iissys.exe and *iissys.exe Anyone Ran Up Against These 1

[jag1046]

Doing a routin clean on a users PC today I managed to kill Navisearch, and Bulseye Network and several others. There is one that seems to be eluding me though. The file is iissys.exe and is in the Windows INF folder. There are 2 entries in regedit referencing this and *iissys.exe

I have cleaned the reg and renamed the file but it keeps comming back at reboot. Adaware and Spybot won't touch it.

Any ideas would be appreciated.


Bill

<<<<< Hi I'm a telephone technician running a test on your telephone lines. To complete the test please dial nine (9), zero (0), pound sign (#) and hang up. >>>>>

 

[MichealC4]

Well, try this.

1. Turn off System Restore (XP only)
2. Open task manager (ctrl+shift+esc) and kill any suspicious tasks.
3. Fix the registry entries.
4. Immediately reboot.

See how that works for you.

----------------------------
"Security is like an onion" - Unknown

 

[jag1046]

PC is Win 2000

When I kill the task it pops back in within seconds.


Bill

<<<<< Hi I'm a telephone technician running a test on your telephone lines. To complete the test please dial nine (9), zero (0), pound sign (#) and hang up. >>>>>

 

[MichealC4]

Okay. Boot in to safe mode and try it there. There might be another task that is stubbing that one.

----------------------------
"Security is like an onion" - Unknown

 

[jag1046]

Tried that no luck.

Any other ideas?

Bill

<<<<< Hi I'm a telephone technician running a test on your telephone lines. To complete the test please dial nine (9), zero (0), pound sign (#) and hang up. >>>>>

 

[MichealC4]

Hrm. Spybot has a Teatimer to protect your system from things doing things such as adding themselves to the Run keys. I believe it is under Tools. Enable it, clean out the run key. You should get a popup from the program asking you to allow the spyware to add itself to the Run key. Deny it. Reboot.

----------------------------
"Security is like an onion" - Unknown