I have a problem with annoying pop-ups for which I’ve yet to find a solution.  MAINLY it’s Application Manager, typified by the following three screens (see attachment AppMgr_screens.doc)
 
The first pop-up is now continually present and I’ve had to push it to one side of the screen to enable me to work with other applications which, surprisingly, do NOT seem to be affected in any way by this apparent Application Manager problem.

Because of the pointer to browserprotect.exe (second screen) I’ve tried closing that via Task Manager but it immediately recreates itself and appears repeatedly in the list of Processes.  I’ve also tried sfc /scannow from the command line but the problem still remains.  Whether scannow is an appropriate route I’m not sure – but I’m at a LOSS as to what is causing the problem.  Incidentally, running DrWeb, Malwarebytes and/or a full SCAN with AVG Free 2013 also show no problem with viruses – although Malwarebytes DID discover (and remove) a Rootkit.0Access file.  Despite this, the Application Manager popup is still present.

As a secondary (but similar) issue I’m also plagued (occasionally) with Word crashing when I try to close it, usually by clicking on the red X at the top right of the screen.  It produces screens similar to the first above, copyable via the Clipboard to Wordpad and subsequently to Word as shown in the second attachment, WordCrash_screens.doc.

Running Detect and Repair (or even reinstalling Word) doesn’t cure the problem.

Are these two problems related?  Whatever, I’d be grateful for any assistance in curing them.

My OS is Win XP Pro and the Word version is 2000.


[recovering disk space, attachment deleted by admin]Here's some information about rootkits.

It appears your system is infected with a rootkit. A rootkit is a powerful piece of malware, that allows hackers full control over your computer for means of sending attacks over the Internet, or using your computer to generate revenue.

Malware experts have recommended that we make it clear that with the system under control of a hacker, your computer might become impossible to clean 100%.

Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. They can disable your antivirus and security tools to prevent detection and removal. This type of exploit allows them to steal sensitive information like passwords, personal and financial data which is sent back to the hacker. To learn more about these types of infections, you can refer to:

 What danger is presented by rootkits?
 Rootkits and how to combat them
 r00tkit Analysis: What Is A Rootkit

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable. Do NOT change passwords or do any transactions while using the infected computer because the attacker may get the new passwords and transaction information. (If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.) Banking and credit card institutions should be notified to apprise them of your situation (possible security breach). To protect your information that may have been compromised, I recommend reading these references:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
What Should I Do If I've Become A Victim Of Identity Theft?
 Identity Theft Victims Guide - What to do
It is dangerous and incorrect to assume the computer is secure even if the malware appears to have been removed. In some instances an infection may have caused so much damage to your system that it cannot
be completely cleaned or repaired so you can never be sure that you have completely removed a rootkit. The malware may leave so many remnants behind that security tools cannot find them. Tools that claim to be able to remove rootkits cannot guarantee that all traces of it will be removed. Many experts in the security community believe that once infected with such a piece of malware, the best course of action would be a reformat and clean reinstall of the OS. This is something I don't like to recommend normally, but in most cases it is the best solution for your safety. Making this DECISION is based on what the computer is used for, and what information can be accessed from it. For more information, please read these references very carefully:
When should I re-format? How should I reinstall?
Help: I Got Hacked. Now What Do I Do?
Help: I Got Hacked. Now What Do I Do? Part II
Where to draw the line? When to recommend a format and reinstall?

Guides for format and reinstall:

how-to-reformat-and-reinstall-your-operating-system-the-easy-way

However, if you do not have the resources to reinstall your computer's OS and would like me to attempt to clean it, I will be happy to do so. But please consider carefully before deciding against a reformat.
If you do make that decision, I will do my best to help you clean the computer of any infections, but you must understand that once a machine has been taken over by this type of malware, I cannot guarantee that it will be 100% secure even after disinfection or that the removal will be successful.

Please let me know what you have decided to do in your next POST. Should you have any questions, please feel free to ask.Hi SuperDave

Thanks for that detailed (and VERY sobering) info on my problem.  Although I don't look forward to the effort involved, I'm going to go ahead with a reformat and reinstall.  It will be a marathon task.  Fortunately, I have another PC with minimal applications which I can fall back on if I experience trouble.

Thanks again.

GeordieLad Quote from: GeordieLad on June 03, 2013, 04:19:27 AM

Hi SuperDave

Thanks for that detailed (and VERY sobering) info on my problem.  Although I don't look forward to the effort involved, I'm going to go ahead with a reformat and reinstall.  It will be a marathon task.  Fortunately, I have another PC with minimal applications which I can fall back on if I experience trouble.

Thanks again.

GeordieLad