mr.findalot and cmd service help needed!

I see HJT is still on the Desktop: C:\Documents and Settings\Owner\Desktop\HijackThis.exe Please put it here: C:\HJT\HijackTHis.exe for safety.

You want to check all security programs, this junk will corrupt the programs. Make sure they are working right or check with technical support about how to uninstall and download them again.

HJT is clean, so I posting this information for you now:
Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

ewido is a great program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?Open&src=sec_doc_nam

Your uninstall list:
Earlier when we were uninstalling PurityScan, this is one of the programs you were looking for:
MediaTickets by OIN <<< uninstall that junk quickly

Everything else looks ok as far as malware goes. I suggest you look at the list and if you see programs you no longer need or use, uninstall them. When we are done, make sure you give the computer a good maintenance cleaning, scan disk and defragmentation.

The Desktop, icons, etc. sounds like the setting have been changed, try these first:

1) 1. Click Start, and then click Control Panel.
2. Double-click Display, click the Desktop tab, and then click Customize Desktop.
3. Select Restore Defaults

2) Right-click on the desktop
Click on the Properties item
When the Properties dialog comes up click on the Web tab
If Show Web content on my Active Desktop is checked then click on the page in the box below and click the Delete button
Uncheck the checkbox in front of Show Web content on my Active Desktop
Click the Apply button and then the Ok button

Run the computer and let me have feedback in the morning, make sure you run Spybot to see if the command.exe issue still exists, if so let me know.

Thanks
 
mr.findalot and cmd. service

Ok, I did the system restore thing, removed MediaTickets, and moved HJT to the file that you suggested. I then ran spybot after rebooting and sure enough Command Service is still there! It was the only thing found, so that is good, but still... I also fixed my icons which makes me much happier! That red made me think that bad things were happening! Let me know what you think I should do next. Thanks, Jaime
 
Thanks for the feedback, let's do this:
Please download and unzip Ren-cmdservice to your Desktop.
It will only work correctly if the folder is placed on your Desktop and extracted !!.
http://downloads.subratam.org/Lon/ren-cmdservice.zip

Open the ren-cmdservice folder by doubleclicking it and then doubleclick the
ren-cmdservice.bat file to run the program.
A text will open when it is finished, Post it please.
Then restart the PC run spybot check for and fix any problems found.

I would review all of the instrutions in the various posts to make sure you completed everything, especially the links I posted in this last post, then don't get infected anymore.

Safe surfing...tashi:) will close the topic in a day for so.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.
 
mr.findalot and cmd service

Good morning! Thanks again for all of your help...I needed it! When trying to open the unzip Ren-cmdservice I was unable. The page is not available. I do not know it's my computer or something on their end. Can you please suggest another way to download it? Thanks, Jaime
 
I apologize, I can not open that link either and will let Lonny know. Please give this tool by Marckie a try.

Please download delcmdservice
http://users.telenet.be/marcvn/tools/delcmdservice.zip
and save it to your Desktop.
Unzip the content to your Desktop (a folder named delcmdservice)
Double-click on the delcmdservice folder
Double-click on delreg.bat to launch the tool
When the tool has finished, please reboot your computer.

Thanks
 
mr.findalot and cmd service

I did what you last suggested and am still showing Command Service when spybot runs. I don't know if this is really a problem or if I should just live with it. Any other suggestions, or am I good to go? Thanks a million, Jaime
 
Jaime, read those instructions carefully, it has to be run from the Desktop to work. If you did it correctly, then please wait until I hear back from Lonny. I PM'ed him earlier and as soon as he let's me know the site with his fix is up and running I will post that fact for you. And it is really not a problem just leftovers from a poor removal by another removal tool, it can do you no harm.

Thanks:)
 
Here you go, make sure to follow the instructions and let me know how it goes.

Please download and unzip Ren-cmdservice to your Desktop.
It will only work correctly if the folder is placed on your Desktop and extracted !!.

http://www.bleepingcomputer.com/files/lonny/ren-cmdservice.zip

Open the ren-cmdservice folder by doubleclicking it and then doubleclick the
ren-cmdservice.bat file to run the program.
A text will open when it is finished, Post it please.
Then restart the PC run spybot check for and fix any problems found.

Thanks
 
mr.findalot and cmd service

I think that I have finally gotten rid of everything!!! Here is the last post. Again, thank you so much! Jaime
Running from C:\Documents and Settings\Owner\Desktop\ren-cmdservice
No Image Path Listed in Registry

-----------------
Deleting cmdservice key
cmdservice key deleted
..
-----------------
Commandline utilities (SWReg and SWSC)
Written by Bobbi Flekman © 2005
-----------------
Finised, Post this text then
Please Restart your PC
ren-cmdservice.bat edited 6-25-2006
 
Jaime, thanks for your hard work:bigthumb: and patience too, tashi:) may close this topic when time permits.

Phil
 
mr.findalot and cmd service

It is official! I ran Spybot and there was no Command service. I am also no longer being re-directed to other sites, there are no pop-ups, and my computer is running much closer to normal speed. I want to thank you one last for all of your time and patience. I don't know thing one about computers but with your help I was able to get rid of these pesky things. Thank you so much, Jaime
 
Cheers. :bigthumb:

As the problem appears to be resolved this topic has been archived.

If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

Glad we could help.
 
You must log in or register to reply here.
Back
Top