N
Nick Goetz
Hi Kelly:
In one case:
System was protected by PCCillin 2004, firewall was on and properly
configured (though both were prevented from running). A number
viruses were removed/disabled using other tools. PCCillun then
detected a number of Spyware objects that it couldn't effectively
clean.
Started with "HijackThis" followed by the usuall registry checking
and other freeby programs to removed almost all of the "critters"
- Adaware detected 2 files that it was unable to remove on reboot
or in safe mode (Spybot didn't detect them). They were deleted
using the recovery console but reappeared with different "morphed"
names upon reboot.
- the "AppInit_DLLs" regestry key was empty (no binary value).
- there were no "apparent" services or processes to kill.
- the "services" key in registry had no "apparent", suspicious
entries (at least that I could recognize).
- checked for files in System32 with the same date stamps, "odd"
names, and similar file sizes to the detected files and
moved/renamed with "ERD Commander"(there were a number of them -
not detected by any of the free programs).
Still no luck
GiantAS completed the job.
The freebies have worked in hundreds of other cases without the use
of a "payfor". I'm sure I missed something but customers get
twitchy when things take too long (usually like to see my backside
heading out the door within an hour).
Nick Goetz