Hi, a coworker has a dell laptop win xp sp1. I was trying to clean it out for
her.
norton found msn chat sniffer. the idle rescources was at 0 before I started.
I ran adaware and norton. I rebooted in safe mode and when the machine boots
up a empty window pops up with a couple little boxes in it. I can not find
out what it is or whats causing this. this even happens in safe mode. it also
has a problem with the dreaded "end program" screen on shutdown. one of them
said "SAMPLE" not responding.

"Starvoyager" wrote:

> Hi, a coworker has a dell laptop win xp sp1. I was trying to clean it out for
> her.
> norton found msn chat sniffer. the idle rescources was at 0 before I started.
> I ran adaware and norton. I rebooted in safe mode and when the machine boots
> up a empty window pops up with a couple little boxes in it. I can not find
> out what it is or whats causing this. this even happens in safe mode. it also
> has a problem with the dreaded "end program" screen on shutdown. one of them
> said "SAMPLE" not responding.

Download this tool (AutoRun) and you can clean with whatever you will find
and see what app is running in the background in real time:
AutoRuns for Windows v8.61:
http://www.microsoft.com/technet/sys.../Autoruns.mspx
1... Click start >> Control Panel >> Double Click Network and Internet
Connections >> Double click Internet Options, on the IE Properties window
you will see these Options:
General | Security | Privacy | Content | Connections | Programs
| Advanced .

Click on General Tab (1st Tab on the left) and you will see a Button called
[ Clear History ..] click on it to clear your History caches, then click on
[Delete Files..] to delete Internet Files created over the time, click on [
Delete Cookies...] to delete your cookies left by visiting websites.

= Then try to Disable the Add-Ons on your Browser somehow installed on your
browser, On how to disable the Add-ons follow this:
Click on Programs Tab and then click the Manage Add-Ons Button there Disable
the None/Not Verified Plug-ins/Add-ons ( you need to Renable them one-by-one
later and see which is the culprit or you can send them here in your next
post) and click [OK] to confirm your Changes.

Click on Advanced Tab and scroll down under the browsing option and uncheck
this box:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) and click Apply
then OK to close your IE Properties.

2.... And also for malwares from here:
http://www.lavasoft.com/products/ad-...e_personal.php
http://www.safer-networking.org ; for Spybot S&D
Download and install after installing this software and
update then run a scan in both safe mode and normal:
http://free.grisoft.com/doc/5390/lng/us/tpl/v5
= Open the Windows
Explorer and locate this path:
C:\Windows\System32\drivers\etc = look in the Right Pane/window for this
file called the HOSTS file but not the one with the extension *.SAM* leave
this as is.
If you can't see it try to click Tools >> Folder Options and select show
Hidden files and folder, then right Click the Hosts file and select open with
Notepad.
There see any reference for that site and remove it, you Hosts file will
looks like this:
# 102.54.94.97 rhino.acme.com # Source server
# 38.25.63.10 x.acme.com # Client Host
127.0.0.1 LocalHost
------------------------------------------
Remove all other References other than those above.

Run disk Clean Up and Defrag in safe mode, then Open run command and type in:
sfc /scannow click [OK]
Note the space between sfc_/

If you still directed Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
Let us know.
Regards,
nass
----------
www.nasstec.co.uk