Jump to content


Photo

Popups and malware


  • Please log in to reply
9 replies to this topic

#1 Skip

Skip

    Member

  • Full Member
  • Pip
  • 12 posts

Posted 28 May 2004 - 12:51 AM

I am having a problem with popups and, I'm afraid, malware. Please help me clean this out of my system. Here is my HijackThis log.

Logfile of HijackThis v1.97.7
Scan saved at 10:32:44 PM, on 5/27/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\HPZipm12.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\wldtwh32.exe
C:\WINNT\system32\wldtwh32.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\SysAI\SysAI.exe
C:\WINNT\system32\regsvrac32.exe
C:\WINNT\system32\regsvrac32.exe
C:\WINNT\system32\regsvrac32.exe
C:\WINNT\system32\regsvrac32.exe
C:\Download\hijackthis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINNT\system32\regsvrac32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [AutoLoaderp0pr1ILKKJPN] "C:\WINNT\system32\wldtwh32.exe" /PC="AM.ICMD2" /HideUninstall /HideDir
O4 - HKLM\..\Run: [p76X36W] wldtwh32.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.8\THGuard.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\RunOnce: [Ad-aware] "C:\PROGRA~1\LAVASOFT\AD-AWA~1\Ad-aware.exe" "+b1"
O4 - HKLM\..\RunOnce: [tij2d.exe] C:\WINNT\system32\tij2d.exe
O4 - HKCU\..\RunOnce: [tij2d.exe] C:\WINNT\system32\tij2d.exe
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Research (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.micr...922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.micros...ontent/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

#2 OlTramp

OlTramp

    SWI Junkie

  • Trusted Advisor
  • PipPipPip
  • 148 posts

Posted 28 May 2004 - 07:05 PM

Hi Skip
Close all browsers and rerun HJT.Check and click fix checked for the following-

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINNT\system32\regsvrac32.dll
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [AutoLoaderp0pr1ILKKJPN] "C:\WINNT\system32\wldtwh32.exe" /PC="AM.ICMD2" /HideUninstall /HideDir
O4 - HKLM\..\Run: [p76X36W] wldtwh32.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\RunOnce: [tij2d.exe] C:\WINNT\system32\tij2d.exe
O4 - HKCU\..\RunOnce: [tij2d.exe] C:\WINNT\system32\tij2d.exe
Restart your computer in safe mode and make sure all hidden and system files are showing and delete-
C:\WINNT\system32\regsvrac32.exe <=File
C:\Program Files\TV Media <=Folder
C:\WINNT\system32\tij2d.exe
Find this one,post it's properties and rename it-
C:\WINNT\system32\wldtwh32.exe to C:\WINNT\system32\wldtwh32.old
Then run a scan at one or all of these sites-
http://housecall.tre.../start_corp.asp
http://www.wilders.o...ee_services.htm
http://www.pandasoft...n_principal.htm
http://www.bitdefend...can/licence.php
Let me know about the properties and scan results.

How To Show Hidden Files
How to Start In Safe Mode

Edited by OlTramp, 28 May 2004 - 07:07 PM.


#3 Skip

Skip

    Member

  • Full Member
  • Pip
  • 12 posts

Posted 30 May 2004 - 02:52 AM

Thank you for your help. Here are the results you aked for.

The properties for wldtwh32.exe are as follows;

Type of file: Application
Description: wldtwh32
Location: C:\WINNT\system32
Size: 184 KB (188,416 bytes)
Size on disk: 192 KB (196,608 bytes)
Created: Monday, May 17, 2004, 2:44:04 PM
Modified: Monday, May 17, 2004, 2:44:00 PM
Accessed: Today, May 28, 2004
Attributes: Archive is checked.

Housecall from trendmicro found nothing.

This is from bitdefender;

Memory ok
Process [SysAI.exe] [PID:000005CC] infected: Trojan.Downloader.Apropo.D
C:\Program Files\SysAI\SysAI.exe unable to disinfect
Master Boot Record 80 ok (Windows 95 B20 - Windows 98)
Partition Boot 1 (primary) (active) ok (Windows NT 2000 FAT32)
C:\WINDOWS\Profiles\beahm\Application Data\Microsoft\Outlook\outlook.pst=>[Subject: fake][From: jfeyen@bannerbank.com]=>misc.zip infected: Win32.Netsky.B@mm
C:\Program Files\SysAI\AproposPlugin.dll infected: Trojan.Downloader.Apropo.D
C:\Program Files\SysAI\AproposPlugin.dll unable to disinfect
C:\Program Files\SysAI\SysAI.exe infected: Trojan.Downloader.Apropo.D
C:\Program Files\SysAI\SysAI.exe unable to disinfect
C:\Recycled\Dc25.exe infected: Trojan.Downloader.Apropo.D
C:\Recycled\Dc25.exe unable to disinfect
C:\WINNT\system32\wldtwh32.old infected: Trojan.Downloader.Apropo.D
C:\WINNT\system32\wldtwh32.old unable to disinfect
C:\WINNT\system32\web4dmod.exe infected: Trojan.Downloader.Apropo.D
C:\WINNT\system32\web4dmod.exe unable to disinfect
C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.bat suspect: BAT.Delete
C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.bat copied
C:\Documents and Settings\Michelle\Local Settings\Temp\THIBE3.tmp\twaintec.cab=>twaintec.dll infected: Trojan.Spy.BiSpy.C
C:\Documents and Settings\Michelle\Local Settings\Temp\THIBE3.tmp\twaintec.dll infected: Trojan.Spy.BiSpy.C
C:\Documents and Settings\Michelle\Local Settings\Temp\THIBE3.tmp\twaintec.dll unable to disinfect
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\7Q9SK3V5\loader[1].exe=>(Upx) infected: Trojan.SecondThought.P
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\7Q9SK3V5\loader[1].exe unable to disinfect
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\7Q9SK3V5\April0604_loader[1].exe infected: Trojan.SecondThought.H
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\7Q9SK3V5\April0604_loader[1].exe unable to disinfect
C:\Documents and Settings\Nick\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe infected: Application.Adware.PowerReg.3.0
C:\Documents and Settings\Nick\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe unable to disinfect

#4 OlTramp

OlTramp

    SWI Junkie

  • Trusted Advisor
  • PipPipPip
  • 148 posts

Posted 30 May 2004 - 09:22 AM

Hi
OK, go ahead and delete that file.You will probably need to show all files and be in safe mode.
Also look for and delete, if found,C:\Program Files\SysAI <=This folder
Clear out all of your system and internet temporary files and post another log. If we see you are clean we'll have you reset your system restore so it is clean too.

Edited by OlTramp, 30 May 2004 - 09:27 AM.


#5 Skip

Skip

    Member

  • Full Member
  • Pip
  • 12 posts

Posted 30 May 2004 - 10:36 AM

OK, I deleted wldtwh32 and the folder SysAI, ran another HJT (log below) and a Pandasoftware scan (below HJT log).

Logfile of HijackThis v1.97.7
Scan saved at 8:32:19 AM, on 5/30/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINNT\system32\MsgSys.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINNT\system32\mobsync.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINNT\system32\HPZipm12.exe
C:\HJT\hijackthis.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\SysAI\AproposPlugin.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.8\THGuard.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Research (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.micr...922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.micros...ontent/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefend...bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

Pandasoftware log:
Incident Status Location

Virus:Trj/Downloader.DK No disinfected C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\IATU4NO7\dm_286[1].cab[dmproxy.dll]

#6 OlTramp

OlTramp

    SWI Junkie

  • Trusted Advisor
  • PipPipPip
  • 148 posts

Posted 30 May 2004 - 12:53 PM

Close but not quite-
Rerun HJT with all browsers closed. Check and fix-
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\SysAI\AproposPlugin.dll (file missing)
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe
Delete - C:\Program Files\AutoUpdate <= This folder
Now you must empty your temp files. Follow this location and delete files but do not delete the folders-
C:\Windows\Temp
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\
In IE-
Tools,Internet Options,Delete Files and cookies. (Make sure you remember any passwords that you have on various sites. When you delete the cookies you will have to log in again)

#7 Skip

Skip

    Member

  • Full Member
  • Pip
  • 12 posts

Posted 30 May 2004 - 02:33 PM

OK, everything has been done, and here's the latest HJT log.

Logfile of HijackThis v1.97.7
Scan saved at 12:32:13 PM, on 5/30/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\system32\mobsync.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINNT\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\HJT\hijackthis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.8\THGuard.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Research (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.micr...922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.micros...ontent/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefend...bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

#8 OlTramp

OlTramp

    SWI Junkie

  • Trusted Advisor
  • PipPipPip
  • 148 posts

Posted 31 May 2004 - 08:27 AM

Looks good to me. I don't know how ,or if you can, shut off your system restore in 2000. Check your help section. If you can, turn it off and reboot . Then turn it back on. That will clear any remnants that were in your restore.By design you can't delete any files from inside of it.

#9 Skip

Skip

    Member

  • Full Member
  • Pip
  • 12 posts

Posted 31 May 2004 - 05:25 PM

Thanks for all your help.

#10 OlTramp

OlTramp

    SWI Junkie

  • Trusted Advisor
  • PipPipPip
  • 148 posts

Posted 31 May 2004 - 05:59 PM

You are very welcome-
:thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button