http://www.dslreports.com/forum/r10822093 en Mon, 30 Nov 2009 09:40:34 EDT Mon, 30 Nov 2009 09:40:34 EDT http://www.dslreports.com/forum/remark,10826715 B :
While you're still in Safe Mode, try going to a command prompt (you can use Explorer but I don't trust it) and navigating to the directories indicated in your first screen shot -- see if those files are still there.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,10826715 Tue, 20 Jul 2004 11:16:15 EDT http://www.dslreports.com/forum/remark,10826521 Swordfish II : ok, I ran adaware in safe mode but none of that stuff came up. Gonna do the virus scans and hijack this scans
--
I'm not going there to die. I'm going there to see if i really am alive.]]> http://www.dslreports.com/forum/remark,10826521 Tue, 20 Jul 2004 10:52:09 EDT http://www.dslreports.com/forum/remark,10826485 B :
Well, technically, I think the rules are broken ONLY after the first HJT log appears! So we should be safe.

Swordfish, the only potential problem with logging in as local administrator is that you'd be giving any resident trojans more privileges.

If, however, your domain user (the regularly logged in user who was infected) is ALREADY a local administrator of the machine (as is frequently the case), then it won't matter much.

It would probably be best if you took this machine off the network until you clean it up.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,10826485 Tue, 20 Jul 2004 10:47:14 EDT http://www.dslreports.com/forum/remark,10823245 siggyx : Follow the steps in the link below or the thread might get locked. Thems the rules.

»Security »I think my computer is infected or hijacked. What should I do?
--
The next best thing to being smart is being able to quote someone who is.]]> http://www.dslreports.com/forum/remark,10823245 Mon, 19 Jul 2004 23:09:01 EDT http://www.dslreports.com/forum/remark,10822916 Swordfish II : Oh I forgot to mention we log into a domain, but to start in safe mode we have to log in as the admin on the computer. I know the admin user name and password, but will this affect the results?
--
I'm not going there to die. I'm going there to see if i really am alive.]]> http://www.dslreports.com/forum/remark,10822916 Mon, 19 Jul 2004 22:30:53 EDT http://www.dslreports.com/forum/remark,10822650 Swordfish II : I was kinda confused though, after restarting the computer adaware ran but didnt pick up any of the files in the screen shot. Then after a couple min the pop ups descended and when I ran adaware again, they were all back.
--
I'm not going there to die. I'm going there to see if i really am alive.]]> http://www.dslreports.com/forum/remark,10822650 Mon, 19 Jul 2004 22:02:49 EDT http://www.dslreports.com/forum/remark,10822131 B :
But does anyone think they should try it in Safe Mode?

;)

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,10822131 Mon, 19 Jul 2004 21:06:32 EDT http://www.dslreports.com/forum/remark,10822121 gt7697c : Suggest try running Ad-Aware in Safe Mode. Please post results.

Edit, too slow. Oh well.;)

If Safe Mode doesn't work you could try using WinBoot CD it comes with Ad-Aware and will run from a boot CD.

HTH.:)

--
Just my 2 bits.]]> http://www.dslreports.com/forum/remark,10822121 Mon, 19 Jul 2004 21:05:36 EDT http://www.dslreports.com/forum/remark,10822120 Kayrac : that means there currently running in memory, one easy way to prevent that, is to boot into safe mode, and then run ad-aware
you can also follow these steps
»Security »I think my computer is infected or hijacked. What should I do?
lol i was slower than 1.....but atleast i was faster than 1 ;)]]> http://www.dslreports.com/forum/remark,10822120 Mon, 19 Jul 2004 21:05:33 EDT http://www.dslreports.com/forum/remark,10822117 B :
Try running it in Safe Mode.

Then try grabbing Spybot from »safer-networking.org . It frequently works better.

Finally have her go through all the steps at »Security »I think my computer is infected or hijacked. What should I do? . Good luck.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,10822117 Mon, 19 Jul 2004 21:05:21 EDT http://www.dslreports.com/forum/remark,10822093 Swordfish II : Hey my friend asked me to help her out with all these popups so I ran adaware but there are some things it cannot remove even though it says it will on the restart. Here is a pic
--
I'm not going there to die. I'm going there to see if i really am alive.

]]> http://www.dslreports.com/forum/remark,10822093 Mon, 19 Jul 2004 21:02:44 EDT