Disappearing windows revisited

[stell]

I posted last week about msconfig, Task Manager and Regedit popping up and
disappearing. Rick(the Nutcase) was kind enough to point me to an emergency
utility that makes copies of these files. The copies also disappear. I've
run NA in Safe Mode, did Symantec's Online Scan, run adaware and spybot and
nothing bad comes up. The windows stay open fine when in Safe Mode. So I am
stumped. Any help would be appreciated as my daughter goes off to college in
2 weeks and I'd like to have her laptop fixed by then.

Thanks

 

[Phil]

Try these:
1 - start, run, type in: sfc /scannow, hit enter. Have your xp cd handy.
2 - Repair install:
Repair install:

Boot from the XP cd, and when prompted hit enter to begin setup. Press F8 to
accept the license agreement. It will then search and find your existing XP
install. Select it, and choose R for repair. Back up any important data
files in case something goes wrong.

Note: you will have to re-install updates from windows update.

3 - format and reinstall xp.

If you have to use step three, this will at least ensure your daughter has a
clean, fresh, and properly working machine for school.

 

[PA Bear]

Doublecheck that you've taken care of everything in this <canned> post,
Stell:

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

After enabling 'Show Hidden Files'* and rebooting into Safe Mode**, run
these tools in the following order with nothing else running in background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow all Removal steps.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then Disk Cleanup > More options > Delete all but the most
recent Restore Point.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

* http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339


** http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Are You Ready for WinXP SP2?
http://www.microsoft.com/athome/security/protect/default.aspx

WinXP SP2 Release Notes
http://support.microsoft.com/default.aspx?scid=kb;en-us;835935

AumHa Forums
http://forum.aumha.org