Startup & Services

[Guest]

Wife's computer quite suddenly started running VERY slowly at startup. I
believe I have only three issues as of yet.

1) Have not run Spybot or AdAware yet, but wondering how to remove
delete items from the Startup or Services tab in msconfig.

2) Additionally, Panda... found a virus but Norton did not; just
wondering, do Spybot & AdAware and other virus detection software titles
identify AND remove the suspicious files? She is running XP with SP2.

3) Lastly, Is there something I should be looking for in the processes
tab in the Task Manager? And if I find anything in any of these places, how
do I remove them.

My wife and I thank everyone in advance for any and all help.

 

[Mike Hall \(MS-MVP\)]

Wollam

Just a few notes first.. your wife's computer worked perfectly well with all
of the processes and start-up items running at one time, so it is unlikely
to be any now unless spyware and malware have added some..

Even if you could identify these processes, removing them from start-up will
only invoke error messages which your wife will find every bit as annoying,
trust me..

SpyBot and Adaware are NOT virus detection programs, and you should not be
running two different anti-virus programs at the same time (Panda and
Norton)..

Your computer must also be fully updated.. set it for 'automatic updates'

OK.. so how to remove the offending stuff?..

First step is to run a one shot virus remover.. I have found that McAfee
Stinger works for people.. download and run it..

http://vil.nai.com/vil/stinger/

You will also need to download Spyware removal software.. Spybot and Adaware
are available at these websites.. both are free.. download and run them..
don't forget to check for updates after you have started them..

Adaware SE - http://www.lavasoftusa.com/software/adaware/
SpyBot S&D - http://www.safer-networking.org/


Spybot has the ability to immunize a system, but there is better for this
function, so download and run Spyware Blaster too.. again, check for
updates..

SpywareBlaster - http://www.javacoolsoftware.com/spywareblaster.html

Two more excellent programs..

Ewido Suite - http://www.ewido.net/en/ ..

A trial working version is available, and they also allow for an online
scan..

You might also want to try this from Nick Skreptos.. Again, a trial version
is available..

http://www.superadblocker.com/

...and he maintains that it will remove Winfixer 2005 and others.. That can't
be a bad thing..

CWShredder will eliminate CoolWebSearch and variants.. there is a free
download here..

CWShredder.. http://www.intermute.com/spysubtract/cwshredder_download.html

For other tools in the fight against spyware, visit this website and
bookmark it..

http://www.pchell.com

You must also run a firewall and anti-virus program.. here are some links
for you..

http://www.zonealarm.com .. http://www.avast.com .. http://www.grisoft.com..

Special notes on SPYAXE (courtesy of bleepingcomputer.com)

Tools Needed for this fix: smitRem.exe

Note: These instructions are a paired down version of the Smitfraud Removal
Instructions. If you feel that you only have the SpyAxe infection, then you
should proceed with these steps. Otherwise, you may want to use the longer
complete Smitfraud Removal Instructions, which will remove SpyAxe as well as
other infections at the same time.

Removal Instructions:

Print out these instructions as we will need to shutdown every window that
is open later in the fix.

Download smitRem.exe and save the file to your desktop. Double click on
smitRem.exe and then click on Start. When it is done, click on the OK
button. You should now have a folder called smitRem on your desktop.

Next, please reboot your computer in SafeMode by doing the following:

Restart your computer

After hearing your computer beep once during startup, but before the Windows
icon appears, press F8.

Instead of Windows loading as normal, a menu should appear. Select the first
option, to run Windows in Safe Mode. When your computer has started in safe
mode and you see the desktop, close all open Windows.

Open the smitRem folder on your desktop and double click the RunThis.bat
file to start the tool.

Follow the prompts on screen and wait for the tool to complete and disk
cleanup to finish.

When the tool is finished, it will will create a log named smitfiles.txt in
the root of your drive, eg; Local Disk C: or the partition where your
operating system is installed. Examining that log should show that the
infection was cleaned.

Reboot your computer back to normal mode.

Pasted from <http://www.bleepingcomputer.com/forums/topic36868.html>

Please return to this thread and provide feedback.. it is the only way that
helpers here can determine how effective the advice given has been..

 

[Gerry Cornell]

Wollam

Please check Event Viewer for Warning / Error Reports in
the System and Application logs for the boot and post copies.

You can access Event Viewer by selecting Start, Administrative
Tools, and Event Viewer. When researching the meaning of the
error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&sd=tech

Part of the Description of the error will include a link, which you
should double click for further information. You can copy using
copy and paste. Often the link will, however, say there is no
further information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and
double click on the error you want to copy. In the window, which
appears is a button resembling two pages. Double click the
button and close Event Viewer. Now start your message (email)
and do a paste into the body of the message. This will paste the
info from the Event Viewer Error Report complete with links
into the message. Make sure this is the first paste after exiting
from Event Viewer.

Are there any yellow question marks in Device Manager? Right
click on the My Computer icon on your Desktop and select
Properties. Hardware, Device Manager. If yes what is the
Device Error code?


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Thanks for everyone's help. Stinger, Spybot and Adaware combined seems to
have done the trick so I stopped there, for now.