37380AAABD76}" = Photo Common

"{2020C08E-74F5-4E9F-BD2A-41F8CB6EBA10}" = Photo Gallery

"{2AC01935-3774-4981-98C8-14E93C14372C}" = Windows Live UX Platform Language Pack

"{3BD8FD6A-D36D-45D9-BB5C-CD39404C222F}" = Windows Live Writer Resources

"{3C5F91EF-5C0B-4D13-BCBE-0FC6FC3ED7F9}" = Movie Maker

"{45898170-E68C-4F02-AA35-C2186BF347A3}" = Movie Maker

"{4AB9FFAB-FFA5-49AF-9712-68B7B859B1F3}" = Windows Live Writer

"{5A0EE0F0-E909-4F3B-B437-AAD9252427CB}" = Windows Live Installer

"{5E094C92-6288-4F43-AA9A-D452D0218F3F}" = Windows Live Essentials

"{6389F199-1D6C-4974-9557-693F9DD48736}" = Windows Live Writer Resources

"{6B6923B9-8719-425B-916C-CD2908F31AAF}" = Windows Live SOXE

"{7C6F0282-3DCD-4A80-95AC-BB298E821C44}" = Windows Live Writer

"{89870E0D-9602-41F8-9E83-14F6849346A4}" = Windows Live Mail

"{89C7E0A7-4D9D-4DCC-8834-A9A2B92D7EBB}" = Photo Gallery

"{8BC85D25-AF2D-40DA-BD04-016B64D384BF}" = Windows Live Mail

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110

"{91D59688-8209-4569-B581-B870BDC74EAB}" = Windows Live Messenger

"{936D4074-6A57-45ED-AF5A-F7CF5A56DE6F}" = Windows Live Essentials

"{9C6D5C94-386A-4DE7-B99F-523D3F167B9A}" = Windows Live Messenger

"{AAA94EAA-40A4-458C-9D86-D1DA765B51D5}" = Windows Live Writer

"{AAF91344-2808-4D6B-9242-FBE5AF79D60A}" = Windows Live Family Safety

"{B286BAC3-CBE6-4854-BF68-EB72A34CEA56}" = Windows Live Messenger

"{B39A6825-EA20-43EA-AB2D-A6BC0298D9A1}" = Movie Maker

"{C6B0EE9E-2128-4448-B7AE-5E2B46E0F0E7}" = Windows Live Photo Common

"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

"{D604900F-A275-416C-AF9D-CDEDF58B72DB}" = Windows Live Mail

"{DD7C5FC1-DCA5-487A-AF23-658B1C00243F}" = Photo Common

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3445598-4424-4EE2-B71C-C23325F7FB71}" = Windows Live PIMT Platform

"{ECEF8079-975D-4337-BF3B-CCCD43537555}" = Windows Live Family Safety

"{EFBCA571-617D-484A-9ECA-E301BB6D0750}" = Windows Live Writer

"{F0E58739-2B4C-498F-9B0D-FF0F2FD52B61}" = Windows Live UX Platform

"{F6F30C28-38AA-4DBA-AE0B-7E30238E61BB}" = Junk Mail filter update

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"WinLiveSuite" = Windows Live Essentials

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SkyDriveSetup.exe" = Microsoft SkyDrive

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 02/09/2013 03:09:06 | Computer Name = helen-PC | Source = System Restore | ID = 8193

Description =

 

 

< End of report >

Edited September 2, 2013 by mij

[Starbuck]

Hi Jim

 

The RK log seems to have vanished - that was probably me.

So you did run RK then?

RK will store a copy of the report in the same location as the main program.

So if RK was downloaded to the Desktop.... the report will be copied there.

If you can't find it....

Click Start.... in the Search box type RKreport.txt

See if this finds it.

If not, download a fresh copy and run it again.

 

The Main Otl log was cut off when you copied it to your post....... please post the Main.txt again for me.

 

You are missing one important program on that computer: An antivirus.

This is somewhat suicidal in today's digital world.

You need to install an antivirus program as soon as you can and run a complete scan of the computer:

• Avira AntiVir
  
• MS Security Essentials ... see note*
  

Install one of these, update the definitions and then run a full scan. Let it quarantine/delete anything it finds. Let me know if there is anything that it reports but can not remove.

 

Thanks

[mij]

Was W7 on a 64 bit Dell now malware related

 

I was unable to find an RKreport.txt so I have downloaded it again and have copied and pasted its report below.

 

The two files it found I deleted when prompted to on exit

 

The JRT software was run and I hope I have paid attention to the begining and ending of the report. It is also pasted below. I have only the one OTL report so should I run it again? I've obviously done someting wrong with it. It's not in the recycle bin either.

On the matter of MSEssentials it was in the process of upgrading this computer that whatever got here was downloaded. Perhaps you will be able to see the time etc in the data.

I will look for MSEssentials and set it up but I'll be careful about invitations to butter up the browser. It should be the latest version from MS

Jim

 

 

RogueKiller V8.6.8 [sep 2 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : helen [Admin rights]

Mode : Scan -- Date : 09/02/2013 17:54:50

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤

[HJ POL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJ POL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

-> C:\windows\system32\config\SYSTEM | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\windows\system32\config\SOFTWARE | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\windows\system32\config\SECURITY | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\windows\system32\config\SAM | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\windows\system32\config\DEFAULT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\Users\Default\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Users\Default User\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Users\Helen\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\Users\RA Media Server\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Users\UpdatusUser\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Documents and Settings\Default\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Documents and Settings\Default User\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Documents and Settings\Helen\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> C:\Documents and Settings\RA Media Server\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> C:\Documents and Settings\UpdatusUser\NTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

 

 

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3500620AS ATA Device +++++

--- User ---

[MBR] 4e633f5d5d97f86f0679c7e86a9e4065

[bSP] eed0c2d95e9a62f69af5ebb3c504077e : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 461899 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_09022013_175450.txt >>

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.5.7 (09.01.2013:1)

OS: Windows 7 Home Premium x64

Ran by helen on 02/09/2013 at 7:42:59.05

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

~~~ Services

 

~~~ Registry Values

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installcore

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\visualbee

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitsearchscopes

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\crossrider

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\pricegong

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\visualbee

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3287810

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110311391106}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311391106}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\conduitchecker_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\conduitchecker_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mconduitinstaller_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mconduitinstaller_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\conduitchecker_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\conduitchecker_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\mconduitinstaller_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\mconduitinstaller_RASMANCS

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CDFC44B8-1AA6-4B1E-A656-03EDCF5277EB}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2316C625-B487-4410-A1A5-FF040B65245F}

 

~~~ Files

Successfully deleted: [File] "D:\end"

 

~~~ Folders

Successfully deleted: [Folder] "D:\ProgramData\visualbee"

Successfully deleted: [Folder] "D:\Users\helen\appdata\local\conduit"

Successfully deleted: [Folder] "D:\Users\helen\appdata\local\visualbeeexe"

Successfully deleted: [Folder] "D:\Users\helen\appdata\locallow\conduit"

Successfully deleted: [Folder] "D:\Users\helen\appdata\locallow\pricegong"

Successfully deleted: [Folder] "D:\Program Files (x86)\conduit"

Failed to delete: [Folder] "D:\Program Files (x86)\webconnect"

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 02/09/2013 at 7:47:09.84

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[mij]

I have just tried downloading MSessentials and it tells me that I have insufficient room on something called club. As there is something like 400Gb free on this hard drive how do I redirect the download to another part of the drive please?

jim

[seedy21]

Hello Mij

 

I have merged your other topic into this one as it looks to be answer's to this problem. Please reply to this topic instead of opening another one. It confuses all of us :)

[Starbuck]

Hi Jim,

 

I have just tried downloading MSessentials and it tells me that I have insufficient room on something called club. As there is something like 400Gb free on this hard drive how do I redirect the download to another part of the drive please?

This is obviously the problem....

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)

Drive C: | 451.07 Gb Total Space | 400.66 Gb Free Space | 88.82% Space Free | Partition Type: NTFS

Drive D: | 14.65 Gb Total Space | 0.03 Gb Free Space | 0.21% Space Free | Partition Type: NTFS

Someone definitely had a bad moment when they set this system up.

The operating system should have been set up on the 'C' drive.

We have 2 options here.... we can move some free space from the C drive to the D drive (if you feel confidant in this)

or

If a reinstall is an option..... reformat/reinstall the operating system on the correct partition.

 

Most programs will actually run from another drive, but things like the AV and other security programs should really be installed on the same drive as the operating system.

 

The present setup may be contributing to problems that you are experiencing with the system.

Let me know what you want to do.

[mij]

Thanks for coming back to me on this seedy21.

I only opened the other thread because this one had been closed and there was no reply to thread button.

It is a continuation of the above problem.

should I now repeat the OTL download and scan?

jim

[Starbuck]

should I now repeat the OTL download and scan?

No Jim.

Please read my previous post first..... this is something we need to deal with before continuing.

[mij]

I wanted/tried to reformat this computer previous to this upgrade but it wouldn't allow me.

I think a reformat and reinstallation might be the least tiresome at your end.

SWMBO's grand son comes back tomorrow morning and SWMBO wants to donate it to him for his teacher training course.

Thanks

jim

[Starbuck]

Hi Jim,

 

I wanted/tried to reformat this computer previous to this upgrade but it wouldn't allow me.

You said earlier that this system was originally Vista..... is the Win7 disc a full operating disc or just an upgrade disc?

[mij]

Hi Jim,

 

 

You said earlier that this system was originally Vista..... is the Win7 disc a full operating disc or just an upgrade disc?

Yes, it was a vista system and looking at the disk it says 'upgrade' includes service pack one.

I have used a similar upgrade on my 32bit computer and on SWMBO's 32bit lap-top and those went fine. And still work ok.

jim

[KenB]

Hi Jim

 

I think a reformat and reinstallation might be the least tiresome at your end.

I think both Starbuck and I would agree with you here :)

To be honest - your grandson would find it very annoying every time he tried to install anything.

 

Your problem is that you have an up-grade version of Win7 and to use this you need an older version of Windows on the system already.

 

If you have the Vista recovery partition ( if there was one originally ) we can use this to revert the hard drive back to what it was originally then use the Win7 upgrade disk.

 

Some Dells use F11.

Switch on and tap F11 about once per second. If this doesn't do it try holding CTRL down and tap F11 once per second.

Don't do anything if you get to the recovery options. Shut the machine down.

 

Which model Dell is it ?

 

Also - when you upgraded did you go from Vista Home to Win7 Home say ? In other words like for like ?

 

Also ........... before we do anything at all with this I would suggest cloning the hard drive just in case anything goes wrong.

( this is making an exact copy that can be re-installed onto any hard drive )

 

You have a few hours work ahead of you if the Vista Recovery Partition exists :)

[mij]

Hi Jim

I think both Starbuck and I would agree with you here :)

ok we will go with that if all looks all-right.

 

 

Your problem is that you have an up-grade version of Win7 and to use this you need an older version of Windows on the system already.

Initially I think we started with WXP which SWMBO had on her old Dell.

We went to Vista Home Premium which came on the this Dell. It is a studio one with wireless keyboard and mouse.

 

If you have the Vista recovery partition ( if there was one originally ) we can use this to revert the hard drive back to what it was originally then use the Win7 upgrade disk.

I am unsure here as I don't know how to check that.

 

Some Dells use F11.

Switch on and tap F11 about once per second. If this doesn't do it try holding CTRL down and tap F11 once per second.

Don't do anything if you get to the recovery options. Shut the machine down.

I get

'Disk error

Press any key to restart

CD-ROM Boot Priority..No Medium

No boot device available

SATA0 : HDD:P0-ST3500620AS

SATA 1 : CD/DVD:P1-PLDS DVD+/-RW DL-8ATS'

With the CTRL held down it started windows normall

With F12 (the one shown at start up)it went into repair options.

Which model Dell is it ?

Studio One, 64bit

 

 

Also - when you upgraded did you go from Vista Home to Win7 Home say ? In other words like for like ?

Asking SWMBO she says OS was vista home premium. The disk I have here is W7 home premium so that would be a yes.

Also ........... before we do anything at all with this I would suggest cloning the hard drive just in case anything goes wrong.

( this is making an exact copy that can be re-installed onto any hard drive )

I do have an external hard drive that I got when revamping the drives on my computer on my last visit here.

 

You have a few hours work ahead of you if the Vista Recovery Partition exists :)

A last question or two.....

I think I can find an XP disk or two, might that be any use here i.e. reformatting etc?

On the Dell I now get prompted to 'manage add-ons' every time I open a program - it's annoying, can it be switched off?

Phew! What a lot of typing.

jim

[KenB]

Hi Jim

 

Boot up and then goto Start > type in .......diskmgmt.msc ..... ENTER

This will give you a list of what partitions are on the hard drive.

 

If you have a recovery partition on there it will show up ......... but not with a drive letter.

 

What is there ?

 

=====================

 

It is possible to install XP then upgrade to Win7.

If you are going down this route then the first thing to do is to make an image of the hard drive ..........just in case :)

[mij]

Thanks for coming back to me on this Ken.

 

Hi Jim

Boot up and then goto Start > type in .......diskmgmt.msc ..... ENTER

This will give you a list of what partitions are on the hard drive.

 

It gives an unlettered drive that has a simple layout basic type has a healthy status (OEM Partition) 39MB capacity is 100% free

In C: drive "---------"----------NTFS system--------"------- (System, page file, Active, Primary Partition 451.07 GB capacity of which 400.6... GB free.

my club (D:) simple layou, basic type, NTFS file system, healthy status (boot,crash dump, primary partition 14.65GB and 10MB free.

 

If you have a recovery partition on there it will show up ......... but not with a drive letter.

 

That looks like it may be first one then?

 

It is possible to install XP then upgrade to Win7.

If you are going down this route then the first thing to do is to make an image of the hard drive ..........just in case :)

 

Perhaps we'll give that idea a miss then, eh?

jim

Edited September 3, 2013 by mij

[KenB]

(OEM Partition) 39MB ....... that looks like it may be first one then?

Looks like it was ..... once ..... but the drive is showing 100% free - which implies that there is nothing on it.

 

Perhaps we'll give that idea a miss then, eh?

This would be a possible solution. Install XP ..... which would format the drive then install Win7 from the upgrade disk.

 

 

 

Trouble is ........... if anything goes wrong you will need a backup - this is where cloning the present hard drive comes in.

 

 

If you are not happy doing this ............ not a problem.

We can leave things as they are and, as already explained, it will just be a bit awkward for grandson when he inherits pc.

 

Let us know what you are happy doing :)

[mij]

Hi again KenB, thanks for returning.

l have just spoken with SWMBO and she reckons that she has had only Vista home premium on the studio One and also produced the Vista disks for re-installing the operating system, windows Vista. She says that XP was on the other Dell which preceded this one.

Sorry about the misleading but my memory is not as good.

Would reverting to the Dell Vista Premium with their disk be better for you? It will take me 1 to 4 hours by their forecast. I don't mind this at all.

I could then try W7 upgrade from there and hopefully find out what I did wrong last time.

jim

[Starbuck]

it will just be a bit awkward for grandson when he inherits pc.

Just to add an explanation if you need one.

A lot of software will automatically try and install to the C Drive... so you will need to redirect it to the D Drive.

Some software won't allow the drive change and must be installed on the same drive as the operating system.

[mij]

Oh hi starbuck, thanks for coming back,

Would that still be the case if we reverted to the Dell Vista Premium and upgraded to W7 from there. I just assumed that what ever mistake was made would not be repeated and that 'my club (D: )' would not be present.

Jim

PS The semicolan followed by a rh bracket has made an unintentional smiley in the reference to the D drive.

 

------------------

Mod edit:

I've corrected that for you Jim.

 

Starbuck

Edited September 3, 2013 by Starbuck