Unknown Program in Startup

An unknown program has been put into the startup in msconfig.
The path is:
C:\Users\%username%\AppData\Roaming\twext.exe
The name is 'userinit'. I have since deleted it from the Run key in the
registry and deleted the file, but was wondering if anyone has heard of
this?

Thanks,
James

 

"JamesJ" <jjy@darwin_roadrunner.com> wrote in message
news:OPxsII57JHA.5828@TK2MSFTNGP04.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> An unknown program has been put into the startup in msconfig.
> The path is:
> C:Users%username%AppDataRoamingtwext.exe
> The name is 'userinit'. I have since deleted it from the Run key in the
> registry and deleted the file, but was wondering if anyone has heard of
> this?
>
> Thanks,
> James<!--colorc--><!--/colorc-->

<sigh>
Google is YOUR friend.......

 

Yes I know. I get lazy sometimes. Usually I do search the web
but I put more credence in the answers I get here.

Thanks much for the link.
James

"Gordon" <gordonbparker@yahoo.com> wrote in message
news:OylfEK57JHA.2656@TK2MSFTNGP05.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> "JamesJ" <jjy@darwin_roadrunner.com> wrote in message
> news:OPxsII57JHA.5828@TK2MSFTNGP04.phx.gbl...<!--coloro:green--><span style="color:green <!--/coloro-->
>> An unknown program has been put into the startup in msconfig.
>> The path is:
>> C:Users%username%AppDataRoamingtwext.exe
>> The name is 'userinit'. I have since deleted it from the Run key in the
>> registry and deleted the file, but was wondering if anyone has heard of
>> this?
>>
>> Thanks,
>> James<!--colorc--><!--/colorc-->
>
> <sigh>
> Google is YOUR friend.......
> <!--colorc--><!--/colorc-->

 

I'm currently using AVG Free and it didn't seem to find anything earlier
today. I
didn't discover it unilt after I scanned.
Could this show up in Services and Processes? An if so will it be named the
same as in
the startup?


Thanks,
James

"JEWboy" <Nojunkmetalblade@nojunkprodigy.net> wrote in message
news:OMu9j657JHA.5476@TK2MSFTNGP05.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> find that file in filesystem and delete ASAP.
> Then keep checking if it reappears in any form, for the next entire week,
> everytime you boot, check if it resurfaces as a file or Registry entry, or
> in MSconfig, or in Services.
> Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
> processes from all users" is checked.
> Check all processes for anything strange including this filename or its
> variations, if you see - kill the process tree.
>
> Run Antivirus immediately, then run AntiSPyware
> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
> in the world.
> One is NOt enough because they complement each other, make sure you set
> their settings to scan stealth items, rootkits, startup processes, etc,
> use your brain.
> I can't be at your computer to see what you doing wrong.
>
> Now listen.
> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
> antispyware tools AGAIN.
> AFter all done kjeep checking your system for any trace of this evil
> thing.
>
> I know sounds like you need to spend a life doing this crap, well it
> depends what you got on the computer. I design circuits for Military & US
> Government so I'd go at great length to cleanup my system, backup
> datafiles, and heck I will (but never did) even reinstall OS if I can't
> get rid of infection. <!--colorc--><!--/colorc-->

 

JEWboy wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> find that file in filesystem and delete ASAP.
> Then keep checking if it reappears in any form, for the next entire
> week, everytime you boot, check if it resurfaces as a file or Registry
> entry, or in MSconfig, or in Services.
> Then start TASK MANAGER, goto Processes, make sure checkbox next to
> "show processes from all users" is checked.
> Check all processes for anything strange including this filename or its
> variations, if you see - kill the process tree.
>
> Run Antivirus immediately, then run AntiSPyware
> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
> in the world.
> One is NOt enough because they complement each other, make sure you set
> their settings to scan stealth items, rootkits, startup processes, etc,
> use your brain.
> I can't be at your computer to see what you doing wrong.
>
> Now listen.
> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
> antispyware tools AGAIN.
> AFter all done kjeep checking your system for any trace of this evil thing.
>
> I know sounds like you need to spend a life doing this crap, well it
> depends what you got on the computer. I design circuits for Military &
> US Government so I'd go at great length to cleanup my system, backup
> datafiles, and heck I will (but never did) even reinstall OS if I can't
> get rid of infection.<!--colorc--><!--/colorc-->


You are delusional. You work the mop and bucket at Taco-Bell. You've
been doing it for years, trying to get promoted to work the fryer. Your
dream is working the counter.

Think outside the BUN.

 

find that file in filesystem and delete ASAP.
Then keep checking if it reappears in any form, for the next entire week,
everytime you boot, check if it resurfaces as a file or Registry entry, or
in MSconfig, or in Services.
Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
processes from all users" is checked.
Check all processes for anything strange including this filename or its
variations, if you see - kill the process tree.

Run Antivirus immediately, then run AntiSPyware
My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools in
the world.
One is NOt enough because they complement each other, make sure you set
their settings to scan stealth items, rootkits, startup processes, etc, use
your brain.
I can't be at your computer to see what you doing wrong.

Now listen.
Shutdown, reboot into Windows SAFE mode, run those 2 antivirus & antispyware
tools AGAIN.
AFter all done kjeep checking your system for any trace of this evil thing.

I know sounds like you need to spend a life doing this crap, well it depends
what you got on the computer. I design circuits for Military & US
Government so I'd go at great length to cleanup my system, backup datafiles,
and heck I will (but never did) even reinstall OS if I can't get rid of
infection.

 

It depends on virus/spyware complexity, some are written as joke programs
and easy to detect, some continually vary their name so it takes an analytic
& highly technical mind to detect.

I killed a serious infection by using sheer reasoning, w/o ANY Antivirus s
everal years ago on coworkers machine. It took me many hours, though, he
had no AV and virus would not allow any Antivirus installation, shutdown his
Firewall and I was forced to unplug Network cable.
I could not load Antivirus thru USB media either, but I did kill infection
by manually examining the LATEST added files to Windows\system32, Windows
root, Temporary files, user\temp files, etc.
No tmany people can do this, but it's just my profession.

You know if my toilet breaks down, I am forced to call for a plumber, I am
clueless. But if computer breaks down, I do it by myself... so to answer
your question:

It MAY show up in services, running processes, startup items, etc as such,
or it may disguise with a variable name, or most commonly:
it copies a legitimate Windows filename so you can never recognize. Unless
you're like mhow spend s alife on computers.... I simply checked "date
modified" and separate a list of files changed on the day thi sman reported
infection, then backed down to a few days earlier just to make sure I catch
all bastards.

Then I checked filesize, and I found one file which was named as an
idientical legitimate Windows DLL library, BUT its size was lsightly
larger!!


Ah-ha I thought to myself, let's see if I replace it with a copy of
legitimate windows file. Well infection stopped, but it did screw up
Firewall forever, some TCP/IP stuff had to be reinstalled.

 

"JEWboy" <Nojunkmetalblade@nojunkprodigy.net> wrote in message
news:OMu9j657JHA.5476@TK2MSFTNGP05.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> find that file in filesystem and delete ASAP.
> Then keep checking if it reappears in any form, for the next entire week,
> everytime you boot, check if it resurfaces as a file or Registry entry, or
> in MSconfig, or in Services.
> Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
> processes from all users" is checked.
> Check all processes for anything strange including this filename or its
> variations, if you see - kill the process tree.
>
> Run Antivirus immediately, then run AntiSPyware
> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
> in the world.
> One is NOt enough because they complement each other, make sure you set
> their settings to scan stealth items, rootkits, startup processes, etc,
> use your brain.
> I can't be at your computer to see what you doing wrong.
>
> Now listen.
> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
> antispyware tools AGAIN.
> AFter all done kjeep checking your system for any trace of this evil
> thing.
>
> I know sounds like you need to spend a life doing this crap, well it
> depends what you got on the computer. I design circuits for Military & US
> Government so I'd go at great length to cleanup my system, backup
> datafiles, and heck I will (but never did) even reinstall OS if I can't
> get rid of infection.<!--colorc--><!--/colorc-->

So how come under your alias Mark L you said only a couple of weeks ago that
the only reason you just started using vista is that your HP XP system got
trashed by nasties and you did not have a backup and had to rush out and buy
Vista? Can you even lie straight in bed?

Camper

 

Do you all know this person?

"Spanky de Monkey" <spanky@deMonkey.gov> wrote in message
news:rSe_l.65$cl4.47@flpi150.ffdc.sbc.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> JEWboy wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
>> find that file in filesystem and delete ASAP.
>> Then keep checking if it reappears in any form, for the next entire week,
>> everytime you boot, check if it resurfaces as a file or Registry entry,
>> or in MSconfig, or in Services.
>> Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
>> processes from all users" is checked.
>> Check all processes for anything strange including this filename or its
>> variations, if you see - kill the process tree.
>>
>> Run Antivirus immediately, then run AntiSPyware
>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
>> in the world.
>> One is NOt enough because they complement each other, make sure you set
>> their settings to scan stealth items, rootkits, startup processes, etc,
>> use your brain.
>> I can't be at your computer to see what you doing wrong.
>>
>> Now listen.
>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>> antispyware tools AGAIN.
>> AFter all done kjeep checking your system for any trace of this evil
>> thing.
>>
>> I know sounds like you need to spend a life doing this crap, well it
>> depends what you got on the computer. I design circuits for Military &
>> US Government so I'd go at great length to cleanup my system, backup
>> datafiles, and heck I will (but never did) even reinstall OS if I can't
>> get rid of infection.<!--colorc--><!--/colorc-->
>
>
> You are delusional. You work the mop and bucket at Taco-Bell. You've
> been doing it for years, trying to get promoted to work the fryer. Your
> dream is working the counter.
>
> Think outside the BUN. <!--colorc--><!--/colorc-->

 

JamesJ wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Do you all know this person?<!--colorc--><!--/colorc-->

Spanky, aka everyone's psychiatrist, aka Bill Yanaire, ad nauseum is a
disgusting troll. Ignore him.

Alias<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> "Spanky de Monkey" <spanky@deMonkey.gov> wrote in message
> news:rSe_l.65$cl4.47@flpi150.ffdc.sbc.com...<!--coloro:green--><span style="color:green <!--/coloro-->
>> JEWboy wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> find that file in filesystem and delete ASAP.
>>> Then keep checking if it reappears in any form, for the next entire
>>> week, everytime you boot, check if it resurfaces as a file or
>>> Registry entry, or in MSconfig, or in Services.
>>> Then start TASK MANAGER, goto Processes, make sure checkbox next to
>>> "show processes from all users" is checked.
>>> Check all processes for anything strange including this filename or
>>> its variations, if you see - kill the process tree.
>>>
>>> Run Antivirus immediately, then run AntiSPyware
>>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated
>>> tools in the world.
>>> One is NOt enough because they complement each other, make sure you
>>> set their settings to scan stealth items, rootkits, startup
>>> processes, etc, use your brain.
>>> I can't be at your computer to see what you doing wrong.
>>>
>>> Now listen.
>>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>>> antispyware tools AGAIN.
>>> AFter all done kjeep checking your system for any trace of this evil
>>> thing.
>>>
>>> I know sounds like you need to spend a life doing this crap, well it
>>> depends what you got on the computer. I design circuits for Military
>>> & US Government so I'd go at great length to cleanup my system,
>>> backup datafiles, and heck I will (but never did) even reinstall OS
>>> if I can't get rid of infection.<!--colorc--><!--/colorc-->
>>
>>
>> You are delusional. You work the mop and bucket at Taco-Bell. You've
>> been doing it for years, trying to get promoted to work the fryer.
>> Your dream is working the counter.
>>
>> Think outside the BUN. <!--colorc--><!--/colorc-->
> <!--colorc--><!--/colorc-->

 

ok.

"Alias" <iamaliasNUK3@THISgmail.com> wrote in message
news:h1dimi$kva$3@news.eternal-september.org...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> JamesJ wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
>> Do you all know this person?<!--colorc--><!--/colorc-->
>
> Spanky, aka everyone's psychiatrist, aka Bill Yanaire, ad nauseum is a
> disgusting troll. Ignore him.
>
> Alias<!--coloro:green--><span style="color:green <!--/coloro-->
>>
>> "Spanky de Monkey" <spanky@deMonkey.gov> wrote in message
>> news:rSe_l.65$cl4.47@flpi150.ffdc.sbc.com...<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> JEWboy wrote:
>>>> find that file in filesystem and delete ASAP.
>>>> Then keep checking if it reappears in any form, for the next entire
>>>> week, everytime you boot, check if it resurfaces as a file or Registry
>>>> entry, or in MSconfig, or in Services.
>>>> Then start TASK MANAGER, goto Processes, make sure checkbox next to
>>>> "show processes from all users" is checked.
>>>> Check all processes for anything strange including this filename or its
>>>> variations, if you see - kill the process tree.
>>>>
>>>> Run Antivirus immediately, then run AntiSPyware
>>>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated
>>>> tools in the world.
>>>> One is NOt enough because they complement each other, make sure you set
>>>> their settings to scan stealth items, rootkits, startup processes, etc,
>>>> use your brain.
>>>> I can't be at your computer to see what you doing wrong.
>>>>
>>>> Now listen.
>>>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>>>> antispyware tools AGAIN.
>>>> AFter all done kjeep checking your system for any trace of this evil
>>>> thing.
>>>>
>>>> I know sounds like you need to spend a life doing this crap, well it
>>>> depends what you got on the computer. I design circuits for Military &
>>>> US Government so I'd go at great length to cleanup my system, backup
>>>> datafiles, and heck I will (but never did) even reinstall OS if I can't
>>>> get rid of infection.
>>>
>>>
>>> You are delusional. You work the mop and bucket at Taco-Bell. You've
>>> been doing it for years, trying to get promoted to work the fryer. Your
>>> dream is working the counter.
>>>
>>> Think outside the BUN.<!--colorc--><!--/colorc-->
>> <!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->

 

Avoid JEWboy like the plague!!

--

Don't pick a fight with an old man.
If he is too old to fight, he'll just kill you.



"JamesJ" <jjy@darwin_roadrunner.com> wrote in message
news:ewK7QrB8JHA.1416@TK2MSFTNGP04.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Do you all know this person?
>
> "Spanky de Monkey" <spanky@deMonkey.gov> wrote in message
> news:rSe_l.65$cl4.47@flpi150.ffdc.sbc.com...<!--coloro:green--><span style="color:green <!--/coloro-->
>> JEWboy wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> find that file in filesystem and delete ASAP.
>>> Then keep checking if it reappears in any form, for the next entire
>>> week, everytime you boot, check if it resurfaces as a file or Registry
>>> entry, or in MSconfig, or in Services.
>>> Then start TASK MANAGER, goto Processes, make sure checkbox next to
>>> "show processes from all users" is checked.
>>> Check all processes for anything strange including this filename or its
>>> variations, if you see - kill the process tree.
>>>
>>> Run Antivirus immediately, then run AntiSPyware
>>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
>>> in the world.
>>> One is NOt enough because they complement each other, make sure you set
>>> their settings to scan stealth items, rootkits, startup processes, etc,
>>> use your brain.
>>> I can't be at your computer to see what you doing wrong.
>>>
>>> Now listen.
>>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>>> antispyware tools AGAIN.
>>> AFter all done kjeep checking your system for any trace of this evil
>>> thing.
>>>
>>> I know sounds like you need to spend a life doing this crap, well it
>>> depends what you got on the computer. I design circuits for Military &
>>> US Government so I'd go at great length to cleanup my system, backup
>>> datafiles, and heck I will (but never did) even reinstall OS if I can't
>>> get rid of infection.<!--colorc--><!--/colorc-->
>>
>>
>> You are delusional. You work the mop and bucket at Taco-Bell. You've
>> been doing it for years, trying to get promoted to work the fryer. Your
>> dream is working the counter.
>>
>> Think outside the BUN.<!--colorc--><!--/colorc-->
> <!--colorc--><!--/colorc-->

 

....and Alias is an Ubuntu whore.

--

Don't pick a fight with an old man.
If he is too old to fight, he'll just kill you.



"Alias" <iamaliasNUK3@THISgmail.com> wrote in message
news:h1dimi$kva$3@news.eternal-september.org...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> JamesJ wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
>> Do you all know this person?<!--colorc--><!--/colorc-->
>
> Spanky, aka everyone's psychiatrist, aka Bill Yanaire, ad nauseum is a
> disgusting troll. Ignore him.
>
> Alias<!--coloro:green--><span style="color:green <!--/coloro-->
>>
>> "Spanky de Monkey" <spanky@deMonkey.gov> wrote in message
>> news:rSe_l.65$cl4.47@flpi150.ffdc.sbc.com...<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> JEWboy wrote:
>>>> find that file in filesystem and delete ASAP.
>>>> Then keep checking if it reappears in any form, for the next entire
>>>> week, everytime you boot, check if it resurfaces as a file or Registry
>>>> entry, or in MSconfig, or in Services.
>>>> Then start TASK MANAGER, goto Processes, make sure checkbox next to
>>>> "show processes from all users" is checked.
>>>> Check all processes for anything strange including this filename or its
>>>> variations, if you see - kill the process tree.
>>>>
>>>> Run Antivirus immediately, then run AntiSPyware
>>>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated
>>>> tools in the world.
>>>> One is NOt enough because they complement each other, make sure you set
>>>> their settings to scan stealth items, rootkits, startup processes, etc,
>>>> use your brain.
>>>> I can't be at your computer to see what you doing wrong.
>>>>
>>>> Now listen.
>>>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>>>> antispyware tools AGAIN.
>>>> AFter all done kjeep checking your system for any trace of this evil
>>>> thing.
>>>>
>>>> I know sounds like you need to spend a life doing this crap, well it
>>>> depends what you got on the computer. I design circuits for Military &
>>>> US Government so I'd go at great length to cleanup my system, backup
>>>> datafiles, and heck I will (but never did) even reinstall OS if I can't
>>>> get rid of infection.
>>>
>>>
>>> You are delusional. You work the mop and bucket at Taco-Bell. You've
>>> been doing it for years, trying to get promoted to work the fryer. Your
>>> dream is working the counter.
>>>
>>> Think outside the BUN.<!--colorc--><!--/colorc-->
>> <!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->

 

noted

"Mike @gmail.com>" <rathbunger<nospam> wrote in message
news:OBx8BcC8JHA.1716@TK2MSFTNGP03.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> ...and Alias is an Ubuntu whore.
>
> --
>
> Don't pick a fight with an old man.
> If he is too old to fight, he'll just kill you.
>
>
>
> "Alias" <iamaliasNUK3@THISgmail.com> wrote in message
> news:h1dimi$kva$3@news.eternal-september.org...<!--coloro:green--><span style="color:green <!--/coloro-->
>> JamesJ wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> Do you all know this person?<!--colorc--><!--/colorc-->
>>
>> Spanky, aka everyone's psychiatrist, aka Bill Yanaire, ad nauseum is a
>> disgusting troll. Ignore him.
>>
>> Alias<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>>
>>> "Spanky de Monkey" <spanky@deMonkey.gov> wrote in message
>>> news:rSe_l.65$cl4.47@flpi150.ffdc.sbc.com...
>>>> JEWboy wrote:
>>>>> find that file in filesystem and delete ASAP.
>>>>> Then keep checking if it reappears in any form, for the next entire
>>>>> week, everytime you boot, check if it resurfaces as a file or Registry
>>>>> entry, or in MSconfig, or in Services.
>>>>> Then start TASK MANAGER, goto Processes, make sure checkbox next to
>>>>> "show processes from all users" is checked.
>>>>> Check all processes for anything strange including this filename or
>>>>> its variations, if you see - kill the process tree.
>>>>>
>>>>> Run Antivirus immediately, then run AntiSPyware
>>>>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated
>>>>> tools in the world.
>>>>> One is NOt enough because they complement each other, make sure you
>>>>> set their settings to scan stealth items, rootkits, startup processes,
>>>>> etc, use your brain.
>>>>> I can't be at your computer to see what you doing wrong.
>>>>>
>>>>> Now listen.
>>>>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>>>>> antispyware tools AGAIN.
>>>>> AFter all done kjeep checking your system for any trace of this evil
>>>>> thing.
>>>>>
>>>>> I know sounds like you need to spend a life doing this crap, well it
>>>>> depends what you got on the computer. I design circuits for Military
>>>>> & US Government so I'd go at great length to cleanup my system, backup
>>>>> datafiles, and heck I will (but never did) even reinstall OS if I
>>>>> can't get rid of infection.
>>>>
>>>>
>>>> You are delusional. You work the mop and bucket at Taco-Bell. You've
>>>> been doing it for years, trying to get promoted to work the fryer.
>>>> Your dream is working the counter.
>>>>
>>>> Think outside the BUN.
>>><!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->
> <!--colorc--><!--/colorc-->

 

"JamesJ" <jjy@darwin_roadrunner.com> wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
>ok.<!--colorc--><!--/colorc-->

"Alias" - a U.S. expatriate - is largely ignored here as well. Most
have him killfiled.

<!--coloro:blue--><span style="color:blue <!--/coloro-->
>"Alias" <iamaliasNUK3@THISgmail.com> wrote in message
>news:h1dimi$kva$3@news.eternal-september.org...<!--coloro:green--><span style="color:green <!--/coloro-->
>> JamesJ wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> Do you all know this person?<!--colorc--><!--/colorc-->
>>
>> Spanky, aka everyone's psychiatrist, aka Bill Yanaire, ad nauseum is a
>> disgusting troll. Ignore him.
>>
>> Alias<!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->

 

I see you taking a lot of flak here. I don't know why, but I follow your
posts, and they work/make sense to me. Please keep on posting answers, you
have saved more PC's than people will care to admit. Cheers

--
Spook
spook@xnets.co.za

"JEWboy" <Nojunkmetalblade@nojunkprodigy.net> wrote in message
news:%23dTH9167JHA.4116@TK2MSFTNGP04.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> It depends on virus/spyware complexity, some are written as joke programs
> and easy to detect, some continually vary their name so it takes an
> analytic & highly technical mind to detect.
>
> I killed a serious infection by using sheer reasoning, w/o ANY Antivirus s
> everal years ago on coworkers machine. It took me many hours, though, he
> had no AV and virus would not allow any Antivirus installation, shutdown
> his Firewall and I was forced to unplug Network cable.
> I could not load Antivirus thru USB media either, but I did kill infection
> by manually examining the LATEST added files to Windowssystem32, Windows
> root, Temporary files, usertemp files, etc.
> No tmany people can do this, but it's just my profession.
>
> You know if my toilet breaks down, I am forced to call for a plumber, I am
> clueless. But if computer breaks down, I do it by myself... so to answer
> your question:
>
> It MAY show up in services, running processes, startup items, etc as such,
> or it may disguise with a variable name, or most commonly:
> it copies a legitimate Windows filename so you can never recognize.
> Unless you're like mhow spend s alife on computers.... I simply checked
> "date modified" and separate a list of files changed on the day thi sman
> reported infection, then backed down to a few days earlier just to make
> sure I catch all bastards.
>
> Then I checked filesize, and I found one file which was named as an
> idientical legitimate Windows DLL library, BUT its size was lsightly
> larger!!
>
>
> Ah-ha I thought to myself, let's see if I replace it with a copy of
> legitimate windows file. Well infection stopped, but it did screw up
> Firewall forever, some TCP/IP stuff had to be reinstalled. <!--colorc--><!--/colorc-->