Spaceman

Thanks for the TrojanHunter link.

I have downloaded the evaluation copy and it looks very nice. The tools report the inner workings of windows in great detail and it has a vast list of Trojans that it is supposed to detect.

What I don't know is whether the program can understand all this info and actually detect and remove the trojans. I was dissapointed to note that only a small proportion of the trojans listed had descriptions against them and that this proportion seemed to decrease as I went down the list.

I don't mean these coments to imply that I'm negative about this program. I just want to better understand it's capabilities.

O, similar questions to me which is why I haven't come to any conclusions about it yet. I want to find a package that can handle Trojans as they are becoming more of a menace and as you know some can be very difficult to remove. Please let me know what your conclusions are.

Bye the way I tend to use http://www.spywareinfo.com for leads about this sort of thing but their website is having problems at the moment, I think its a technical problem but they are constantly being attacked with sophisticated DOS attacks etc. They have some very good people in the forums there.

Still same problem with SP2.

I have deleted Zonealarm & Fix-It programs, ran Spybot & Adaware. Ran System File Checker.

Started in Safe mode & located a file (under Software Distribution - thanks for the info on where to find it) called Update. SP2 loaded itself but again, when restarting I got the message that Windows is unable to start! Bugger!

I've put another request into MS for help & I guess I'll have to wait for them to suggest something else.

7thFloor

For the time being I've run out of likely solutions but have you tried:-

Make sure you have plenty of free disk space and do a CHKDSK /f from the command prompt.

Are you up to date with all the pre SP2 updates?

Are you logged on as an Administrator?

You could boot from your XP instalation CD and use the repair option (not the recovery console one) to put your system back to its original state. This should keep all of your installed programs and most though not all of your settings.

If you do this you will lose all of the security updates. Unless you have a good external firewall, I would not recommend connecting to the internet, even for a few seconds or to get an update, untill you have SP2 installed.

Someone clever may be able to sort this via the recovery console but don't try it unless you understand it.

Your system obviously has a problem so do not count on continuing to keep your data intact while trying to sort this.

Best of luck.

Optimist

Thanks for your interest. I've done everything you suggest apart from the repair option which I hadn't thought of and have never touched before. It may well come to that if I don't get anywhere with MS (Still no reply as of now).

Will keep you posted about the outcome. I must confess thinking that I'll just ignore SP2 but then I'd probably screw myself up for further updates. Best to persevere I reckon.

Update with my SP2 problems:

I have a Mesh PC. On their site they are warning of Windows freezing on uploading SP2 if certain Spyware is there. It got me wondering.

I think I've found a, or THE, problem. When I ran Spybot I was assuming that it then fixed the problems like it said. It doesn't appear to get rid of DSO Exploit. I ticked the Fix it box but when I run Spybot again, DSO Exploit is still there.

This is obviously a registry problem. I'm going to remove the entries this afternoon after backing up my registry.

I'll keep you informed.

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2461077358-3683029919-4181152385-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

7thFloor

I think you will find that Spybot does remove those entries but the system keeps putting them back. I did look into the DSO Exploit. I can't remember the details but came to the conclusion that it is harmless.

Of course I could well be wrong and in any case it could still be the source or your problems.

7th, I came to the same conclusion as Optimist. theres more info here;

http://www.askmehelpdesk.com/cgi-bin/yabb/YaBB.cgi?board=computers_for_beginners;action=display;num=1082096807

Yes, you're perfectly correct, it hasn't helped at all. But I count it as a small moral victory as I have never altered anything in the registry before & I have the satisfaction that it seemed to go OK and Exploit hasn't re-appeared.

I have also obtained a copy of SP2 installation on disk as suggested and tried that - guess what? No luck either!!! Same problem! What I did notice was that the disk drive light only came on for a few seconds at the beginning of installation leading me to believe that the installation process is using the original downloaded SP2 info. Is the problem that this initial download has been corrupted? I have emailed MS telling them of the problems (again) and asking what SP2 files to delete so I can start from scratch.

I saw a folder (421meg)in there under the 'Software Distribution/Download' folder that contained references to SP2 and was created on 16th Sept but I'm concerned if I delete the whole lot I'll be getting myself into trouble.

I'll probably have to wait for MS to get back in touch.

7thfloor, I and a friend have recently had a total of 3 pcs that were so clogged up we had no option with but to re-install XP. This was on PCs that had Norton, Spybot and Adaware running. I managed to save the other PCs on my network from the same fate by doing online virus scans at trendmicro.com and pcpitstop.com and installing and running spywaredoctor and spywareblaster. These found numerous trojans, auto dialers and popups that the others had failed to spot.

Maybe you solution lies in the same direction.


best of luck

Neil

robber, spywaredoctor is know to produce false postives, my guess is that the one you found were false.

I would not use spywaredoctor instead of sybot and adaware.

Edit I have just downloaded a trail version of this program, it gave me 3 warnings all 3 were wrong with one descrided as "Very Dangerous Spyware" its rubbish.

On a previous 'puter, it was set up so that if I fired up OE or IE the thing would automatically dial-up for me. Don't know how that worked.

At the mo when I load up, it just gives me the dialler window and I have to push the button to start it.

Can anyone tell me what settings I need to make it auto dial?

G.

Mr G get yourself a secretary :-)

MB - Can't afford one - gotta wife ;-)

Greystone,

is there a tickbox option on that dialler window for connect automatically?

Ian

Ian - No. It may be hidden somewhere but it is all Spanish and, whilst I can comfortably order a bocadillo and a glass of wine in the language, the techie stuff floors me.

I'm sure before I was using freeserve and I'm now on wanadoo which is the same family so you may be onto something there. ;-)

G.

Robber, I have had a bit deeper look at the Spyware Doctor product and I have slightly changed my mind about it, its not a rogue program but its detection does not seem to be very good. The 3 things it found on my PC were not spyware or trojans or anything else that needs removing. It looks as though it could end up being OK but at the moment I would definitely not uses it.

And apologies if I sounded a bit arrogant in my earlier post, I didn't mean to.

greystone, try (in IE) Tools/Internet Options/Connections tab and tick Always dial my default connection, or the Spanish equivalent ;-)

Little problem. Took a few screws out to see if a hard disc really does look like this. Boy, were they stiff. Anyway, I took a photo, looks like this:



Now I've put all the screws back in it doesn't seem to do anything other than spin. I'm sure I connected the wires back correctly. All my critical information that it's taken me years to collect is on there. If I can only get it working again I can get all this info off!

How do I do that?

































Only kidding!

Kayak - Already done that but still no joy. No worry. It is not a big prob just a minor annoyance. ;-)

G.