Spyware Troubles

Bah… forgot you're running Win2K… won't have System Restore Points, ignore what I said about that. Sorry Did you have any luck with the reg file?

i did save it as ALL FILES. and still didnt work, it might of worked on your computer because you are running win xp ? <_< thanks, gotti

Hmm…

Try this one….

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETDDEC]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_NETDDEC]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETDDEC]

Save it like before. Try and merge it.

Let me know how it goes.

quick question when i double click on the icon after i save it this is what it says : Are you sure you want to add this information in C:\DOCUME~1\ONKS1\Desktop\fixme.reg to the registry then i hit YES then it says Information in C:\DOCUME~1\ONKS1\Desktop\fixme.reg has been successfully entered. in to the registry, i hit OK is this what is supposed to say ?

Yes. That is what it is supposed to say. Did you reboot and check to see if they are still there?

im gettin really mad ITS Still there ! i saved it as ALL FILES and it successfully merged it and stuff , i rebooted and it is still there

Heh…its ok. The active infection is gone. These registry entries aren't doing anything bad. Just being difficult is all.

Lets try this…

Open up regedit. Browse to [HKEY_USERS\S-1-5-21-117609710-1844823847-839522115-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit].

Look for this entry in the right hand pane:

"LastKey"="My Computer\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Enum\\Root\\LEGACY_NETDDEC"

Delete that entry.

Exit regedit.

Merge the previous reg file again.

Reboot and let me know

funny, the legacy netddec is still there but after i deleted the Value u told me, i merged, it reappeared after my reboot(the last key thing )

Just the "LastKey" entry?

[HKEY_USERS\S-1-5-21-117609710-1844823847-839522115-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]. this value reappears after i delete it, exit , merge, and reboot. upon reboot. the [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETDDEC is still there too.

This key is just to open up regedit at the last key you were in previously. Which is why it has been restoring itself. As I said.. its not anything bad. Hopefully doing the below will fix it for good. Try this…. Browse back to HKEY_USERS\S-1-5-21-117609710-1844823847-839522115-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit Instead of deleting the LastKey value… change it to, oh…. HKEY_LOCAL_MACHINE instead. Hilite HKEY_LOCAL_MACHINE in the left hand pane. Exit regedit. Merge the regfile. Reboot and let me know.

the name change for LAskt Key was succesful however, the merge failed, and the the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETDDEC is still there

Heh… ok try this…

Download and install Registrar Lite. Run the program. Copy/Paste HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETDDEC into the Address field. Click the Security Menu header. Click Take Ownership. Press the red "X" to delete the key.

Exit Registrar Lite. Reboot.

Let me know how that goes

it worked ! nice nice cool thanks kota guy

Excellent… could you post a last HJT log please? Just wanna make sure you're good to go