Search:

pskelley,

Thanks for your help but I am not going to carry on trying to remove the problem.

I am currently in the process of doing a low level format of the h/d using the manufacturers utility...

In this thread:
http://forums.spybot.info/showthread.php?t=19261

PSKelley is helping me to try remove some malware and suggested I post in this section because my problem seems new.

Spybot...

Update:

I thought I had removed AVG via Add Remove Programs in Safe Mode. I just noticed that it was still in my start programs so uninstalled it from there.

After uninstalling AVG on my next...

I can't do the prevex scan because I can't log-in in normal mode.

I can only log-in in safe mode.

Is there anything I can do in Safe Mode that might enable me to log-in in normal mode or what...

I mentioned in my previous post that I have uninstalled AVG while in safe mode but I still couldn't log in, in normal mode.

Just now in safe mode I ran hijackthis and noticed 5 references to AVG...

I did 2 things, deleted the vrt2.tmp file, installed AVG then rebooted.

While in safe mode I ran spybot again. It detected and removed Win32.delf.uc as usual. I then removed AVG via add remove...

I can log in, in Safe Mode

c:\home.htm is OK I use it as my browser home page, it is just full of my links.

I located vrt2.tmp in the windows\temp directory and deleted it. I did the same earlier but think it was vrt5.tmp....

I exported my services list in case there might be something else that caught anyone's eye:


Name Description Status Startup Type Log On As
Alerter Notifies selected users and computers of...

Just rebooted and vrt2.tmp is in the task list and trying get on the net.

I stopped the service systs.exe is not there.

This is the hijackthis log:Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:12:10, on 20/10/2007
Platform: Windows 2000 SP4 (WinNT...

pskelley,

I'm sorry about not reading that thread in full. I only scanned the opening post assuming it was just a warning and missed the instructions below. Perhaps you need a big red notice to...

In the hope that someone will be going to help from reading other threads it seems the first thing to do is rename hijackthis to bettingmad and post a new log file.

I have also disabled teatimer....

I'm running Windows 2000 and yesterday morning zonealarm warned me that systs.exe was trying to access the internet.

Adaware detected win32.backdoor.SDbot and removed it which deleted systs.exe...