Re: Please Help!!

From: JudithMD (JudithMD_at_discussions.microsoft.com)
Date: 10/20/04


Date: Wed, 20 Oct 2004 16:19:05 -0700

Had some success with this routine. The Trend Sysclean package cleaned two
files with TROJ_AGENT.PC and the AdAware found registry entries corrupted by
Virtumondo (This happens all the time). The hardwin.exe process had
disappeared after the scans but re-appeared when I restarted the computer.
It is possible now to end the process so it doesn't eat up memory. (Before
it would restart immediately after being stopped. (I'm not sure whether I
was properly in safe mode - the instructions in my help file didn't seem to
correspond to reality.) Can you tell me how to restart in safe mode ?
Thanks for your help

"David H. Lipman" wrote:

> Some may be malware !
>
> 1) Download the following three items...
>
> Trend Sysclean Package
> http://www.trendmicro.com/download/dcs.asp
>
> Latest Trend signature files.
> http://www.trendmicro.com/download/pattern.asp
>
> Adaware SE (personal free version)
> http://www.lavasoftusa.com/
>
> Create a directory.
> On drive "C:\"
> (e.g., "c:\New Folder")
> or the desktop
> (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
>
> Download sysclean.com and place it in that directory.
> Dowload the signature files (pattern files) by obtaining the ZIP file.
> For example; lpt202.zip
>
> Extract the contents of the ZIP file and place the contents in the same directory as
> sysclean.com.
>
> 2) Update Adware with the latest definitions.
> 3) If you are using WinME or WinXP, disable System Restore
> http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
> 4) Reboot your PC into Safe Mode
> 5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
> platform and clean/delete any infectors/parasites found.
> (a few cycles may be needed)
> 6) Restart your PC and perform a "final" Full Scan of your platform using both the
> Trend Sysclean utility and Adaware
> 7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
> System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
> 8) Reboot your PC.
> 9) If you are using WinME or WinXP, create a new Restore point
> 10) Please report back your results
>
> Dave
>
>
>
>
>
> "JudithMD" <JudithMD@discussions.microsoft.com> wrote in message
> news:8924FDCA-2930-4155-B324-0CBC591EBEBA@microsoft.com...
> | I have the same problem, only I have 51 processes running and practically no
> | RAM left. The big pig-of-a-process is "hardwin.exe". It's not on the
> | process website or google. Anyone ever heard of it?
> |
> | "BrookeNZ" wrote:
> |
> | > When I start Windows, I have 32 processes running on my computer! My computer
> | > is working ridiculously slowly but how do I figure out which processes I can
> | > end or remove?????
>
>
>



Relevant Pages

  • Re: Need more help to remove nasty REQ.DAT from my WinXp Pro
    ... > Dowload the Trend Pattern File by obtaining the ZIP file. ... > 2) Update Adaware with the latest definitions. ... > 5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your ... >> System Restore On & Off, and also in Normal and in Safe Mode. ...
    (microsoft.public.windowsxp.general)
  • RE: Need more help to remove nasty REQ.DAT from my WinXp Pro
    ... Update Adaware with the latest definitions. ... Reboot your PC into Safe Mode ... Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your ...
    (microsoft.public.windowsxp.general)
  • Re: Virus that causes a lot of traffic ?
    ... All viruses are malware but not all malware are viruses. ... Adaware looks for non-viral malware ... Trend Sysclean is a broad-spectrum; ... |>| to the server besides SQL Slammer, ...
    (microsoft.public.win2000.general)
  • Re: Nasty Virus
    ... Have Adaware remove the parasites in Safe Mode and delete the hosts file. ... | Restore and re-apply any ...
    (microsoft.public.security.virus)
  • Re: Control Panel wont open
    ... I used Adaware 6, Spybot S&D, and SwatIt. ... I also have Norton Internet Security which is along with the previous ... I did as you suggested by running them in Safe mode along with Normal mode ... > download it and install it. ...
    (microsoft.public.windows.file_system)