Jump to content



  • Please log in to reply
1 reply to this topic

#1 NsaneRAZ



  • Full Member
  • Pip
  • 7 posts

Posted 02 July 2004 - 08:35 PM

hi, over the past 3 weeks i have done a lot of research, trial and error, and lookn thru files on my comp(regular,safemode,dos promp)

ive run every single program, spybot, adaware, about buster, etc etc etc, ran all the procces progs like process xplorer etc, killed off all files as of and after date of infection in windows and windows system folder, killed all temp files, cookies, temporary internet, history (had to also do that restarting comp in ms dos), fix stuff usin hijack this, and fixn more registry stuff runin regedit, and u cant 4get disabling programs from ur startup at msconfig.

anyway my point is...all that shit and it had seemed fixed(b/c i orginally had the reoccruing res:/dll virus) but i was confused...because everytime i opened up IE, AIM etc it wud freeze...but i didnt understand..cuz my homepage stayed back at google or cnn or anythn clean all the time...cuz see i had killed off the DLL virus/trojan part..but then i noticed in my system folder in windows...a file called vsconfig.xml ... so i lookedit up..and its apparently part of zone alarm...BUT my vsconfig.xml was almost 300MBS...so i looked at one on a different computer..and that one was like 300 bytes or sumthn realy small...and when i clicked open it wud show a few lines of code...but when i clickd mine..id get an error when opening sayn the code is bad or sumthn...and wud take like 10 mins 2 jus get the properties of it...so im like shit this mite be the last straw 2 this virus...sooo i deleted it and it worked..i restarted my computer..and IE worked still, so now im finally in the clear.

heres how 2 kill off vsconfig.XML (b/c u cant kill it in regular windows, or safemode b/c it says the file is in use)

kill off VSCONFIG.XML , especially if its 1MB+...u gotta kill tht in DOS
(start>>>shutdown>>>in MSDOS MODE)
***NOTE: regular ms dos promp NOT ms dos SAFE MODE***
a black screen will come up
heres the commands to type in(each line entered separately)

CD windows
CD windows\system
del vsconfig.xml
-it shud say deleted or ull see sumthn happne atleast..and then type CD windows
and then WIN to boot into windows.

now check make sure all temp files n shit r deleted...jus 2 be safe ya know...and then start IE...it shud work without freezing...if u did everything possible.

basicaly my point of this post isnt to tell the steps to gettn rid the virus, cuz theres a lot more detailed explanations of all my steps on this forum.

my point is tht a lot of people have killd off the DLL part successfully BUT thier IE will freeze...so when u kill of vsconfig.xml..it will fix ur problem.

side note: u might ask well why is vsconfig bad if its part of zonealarm(a popular firewall)
well...my guess is that, since its an XML file..it shows where 2 direct ur browser or sumthn like tht...and a normal vsconfig file shud be less than 1MB...and when u open ur vsconfig file(if its not corrupt)..it shud be able 2 open and no errors shown in the code[it will say error].

anyway one last thing thats very important....ur vsconfig.xml shud come back after a reboot...but thats OKAY(if its small now..not like ur big sized previous file) b/c its a valid file...jus not when its corrupt... zonealarm will regenerate a new clean file after the bad1 is killed.

#2 PGPhantom


    Superman of SWI

  • Emeritus
  • PipPipPipPipPip
  • 3,494 posts

Posted 31 August 2004 - 12:25 PM

  • HijackThis ...
    • Double click on "My Computer" to open it.
    • Double click on the local "C-Drive" to open it.
    • Click on "File" => "New Folder" and name it HJT. i.e. The folder will be C:\HJT.
    • Please download HijackThis from any of the following locations:
    • spywareinfo.com
    • subratam.org
    • tools.zerosrealm.com
  • Install/Unzip it into C:\HJT.
  • Only run HijackThis from C:\HJT\HijackThis.exe. That way we can ensure that we have the backup files available in the event that they are needed.
  • Run HijackThis, click on scan and wait for the scan to finish.
  • The "Scan" button will change to "Save Log", click on it and simply press "Save" on the window that will appear.
  • Notepad will open with a copy of the log.
    • Click on "Edit" => "Select All".
    • Click on "Edit" => "Copy". This will copy the contents of the Notepad instance to the clipboard.
  • Please post your entire log here for analysis.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button