extremely bad thing

[mark]

I thought i had a trogan running and went in to disable it
(was showing 'winlogon' in process tools i never seen
before) and changed all winlogon.exe to "deny" permissions
in attempt to stop it in safe mode. Now pc constantly
reboots, only gets as far as xp home edition load screen
then reboot - I can't get into safe mode now - when i try
safe mode from f8 i get as far as system32\mup.sys. I can
only get recovery console now. Any way to default the
winlogin.exe permissions in the recovery console?
or am i going in the wrong direction?
thanks

 

[Guest]

from the f8, can you choose to restore your system to an earlier point?

 

[mark]

Unfortunately the MS restore from the f8 option didn't
work (or had no seen impact). i had never backed up so i
didn't know what a safe restore point was (that'll
change). I finally did a restore to start (option on hp
pc) and started from scratch - just like coming out of the
box - but still have something there that shouldn't be -
problems with adware? - hampered re-install of symantec
products. at least i can bootup and login and my display
isn't upsidedown(the start of it all). continuing to nail
this down and correct.

 

[MAP]

-----Original Message-----
I thought i had a trogan running and went in to disable it
(was showing 'winlogon' in process tools i never seen
before) and changed all winlogon.exe to "deny" permissions
in attempt to stop it in safe mode. Now pc constantly
reboots, only gets as far as xp home edition load screen
then reboot - I can't get into safe mode now - when i try
safe mode from f8 i get as far as system32\mup.sys. I can
only get recovery console now. Any way to default the
winlogin.exe permissions in the recovery console?
or am i going in the wrong direction?
thanks

.http://pestpatrol.com/pestinfo/w/winlogonexe.asp

This my help with your symantic troubles

How to uninstall Norton AntiVirus by using the
Rnav2003.exe removal utility
http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001092
114452606

 

[mark]

Thanks,
according to symantec i have the w32.hllw.polybot worm.