Yrag: Yes Office 2000 (upgraded to Office XP)

Pixel Pirate: Already checked those locations

Two more, Stumpy

This link has info on wsaupdater and omniscient, both of which are running at startup.


http://www.wilderssecurity.com/showthread.php?t=35120

Stump - Stop 'Office' XP from starting anything at boot (OSA9.EXE). It should be in your Startup folder.

Try to hit Win+R and type sysedit and see if there's something going on in the 2 ini files...

BE CAREFUL!

Or try Run - MSINFO32, go to Software Environment and Startup Programs and see if theres anything there.

Maybe it's this string, remember to take a backup first

Using Regedit, change the following key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENT VERSION\WINLOGON

Change USERINIT from C:\windows\system32\userinit.exe to C:\windows\system32\userinit.exe,

Ok!, Thank You very much guys, all is now solved, my boot is now as it was, all your help is much appreciated

Thanks Guy & Gals

How did you resolve it?

Removed all that Pictoratus said, and the Office startup, then all was well

Great you got it figured out. It's a real pain to be bothered with.

In my quest for a possible solution I found the answer to a problem my father was having with Ad-Aware, also a folder that keeps popping up at startup.

The question is where did you get all that adware? Why wasn't it detected? And how do you protect yourself from getting it again?

Great Security Check here

http://security.symantec.com/sscv6/default.asp?productid=symhome&langid=ie&venid=sym

Don't take long to check

I have Spybot and it works for me. I also have NAV and I don't have virus or trojan problems. It is just strange that you said you ran all these spyware programs and they found nothing. It seems to me that they probably weren't working. Just strange, and curious.

I use AVG as my antivirus program and that Symantec checker reported that I had no virus protection running. This is odd, as Zone Alarm as reported that it couldn't find a virus checker either. I have AVG setup so that it is constantly on in the background and I have all the boot scanning options turned on as well.

Maybe that's not a bad thing. I've been reading about some of the latest virus/trojan horses which detect your virus program and turn it off. They couldn't do that if it wasn't detectable. Hmmmm.

Of course, maybe one of those pesky things has already turned it off. Double Hmmmm.



[Message Edited]

Another oddity...the Symantec virus scan said I had an infected Default.css file in c:\windows. That file doesn't exist on C:\ at all.

Hi! If you still having problems with the folder that opens, load this program and execute it and I think your problems will be over!http://www.pekspro.com/cgi-bin/countdown.pl?files/pmfix.zip.
Just download it and let it fix your problems!
Lotta

From the link above...

right... anyone going to download from that link above and run that?

#41 by lotta - 6/27/2004 1:07:37 AM Hi! If you still having problems with the folder that opens, load this program and execute it and I think your problems will be over! LinkJust download it and let it fix your problems!Lotta

Hoppsan!
På ett eller annat sätt har du försökt komma till en sida som inte finns. Gå till Startsidan så hoppas jag du hittar det du söker ändå -).

That is a 404 error, wonder why?

Another oddity...the Symantec virus scan said I had an infected Default.css file in c:\windows. That file doesn't exist on C:\ at all.

have you looked at the log file for NAV?

It will explain what it found and what it did with it...

It is probably zapped by NAV already. One thing though, if you had a Default.css in your Windows Directory then it was probably put in there by a jacked site, jacking site or some other program that was ran which has the infected file inside the compressed installation wrapper...

werewolf: ZA 5's AV monitor was programmed to detect only NAV, McAfee and CA's EZ AV. That's why it doesn't detect AVG. I imagine in time it may add other AV's to monitor. You might want to turn the AV monitor off since it doesn't work with your AV.

Iplural, hope you haven't gone yet ...I can't find that file.

sig101...thanks for that suggestion

I don't use NAV I use AVG, and yes that website check reported that I did not have virus protection, I just ignored that part as I know I'm protected, but the attack loopholes have all been filled, and the window that opens was due to some files from the WINSTART invasion not being removed completely, (I had to do that manually).

All my problems are now over and all attack holes sealed, thank you all for your help.

lets all go drink