Big OOOPS with WinXP

OK, well not realy OK.

I run an XP on my PC. It's all been going fine untill yesterday evening.

As I think some one managed to dig their way into my PC, not sure how though. At the moment after updating my antivirus software (Avast) and runing AdAware in safe mode, I managed to get rid of the most of the crap on my PC.

the problem is thogh, that something is still blocking autoupdates from switching back on, and I do get an odd window pop up offering me to download an antivirus software.

Any ideas on what might it be and how to get rid of it?

Try Malware Bytes:

http://www.malwarebytes.org/

Sounds like it might be antivirus 2009. I have been seeing that a lot lately. Then run Spybot Search and Destroy, to catch any stragglers.

Quote:

---

antivirus 2009.

---

Doesn't this thing use CreateProcess and the WriteProcessMemory API to force another process to keep itself running? Normal applications SHOULD NOT be able to call this stuff.

When it's all said and done... you will want to have a good look at your policy editor.

I would suggest that maybe you grab your important doc's and just format and do a clean re-install.

you might be able to get rid of most of the crap, but you will never know if there is still something hiding in the background.

Thank you all for your replyes.

Real nice one by Westin, realy helped. I also ran it along side of AdAware in safe mode :)

t34b4g5, your option would be fine if I only run a system for games, but it's also a dev system and I can't have it down for more then 12 hours at any one time. To fully restore all the right settings would take me a few days making my customers a bit pissed, and may be getting such a nice person as myself killed in the process :(
I'm sure you wouldn't wish that to happen ;)

Quote:

---

Originally Posted by nightcat

Thank you all for your replyes.

Real nice one by Westin, realy helped. I also ran it along side of AdAware in safe mode :)

t34b4g5, your option would be fine if I only run a system for games, but it's also a dev system and I can't have it down for more then 12 hours at any one time. To fully restore all the right settings would take me a few days making my customers a bit pissed, and may be getting such a nice person as myself killed in the process :(
I'm sure you wouldn't wish that to happen ;)

---

If it is truly a Dev system then why on earth are you playing with it like it's a normal everyday system.

You must of been download warez for something for it to get pwned/rooted ...

i've never let a dev setup touch the interwebs and i sure as hell don't install any other software then the stuff that is required.

You basically want a quick fix but at the end of the day how are you going to say that it's secure and there isn't some person stealing customer stuff straight off the system..

just take an image of the dev system, throw that onto a spare machine, use the spare machine while you format and re-install the actual dev machine and you can always import settings over to and that way if it takes 12hours you still have the pwned machine to use..

then once it's back up and running don't download anything un-needed onto the machine and make sure it's fully patched..

cheers
t34b4g5..:)