Qoolaid, Smitfraud etc. - imm. logoff - no Safe Mode, MSN inflicted.

[satrow]

I've pulled the disk to another machine, cleaned out loads of trojans etc - there's no XP or recovery cd, nor any sign of making one (apart from jumping through hoops of real fire ), it's a Dell 2550, I think - P4, 256Mb, 40Gb.

Any way I can make this work again without flattening it - ie., how do I clean the registry from another XP CD or PE disc?

 

[diogenes10]

Specialized removal tools may be in order, two possibilities from your title:

Combofix:

http://www.windowsbbs.com/showthread.php?t=57442

download here:

http://download.bleepingcomputer.com/sUBs/combofix.exe

smitfraud fix:

http://www.bleepingcomputer.com/forums/topic17258.html

Others may be needed.

If there is a rootkit problem in there too, there may be no way you can be absolutely sure the registry is cleaned.

 

[satrow]

Thanks for the reply, diogenes10.

With the drive slaved, I found and removed Swizzor, Qoolaid, worm.vb.ao, zquest and a myriad of other spyware traces - still couldn't access Windows when back as a boot drive.

Rootkit detectors found nothing on the drive.

I managed to run a parallel install from an nLite disc I'd created for my machine a couple of days before (The original XP disc was found but was unbootable (damaged)).

The machine's back in use now and a couple of teenagers suitably chastised and given some safe hex education.

If I can't find a way into the original Windows installation, I'll go back and clean all traces of the original install and repair the current installation using their OEM key.

 

[diogenes10]

Here's a piece of freeware that would give them a little additional protection:

http://www.javacoolsoftware.com/spywareblaster.html

I added this to the av and firewall protection on our home machine.

 

[satrow]

That's already installed,as is the Spybot hosts file and they're under strict orders to use Firefox to paste links into - not click them from MSN Messenger so they open in IE!

Thanks again.

 

[lontours]

I have Symantec Mail Security for Microsft Exchange 4.6.1.107 installed. When I try and activate Symantec Premium AntiSpam
I get the following error:

"Symantec Premium AntiSpam registration failed. The product will not
receive spam definition updates.

Do the following:
1. Ensure that a valid, up-to-date Premium AntiSpam license is
installed.
2. Verifty that DNS can resolve aztec.brightmail.com
3. Allow outbound secure https through firewall (port 443)
4. If using a proxy server, see the documentation for manually running
register.
5. Retry registration by enabling Premium AntiSpam within the
product."

Has anyone got this to successfully register?
PS So I've checked second,third and fourth line and it's working and I think I've got the valid key from Symantec.