unable to run programs

[Bill Forss]

I have windows xp pro. on a laptop, norton antivirus reports threat of
trojan spamdes!inf located in windows\system32\drivers\ndis.sys.
norton av is not able to delete or quarantine. I also find that I can't
run programs as the file extensions have been changed to .lnk How can
I fix this so proper extensions (ie:exe/com) are attached to the renamed
files. safe mode boots then shows no icon and start menu button is gone.
just the words safemode is at each corner of the screen.

 

[nass]

I have windows xp pro. on a laptop, norton antivirus reports threat of
trojan spamdes!inf located in windows\system32\drivers\ndis.sys.
norton av is not able to delete or quarantine. I also find that I can't
run programs as the file extensions have been changed to .lnk How can
I fix this so proper extensions (ie:exe/com) are attached to the renamed
files. safe mode boots then shows no icon and start menu button is gone.
just the words safemode is at each corner of the screen.

Trojan.Spamdes!inf
http://www.symantec.com/security_response/writeup.jsp?docid=2007-062109-3723-99

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx


Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

Lots of tools to download and disinfect your machine (offline scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/

After the scan run disk cleanup on your drive.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
http://www.merijn.org/index.php
When all else fails, HijackThis v2.0.2
(http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis) is
the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass

 

[Bill Forss]

:
-

I have windows xp pro. on a laptop, norton antivirus reports threat
of
trojan spamdes!inf located in windows\system32\drivers\ndis.sys.
norton av is not able to delete or quarantine. I also find that I
can't
run programs as the file extensions have been changed to .lnk How
can
I fix this so proper extensions (ie:exe/com) are attached to the
renamed
files. safe mode boots then shows no icon and start menu button is
gone.
just the words safemode is at each corner of the screen.
--
Bill Forss-

Trojan.Spamdes!inf
http://tinyurl.com/yra99b

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete
cookies
by doing this:
Click Start Control Panel Double click Network and Internet
Connections Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing
Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all
non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from he
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://tinyurl.com/yb6d45


Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from he
http://www.avast.com/eng/avast-virus-cleaner.html

Lots of tools to download and disinfect your machine (offline
scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/

After the scan run disk cleanup on your drive.

2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
http://www.merijn.org/index.php
When all else fails, HijackThis v2.0.2
(http://tinyurl.com/33qwyx) is
the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware.
Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass