I can't thank you enough, but I still see objects in the PC admin security log. This is just the first one, there are 37 of them and they all point to the blaster worm. It makes me nervous.
Here it is, "IPSec policy agent changed: %1 PolicySource: %2 %3
I can't thank you enough, but I still see objects in the PC admin security log. This is just the first one, there are 37 of them and they all point to the blaster worm. It makes me nervous.
Here it is, "IPSec policy agent changed: %1 PolicySource: %2 %3
Can you clear the log and see if anything comes back? I'm thinking they are old warnings.
Can't clear only the warnings, all audits will clear. My lap top seems to run good, just nervous after finding a Ghost Key Logger, and a stealth spy program file in the windows\prefetch\ntv location, plus all the other stuff found.
One change in my PC's reboot, I am given a option of Windows Recovery Console or XP. Is this part of all the updates?
Can't clear only the warnings, all audits will clear. My lap top seems to run good, just nervous after finding a Ghost Key Logger, and a stealth spy program file in the windows\prefetch\ntv location, plus all the other stuff found.
One change in my PC's reboot, I am given a option of Windows Recovery Console or XP. Is this part of all the updates?
You can cleanout the windows\prefetch folder. Don't delete the prefetch folder, just the files.
One change in my PC's reboot, I am given a option of Windows Recovery Console or XP. Is this part of all the updates?
No. Once you select XP and boot, the next time you boot you shouldn't get that. If you do, do this;
You can use windows sfc (system file checker) You'd need your XP CD to make this work.
Click Start> Run> type sfc /scannow Note the space.
That sscan took a while, but came up empty. I tried X-Block and found "SpyAgent.ak" once more. When I clean the registry two invalid active-x CLSIDs keep showing up as before, whith a long string of numbers after them. On the reboot there is no change, still get the Recovery Console Option.
That sscan took a while, but came up empty. I tried X-Block and found "SpyAgent.ak" once more. When I clean the registry two invalid active-x CLSIDs keep showing up as before, whith a long string of numbers after them. On the reboot there is no change, still get the Recovery Console Option.
Where does it show SpyAgent.ak is at?
The 2 CLSIDs, have you tried removing them?
The two CLSIDs were protected so no delete. I was able to change a setting where no one could have access to them, it showed all users. They don't show up in the registry clean anymore, but I still get the Recovery Option on start-up.
I found the start-up file that would let me edit it. I deleted the last line with the Recovery Console in it and the PC starts up just fine.
Now I get a ymp.exe file that won't clear the registry but comes up red, and the first one.
Had enough for today, just wanted you to know this PC is now faster than it has been in a long time. Zips from one page to another.
Going to check download speed tomorrow.
I say again thank you. Just wanted to let you know I had the same worm and spyware on my desk top so I ran the same scans. I got the same results as I went through the push ups except a few. When I got done with the first part, cs.exe showed up. I couldn't remove it so I dissabled it, then SpyAgent.ak showed up. Again X-Cleaner found it and removed it. My son uses it the most and it had over 400 items in the registry, I couldn't believe it. Runs good now. I would like to post a scan, do I post it along with this thread, or start a new one.
Hi, I didn't like the way my PC was acting, so I did the complete re-install and all updates again except I didn't upgrade to IE-7 as that's when I got more errors before.
This time I ran X-Cleaner first after reaching out of the box state. It found "WhenU-UControl" again and I removed it. This time I wrote down where it was.
Installed Norton and updated, found nothing.
Installed Advanced System Optimizer and found "GhostKeyLogger", then I removed it.
Updated windows but not with IE-7 this time. Do it later.
Ran all the other scans and found nothing.
Ran X-Cleaner again and found "SpyAgent.ak" and removed it. I have the locations of all these if you need them. Something tells me there's more waiting on me to find. Can you look at the log again and tell me what you think? I'm going to test my PC out now and wait untill you have time.
It's running somewhat slow again.
Thanks
Here's the HJT log.
Logfile of HijackThis v1.99.1
Scan saved at 8:56:23 AM, on 4/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
