Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Problem with Microsoft Calendar reminder


  • Please log in to reply
9 replies to this topic

#1 Sleepless

Sleepless

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:07:00 PM

Posted 18 September 2009 - 03:51 AM

Ok, I'm in the correct forum now.

I recently downloaded malwarebytes anti-malware program. The instructions were good and it worked fine. But, now I can't access my calendar for reminders. I get a generic error message saying "Microsoft Works 8 has encountered a problem and must close."
It does not say what problem.
I am not using Microsoft Works 8, nor have I downloaded or installed it, ever.
I'm using Microsoft Works 2003 which came pre-installed on my computer when I bought it.
I never upgraded.
None of the items in the list of malware found said anything about microsoft calendar.
I've tried rolling back to a date before I used the anti-malware program but it had no effect.
My calendar data seems to be there, and it was backed up, the program just won't run.
The only other thing I use from M. works is a spreadsheet which still opens fine.

I can't find any way to make the calendar run.
I hope someone has some ideas.
Thanks.

BC AdBot (Login to Remove)

 


m

#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,388 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:08:00 PM

Posted 18 September 2009 - 08:33 PM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 69,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:00 PM

Posted 18 September 2009 - 09:04 PM

Hello,let's start here.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Next run ATF and SAS:
Note.. SAS doesn't open the registry hives for other user accounts on the system, so scans should be done from each user account.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 Sleepless

Sleepless
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:07:00 PM

Posted 21 September 2009 - 01:32 PM

Hi boopme, thanks for replying.

I've been following the instructions you posted and I have some results and questions I'd like you to comment on before I go any further.

I updated and ran MBAM and I have that log (it, like all runs after the first found nothing.) I also found the log from the first scan I ran and I'll post them both below.

First though, I have a question about something that happened as I was following your directions.

I downloaded SUPERAntiSpyware and ATF Cleaner.

I installed SuperAntiSpyware, checked only the items you suggested, and updated it.

I tried to reboot into safe mode with F8 and a list of things printed out on the screen then the computer seemed to freeze up. After a couple minutes of no activity, I turned it off and rebooted normally.

I got online and found that now the toolbars for Internet Explorer are mostly blacked out and I can't read or see my buttons. I haven't found a way to undo this new problem yet, so I need advice here.

My next question involves the next step in your instructions where you say to run ATF Cleaner. You said "Under Main 'Select Files to Delete' choose : Select All." My question is what is it I am deleting? You mention I can choose to save passwords, but I'd like to know what I'm going to lose?

That's as far as I've gotten so far.

Immediately below, I've copied the original log from my first MBAM run.
Below that, is the log from the run you asked for at the start of your instructions.
I hope I've been clear in my explanations here. Thanks for helping. Here is the first log.....

Malwarebytes' Anti-Malware 1.41
Database version: 2814
Windows 5.1.2600 Service Pack 3

9/17/2009 1:38:13 AM
mbam-log-2009-09-17 (01-38-13).txt

Scan type: Quick Scan
Objects scanned: 106484
Time elapsed: 4 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 15
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\HP_Owner\Favorites\Free Porn Tube Categories Keezmovies.com.url (Rogue.Link) -> Quarantined and deleted successfully.


-----------------------------------------------

Here is the most recent log......

Malwarebytes' Anti-Malware 1.41
Database version: 2834
Windows 5.1.2600 Service Pack 3

9/21/2009 3:10:46 AM
mbam-log-2009-09-21 (03-10-46).txt

Scan type: Quick Scan
Objects scanned: 106860
Time elapsed: 11 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-----------------------------------------

End of post. Thanks

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 69,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:00 PM

Posted 21 September 2009 - 03:30 PM

Hello the MBAM logs lok good. Run the ATF and SAS in normal for now and we will see if removes anything else that may be causing this.
ATF will clear all these if checked.
http://www.softpedia.com/progScreenshots/A...shot-32740.html
You will only lose the Passwords if you do not check the browsers.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 Sleepless

Sleepless
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:07:00 PM

Posted 24 September 2009 - 03:37 PM

Ok, I've tried 6 times to boot into safe mode but I either get into a loop or the computer locks up:

1. I get to the page asking to boot in XP home edition, or XP recovery. F8 option is on the bottom.
2. I press F8
3. I get a page with many boot options. I choose "safe mode".
4. I go back to the same page as in #1 above except that now it says "safe mode" in blue at the bottom left of the screen.
5. If I press F8 again, I goto the same page as in #3. I choose safe mode again.
6. I end up back at #4. This is the loop.
When at the page in #4, if I choose windows XP home edition, the screen prints a list of drivers. There is intermittant activity on drive C for a little while, then everything stops. 5 minutes later, I'm still stuck there. Keyboard is dead. Only option is to press the off button on the tower and boot normally.

So, Do I have to run the suggested programs in safe mode?
Is ATF cleaner only for Vista? I have XP, should I run it or not? (I should have mentioned this earlier I know).

I went to the Add/remove list on the control panel. I have 2 entries for microsoft works, I don't kno why. When I click on support, I get an option to repair the existing installation. Niether one works. My problem with the calendar is still with me. Even when it reads off the Works disk (which I just found BTW)

If I reinstall Works, will I lose all the reminders I have for my calendar? I especially don't want to lose my Works movie database files. (They're backed up too just in case.)
My calendar files are backed up, but I don't know which file holds the reminder data. If I knew, I could try replacing that file from a new installation with the existing file.

Another thing I found is if I go the the Works calendar folder and right click on WksCal.exe and choose "run as" from the menu (which is my current administrator standing) I get a different error message. This one says works cannot access some necessary files, they may have been moved or deleted.
Replacing the existing calendar files with my backups is no help no matter how I try to run the program. These error messages only tell someone that something is wrong, not where the problem is, like WHAT files can't it find.

I still need your advice on what I should do at this point.
Thanks for the help.

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 69,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:00 PM

Posted 24 September 2009 - 09:51 PM

So, Do I have to run the suggested programs in safe mode?
Is ATF cleaner only for Vista? I have XP, should I run it or not? (I should have mentioned this earlier I know).

I saw that you have XP in your MBAM log. Please run these from Normal mode for now. We'll see if things come back with removals.


If I reinstall Works, will I lose all the reminders I have for my calendar? I especially don't want to lose my Works movie database files. (They're backed up too just in case.)
My calendar files are backed up, but I don't know which file holds the reminder data. If I knew, I could try replacing that file from a new installation with the existing file.
You probably will lose that with a reinstall.
Another thing I found is if I go the the Works calendar folder and right click on WksCal.exe and choose "run as" from the menu (which is my current administrator standing) I get a different error message. This one says works cannot access some necessary files, they may have been moved or deleted.
Replacing the existing calendar files with my backups is no help no matter how I try to run the program. These error messages only tell someone that something is wrong, not where the problem is, like WHAT files can't it find.

You could ask in the "All other Applications forum" some who uses it would know more than I about those two.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.



I still need your advice on what I should do at this point.
Thanks for the help.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 Sleepless

Sleepless
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:07:00 PM

Posted 25 September 2009 - 10:13 PM

Ok, I ran ATF and SAS in normal mode. No problems. The MBAM scan I ran found nothing. Here is the log from the SAS scan:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/25/2009 at 08:17 PM

Application Version : 4.29.1002

Core Rules Database Version : 4125
Trace Rules Database Version: 2064

Scan type : Complete Scan
Total Scan Time : 04:10:49

Memory items scanned : 532
Memory threats detected : 0
Registry items scanned : 8718
Registry threats detected : 0
File items scanned : 355391
File threats detected : 1

Adware.Tracking Cookie
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@realmedia[1].txt


The calendar problem is still with me.

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 69,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:00 PM

Posted 26 September 2009 - 06:23 PM

Hello,we look clean now. So I have this suggestion for the clock. Your next option is to ask about this in the XP forum now that malware is ruled out.

Please run sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files
NOTE for Vista users..The command needs to be run from an elevated Command Prompt.
Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the XP CD when asked.

Edited by boopme, 26 September 2009 - 06:23 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 Sleepless

Sleepless
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:07:00 PM

Posted 27 September 2009 - 06:33 PM

Ok, thanks for the help.
I haven't needed any system CDs before. I don't even rememberWHAT I got when I bought the computer. If I find them, maybe I'll try Sfc.exe. That guide link looks kinda complicated, so till then I'll look for a simpler fix.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users