G

Guest

Guest
Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I have a pc running xp sp2 and it is on a network. Tcpip won't work no matter
what I do, so I followed microsofts instructions to remove winsock and
winsock2 from registry. I re-installed tcpip protocol, then rebooted. After
login, I get a EULA, for some software I've never heard of, without clicking
the "i agree", (that was the only choice) I close it by clicking the X in the
upper corner. I received a few error messages after that, and now I cannot
boot up into windows. I get my desktop, but no Icons. But I am receiving pop
ups from the internet. I have killed any suspect processes in the task
manager. I get the same symptoms booting to safe mode also. I have seen this
once before, and just formatted the drive and started over.
BTW Before all of this, I ran adaware, spybot, hijack this ... The pc came
up clean.
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

From: "frustrated" <frustrated@discussions.microsoft.com>

| I have a pc running xp sp2 and it is on a network. Tcpip won't work no matter
| what I do, so I followed microsofts instructions to remove winsock and
| winsock2 from registry. I re-installed tcpip protocol, then rebooted. After
| login, I get a EULA, for some software I've never heard of, without clicking
| the "i agree", (that was the only choice) I close it by clicking the X in the
| upper corner. I received a few error messages after that, and now I cannot
| boot up into windows. I get my desktop, but no Icons. But I am receiving pop
| ups from the internet. I have killed any suspect processes in the task
| manager. I get the same symptoms booting to safe mode also. I have seen this
| once before, and just formatted the drive and started over.
| BTW Before all of this, I ran adaware, spybot, hijack this ... The pc came
| up clean.

You may be infected with a virus and that's why non-viral malware scanners failed to find
anything.

Dump the contents of the IE Temporary Internet Folder cache (TIF)
Start --> Settings --> Control Panel --> Internet Options --> Delete Files

Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
Tools --> Options --> Privacy --> Cache --> Clear


Download CLEAN.EXE from the URL --
http://www.ik-cs.com/programs/virtools/clean.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
{ http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
(.lnk) files and a PDF instruction file.

GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
Scanner. You may have to disable your FireWall or allow FTP.EXE to go through your FireWall
to allow the FTP utility to download the needed files

CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
to scan again at a future date, run this batch file. It will automatically check the date
of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
signature files and install them before performing the scan.

DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
you have booted from an Emergency Boot Disk or DOS disk and have already executed;
c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
http://www.bootdisk.com/bootdisk.htm

I need you to perform the following...

Execute; CLEAN.EXE
Choose; Unzip
Choose; Close

Execute; c:\mcafee\GetFiles.BAT
{ or Double-click on 'GetFiles Link' in c:\mcafee }

Reboot the PC into Safe Mode [F8 key during boot]

Shutdown as many applications as possible !
It would also help for you to read - "How to perform a clean boot in Windows XP"
http://support.microsoft.com/kb/310353

Execute; c:\mcafee\CLEAN.BAT
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"David H. Lipman" wrote:

> From: "frustrated" <frustrated@discussions.microsoft.com>
>
> | I have a pc running xp sp2 and it is on a network. Tcpip won't work no matter
> | what I do, so I followed microsofts instructions to remove winsock and
> | winsock2 from registry. I re-installed tcpip protocol, then rebooted. After
> | login, I get a EULA, for some software I've never heard of, without clicking
> | the "i agree", (that was the only choice) I close it by clicking the X in the
> | upper corner. I received a few error messages after that, and now I cannot
> | boot up into windows. I get my desktop, but no Icons. But I am receiving pop
> | ups from the internet. I have killed any suspect processes in the task
> | manager. I get the same symptoms booting to safe mode also. I have seen this
> | once before, and just formatted the drive and started over.
> | BTW Before all of this, I ran adaware, spybot, hijack this ... The pc came
> | up clean.
>
> You may be infected with a virus and that's why non-viral malware scanners failed to find
> anything.
>
> Dump the contents of the IE Temporary Internet Folder cache (TIF)
> Start --> Settings --> Control Panel --> Internet Options --> Delete Files
>
> Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
> Tools --> Options --> Privacy --> Cache --> Clear
>
>
> Download CLEAN.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/clean.exe
>
> It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
> { http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
> (.lnk) files and a PDF instruction file.
>
> GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
> Scanner. You may have to disable your FireWall or allow FTP.EXE to go through your FireWall
> to allow the FTP utility to download the needed files
>
> CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
> to scan again at a future date, run this batch file. It will automatically check the date
> of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
> signature files and install them before performing the scan.
>
> DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
> you have booted from an Emergency Boot Disk or DOS disk and have already executed;
> c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
> http://www.bootdisk.com/bootdisk.htm
>
> I need you to perform the following...
>
> Execute; CLEAN.EXE
> Choose; Unzip
> Choose; Close
>
> Execute; c:\mcafee\GetFiles.BAT
> { or Double-click on 'GetFiles Link' in c:\mcafee }
>
> Reboot the PC into Safe Mode [F8 key during boot]
>
> Shutdown as many applications as possible !
> It would also help for you to read - "How to perform a clean boot in Windows XP"
> http://support.microsoft.com/kb/310353
>
> Execute; c:\mcafee\CLEAN.BAT
> { or Double-click on 'Clean Link' in c:\mcafee }
>
> A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
> end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
> It is suggested that you move the report out of c:\mcafee before performing another scan.
> It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
> report for each session.
>
>
> * * * Please report back your results * * *
>
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>
David
I cannot do anything inside of windows. There is no taskbar, start button,
nothing, and I cannot get into safe mode either. The only thing I can bring
up is task manager, and the pop ups that just happen to show up. :(
I'll try to boot from a floppy and try to run those utilities and give you
an update.
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

From: "frustrated" <frustrated@discussions.microsoft.com>


| David
| I cannot do anything inside of windows. There is no taskbar, start button,
| nothing, and I cannot get into safe mode either. The only thing I can bring
| up is task manager, and the pop ups that just happen to show up. :(
| I'll try to boot from a floppy and try to run those utilities and give you
| an update.

Booting from a floppy won't help as it most likely is DOS.

Try logging in as another user such as; administrator

If for can't logon as administrator, then you may have to run a repair install.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm