Spyware help needed

[Interwood]

Hi Smidsy,

In Windows XP it's hiding in c:\windows\system32

In other versions of Windows, start up a dos or command prompt window and enter the following:

cd\ [enter]
dir regsvr32.exe/s

What this does -

The first line takes you to the root directory
The second line searches the whole C drive for regsvr32.exe.

If you have installed windows onto C drive, this will find it. If it is on another drive, ie. D you will need to enter d: [enter] before the two lines above.

Good luck

Interwood

[Sprog]

Hei Sprog,
That's the same link I posted in my original message - but the tasks it says to kill in task manager aren't there and I can't find a copy of regsrvr32.
Paul

It means to kill the tasks first if they are runnung.
Then you need to unregister and remove the dll's, which you say you have done.
Then you need to delete all the crap from the registry if present using regedit to locate them.
Then delete the named files if present using windows explorer or the search facility.

regservr32 is accessed using the Run option and typing regservr32 /u name_of_dll

[Gingermick]

Before you reinstall you could try spy sweeper. I had a major problem with popups on IE and it stopped them where spybot hadn't.

mick

[Bob Willson]

Hello Smidsy
Are you sure that you have 10 gig of data?
Most people have about 20 meg of data and the rest is programs. Programs, assuming you have copies of them, are not a problem as they can just be reinstalled. So, unless you have the Kodak archives mirrored on your system, or you have a whole bunch of movies or music on the HDD then it is likely that all your data will fit on to one CD.
If you do have lots of movies or music then just burn them to CD/DVD. This is where they more properly belong anyway.

To get back to not being able to find the file, you aren't hiding your system files from yourself are you? This is a Micro$oft trick designed to stop cretins from deleting all their system files because they don't know what they are and they never use them anyway.

Go to My Computer/ Tools/ Folder Options/View and make sure that the radio button is ticked to allow you to see the system files.

[Sprog]

Windows XP has a System Restore function which allows you to get back to a previous state.

Click on
Start>Help and Support>Undo changes to your computer with System Restore
click Restore my computer to an earlier time, click Next
Select a date in bold type that is before your problem and click Next, follow the prompts.

Anything you have saved after this date that is NOT in My Documents may be lost so take the appropriate actions to preserve anything you need.

That is the problem to replying before having a nap

[smidsy]

Hei Bob,
You got it in one - lots of music and video files.
I could delete these to CD but I watch and listen to them on the PC so I don't see any point until I start running short of drive space.
All I would back up apart from these is e-mail, bookmarks and WP files which total would be less than a meg.

I know what you mean about hidden files and how to look for them - I actually found all the files for this thing but I needed to disable the .dll which killbox allowed me to do.
All seems fine now except that IE is still missing from the add/remove programs list. When I first started looking at this there was something called "Internet Explorer Q123456" in the add/remove programs list which I selected to remove - I'm thinking now that this could have been an anti-fix trick on the spyware.

The system seems to be running ok now and there is no visible signs of the spyware so I shall see how it goes for a day or two.
If worst comes to worst I shall bite the bullet and do a win re-load.

Cheers
Paul

PS I actually run Win2000 guys.

[derekcohen]

"If worst comes to worst I shall bite the bullet and do a win re-load".

Paul

I went through this quite recently - I was ready to buy another desktop machine. Luckily I mostly use my laptop. (I really do need to buy one anyway as the desktop is an old Pentium 3 with Win 98, about 5 years old - still, it is not used for games and does all it sets out to do). I had to reformat the whole hard drive (only 10 gig) and to make sure I removed all partitions as well since this is where files can hide, I was told. Drastic measures but it worked. Like you, I tried umpteen anti-spy programs, all in vain.

I now run Xoftspy, McAfee and Kerio Firewall, and so far nothing has slipped through.

Regards from Perth

Derek

[smidsy]

Hei Derek,
This machine is old (built Jan 2002 by yours truly) and slow (P4 1.4gig & 512ram) by most standards but it suits me fine.
I'm not a massive gamer, and use it mainly for word processing, mail and the net.
What I've done in the past to reformat a drive is hook the drive up to a second machine so that during the reformat you are not operating on the drive that's being formatted - I think this is the only way to go.
I'll see how it runs in the next week or so and bite the bullet if I have to.
Cheers
Paul

[Bob Willson]

No need to remove the HDD from the machine, just boot from the CD and that will allow you the option of reformatting the HDD.

[smidsy]

I know you can format via the CD, but I would have thought that the pc would need at least some files on the HD to do the actual format.

Based on that theory, to do an absolutely total format you need to be running the format command from another HD.

I may be talking crap here but that's what I would have thought.

Cheers
Paul

[Bob Willson]

Yes, you are correct there Paul. You are talking crap.

No files are actually required to be on the HDD as they will just reside in the computers memory (RAM) and run from there. So, that should save you a bit of work if you need to do this again.

[Sprog]

All seems fine now except that IE is still missing from the add/remove programs list. When I first started looking at this there was something called "Internet Explorer Q123456" in the add/remove programs list which I selected to remove - I'm thinking now that this could have been an anti-fix trick on the spyware.


PS I actually run Win2000 guys.

You might want to look at this article on MS support site, especially the examples to the right of the page.

http://support.microsoft.com/?kbid=810232