[Crustyoldbloke]

"PendingFileRename Operations Registry Has been Removed by External Process!" is normally a good sign. As for running second bat, you merely pre-empted what I was going to ask you to do, and 32 bad guys got zapped as a result. Which means.............................

Congratulations! your new log is clean. Just a little bit more to do to prevent further infection.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
I recommend going to the following link and update as recommended by Microsoft. This adds more security and extra features including a pop-up blocker for Internet Explorer. Microsoft Update

Now that everything is fixed, I suggest that you consider getting these programmes to help keep the computer clean:

SPYWARE BLASTER - Blocks bad ActiveX items from installing on your computer.
AD-AWARE PERSONAL – A fine free malware detector and removal programme
SPYBOT S&D – Excellent free spyware detector and removal programme
GOOGLE TOOLBAR - Blocks many unwanted pop-ups in Internet Explorer.
FIREFOX - Safer alternative to the Internet Explorer web browser.
AVG ANTIVIRUS - Free antivirus programme if you currently are not using one.
ZONEALARM - Free firewall programme if you currently are not using one (Windows XP has a built-in firewall).

Remember to update these frequently.

Please note that whilst there is nothing wrong in having more than one antispyware programmes for “on demand” scanning, having two or more antivirus systems is not recommended as they may well interfere with each other.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep your Windows, antispyware and antivirus updated.

Happy safe surfing!

[Advertisements]

Thanks, Doc. You were great. I've made a donation via PayPal - weird amount, given currency exchange rates, but I hope you find it fractionally commensurate with your effort. I'm almost going to miss my morning and evening fix-it assignments.

One question: I know I'm not supposed to have more than one virus scanner installed - I assume that Trojan Hunter doesn't count as one?

-Benjamin

[wapshot1]

Thanks, Doc. You were great. I've made a donation via PayPal - weird amount, given currency exchange rates, but I hope you find it fractionally commensurate with your effort. I'm almost going to miss my morning and evening fix-it assignments.

One question: I know I'm not supposed to have more than one virus scanner installed - I assume that Trojan Hunter doesn't count as one?

-Benjamin

[Crustyoldbloke]

Thank you for your generosity Benjamin.

I'll be totally honest and say that I am not a fan of Trojan Hunter. I see it time and time again together with loads of Trojans. Perhaps it is a very passive programme that hunts Trojans and takes a photo of them rather than killing them.

Personally, I like Microsoft AntiSpyware even though it is a beta programme and I use it as my real-time programme. I think that Ewido is awesome as is Ad-Aware and Spybot; I use all three for on demand scanning.

I think that we can probably dismiss Trojan Hunter as a serious contender for the premium real-time slot, but since it scans (I assume it does) it must be counted as your one and only real time scanner.

I'll let my brain go back to its normal state of dormancy

[wapshot1]

Okay, I'll remove Trojan Hunter. *That* came through loud and clear. I think I like Ewido -- but actually, I just got Trend Micro's PC-Cillin as my virus scanner; I was going to use Ad-Aware and other spyware killers for that side of things. I just wanted to make sure that PC-Cillian and Trojan Hunter didn't conflict. Sounds like they wouldn't, but it's a moot point.

[Crustyoldbloke]

I'm sure you will make the right decision. I wish you well.

I'll leave this thread open for a few days in case of misfortune.

[wapshot1]

Thanks for keeping it open. I do indeed have a problem. Before I downloaded the various programs you recommneded and moved back into my computer, I thought I'd scan it first to be sure there were no viruses. I used Ewido -- worked great, and caught some uglies -- and then Trend Micro's online spyware/virus scanner. I've used their online virus scanner before, and it's always worked great. Never used the combined one, but I'm sure it also functions well. However, I let it run while I was at work; when I returned, I found that the browser had shut down, the internet connection (wireless) was closed/off, and (most important) there was an error message that said that Windows had recovered from a serious system error. That alarmed me - what do you recommend, and should I open a new thread elsewhere?

I'd really like to install my new virus scanner, but I don't want to until I'm pretty sure the system's clean.

-Benjamin

[wapshot1]

I went ahead and installed my new virus scanner and (a) even though it said it was installed, it was not to be found on the Start Menu or Add/Remove New Programs; and (b) when I tried to remove the folder from the C:\Program Files, it said I didn't have the right to access it, and to make sure the disk/folder was not full/write-protected. I have the same problem with two HJT folders, which I also cannot remove. Is this something simple, or this a bigger problem I should be following up somewhere else?

[Crustyoldbloke]

Oh dear! That sounds a bit like OS or software issues. It doesn't sound malware related to me.

I am going to recommend that you post a thread in the Operating Systems, WinXP forum first of all. See what the experts have to say about it. Given that you have had other problems, I think it is more likely to be OS than other software.

[wapshot1]

That's what I figured. Thank you so much again for your help.

[Crustyoldbloke]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.