[miss_hamilton]

And thats just the beginning..

about an hour ago i got W32.spybot.worm. And tried to get rid of it. I followed symantec instructions closely, and now i have no taskbars, and my CPU is running at 100%. It's an svchost.exe that is sucking all my power. And when i stop it, my comp shuts down.

I dont know if it helps at all but this is what i have running..

iexplore.exe
MSGSYS.EXE
wdfmgr.exe
svchost.exe
rtvscan.exe
defwatch.exe
gcasServ.exe
vptray.exe
LEXPPS.EXE
spoolsv.exe
LEXBCED.EXE
explorer.exe
svchost.exe
"
"
"
"
alg.exe
lsass.exe
services.exe
winlogon.exe
csrss.exe
system
system idle process

clearly i have no idea what i'm doing.

[Advertisements]

Please go to the malware forum in my signature and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[gerryf]

Please go to the malware forum in my signature and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[kool808]

Hello and welcome to Geeks to Go! I'm kool808

Please read THIS. Then post the HijackThis Log result at Malware Removal Forum.

[Retired Tech]

If you press ctrl + alt + delete keys together, do you get task manager, if so, press file, new task, type explorer.exe then press OK

Try here

http://support.micro...kb;en-us;318027

After you perform an in-place upgrade or repair installation, you must reinstall all updates to Windows. To reinstall Windows updates, visit the following Microsoft Web site:


http://windowsupdate.microsoft.com


However, this part

Perform an in-place repair of Windows XP. Start the installation of Windows XP, but select the option to repair the existing installation. This will replace all of the Windows files, while leaving the installed programs and data intact.

seems to conflict with this part

You may lose data or program settings after reinstalling, repairing, or upgrading Windows XP

[miss_hamilton]

firstly thanks peoples.. but so far, not so good.

so i went to the malware forum. And did the cleanup thing. and restarted and all that.

My CPU is still running at 100%. And now, my windows apperance has changed to the classic skin. I cant click on links. And i cant copy and paste them into address bars. so i need the full addresses to any links, so i can type them in.

BUT my taskbar is there now, cept its like 'atuo-hide the taskbar' but i cant drag it up.. does this make sense?

also I dont know how to do a hijackthis log. :s

[Retired Tech]

Try here

http://www.tomcoyote...t/#introduction

Save the log and post it in the malware section before doing anything else

http://www.geekstogo..._Log-t2852.html

Edited by Keith, 04 June 2005 - 06:56 AM.

[miss_hamilton]

hello. I'm jenn. my brother started this thread last night after he f**cked with my comp. And now he wants me to fix it..

He's told me that he got W32.spybot.worm last night over msn then went to symantec.com and tried to get rid of it. I dont know exactly what he did then, but for some reason he deleted HKEY_CURRENT_USER\Software\Microsoft\OLE for the registry editor. Then restarted the computer and then the taskbar wouldnt (and still wont) display properly and my XP skin isnt working (its set to classic skin and cant be changed) also the CPU is running at 100% (whish suggests to me that there is a malware *shrugs*) then he came here and went to 'you must read this before before posting a hijackthis log' did a cleanup then posted a hijackthis log.

Since then, i've read the 'you must go here before..' and done -
a cleanup,
a ad-adware scan,
a CWShredder thing,
a spybot - search and destroy scan,
a ediwo security scan (which i made clay watch all the way through.),
restarted and nothing had changed so i've done a new hijackthis log..

so thats where we are up too.

I figured i have to restore the registry, but there are no restore points (dont know why, i know there was before) also i dont have a startup disk.. basically i just wanna know if it's [bleep]ed?

[Retired Tech]

Do you have the XP CD

If so, try here

http://www.theelderg..._windows_xp.htm

The recovery console or windows installation cd repair current installation will probably be the better options

Edited by Keith, 05 June 2005 - 12:16 AM.

[miss_hamilton]

nope.

I'm rooted hey?

just tell me how hard i should hit clay's car.. with a sledgehammer.

[Retired Tech]

He should go and buy you a copy (bundled with Office).

[miss_hamilton]

okay. so that should fix the taskbar and skin problem right? do you think, deleting HKEY_CUR../OLE was what caused that?

what about the 100% CPU.. should i post a hijackthis log in the malware forum?

[Retired Tech]

You should post a Hijack This log to the malware section because it may not have been removed properly or completely

The missing file would likely cause the taskbar to go, it certainly did not help.

[miss_hamilton]

okay, will do.. thanks heaps Keith.