Unable to Remove This Piece of Spyware

[cohenfive]

i posted this in the spyware removal thread as well but was hoping for a wider audience to see if anyone can help on this....

i followed schadenfroh's instructions on spyware removal from my pc:

1. have hijackthis in its own folder
2. disabled system restore
3. booted into safe mode
4. ran hijack this in safe mode and tried to delete the entries schadenfroh recommended

one file will not be removed and it's the one that is constantly running in the background tieing up my pc's resources:

04_HKLM\..\RunOnce: [*vgaanti] C:\WINDOWS\Help\Starter\vgaanti.exe rerun

i tried 'fixing' it at least 10 times but when i reran the scan it was there again....

anyone know how to get rid of this?? thanks in advance

 

[Schadenfroh]

fix it in safe mode, manually delete the file

 

[cohenfive]

Originally posted by: Schadenfroh
fix it in safe mode, manually delete the file

just to be sure, are you suggesting i go into c:\windows\help\starter, locate this file and just delete it?
don't want to mess anything else up, hence the specificity.

thanks again.

 

[Schadenfroh]

Originally posted by: cohenfive

Originally posted by: Schadenfroh
fix it in safe mode, manually delete the file

just to be sure, are you suggesting i go into c:\windows\help\starter, locate this file and just delete it?
don't want to mess anything else up, hence the specificity.

thanks again.

delete the specific file

btw, i have XP SP2 PRO, while i do have "c:\windows\help\", i do not have "c:\windows\help\starter"

 

[cohenfive]

Originally posted by: Schadenfroh

Originally posted by: cohenfive

Originally posted by: Schadenfroh
fix it in safe mode, manually delete the file

just to be sure, are you suggesting i go into c:\windows\help\starter, locate this file and just delete it?
don't want to mess anything else up, hence the specificity.

thanks again.

delete the specific file

btw, i have XP SP2 PRO, while i do have "c:\windows\help\", i do not have "c:\windows\help\starter"

when i go into window\help\starter there are two items:
1.folder named help_mell which has an html document called 'viewer'
2. an html document called 'welcome'

no mention of vgaanti....are these names just b.s.? should i blow away the starter folder or the contents?

thanks...

 

[Schadenfroh]

Originally posted by: cohenfive

Originally posted by: Schadenfroh

Originally posted by: cohenfive

Originally posted by: Schadenfroh
fix it in safe mode, manually delete the file

just to be sure, are you suggesting i go into c:\windows\help\starter, locate this file and just delete it?
don't want to mess anything else up, hence the specificity.

thanks again.

delete the specific file

btw, i have XP SP2 PRO, while i do have "c:\windows\help\", i do not have "c:\windows\help\starter"

when i go into window\help\starter there are two items:
1.folder named help_mell which has an html document called 'viewer'
2. an html document called 'welcome'

no mention of vgaanti....are these names just b.s.? should i blow away the starter folder or the contents?

thanks...

unkown, use your judgement, i would

 

[cohenfive]

using my judgement is scary in this situation...

i may also ask this in the operating system forum to see if i get a response from an xp expert. also, does microsoft have forums for questions like this? if this folder isn't supposed to be there it's probably ok to delete....

 

[Schadenfroh]

Originally posted by: cohenfive
using my judgement is scary in this situation...

i may also ask this in the operating system forum to see if i get a response from an xp expert. also, does microsoft have forums for questions like this? if this folder isn't supposed to be there it's probably ok to delete....

try the forums at msfn.org


all i can tell you is that it does not exist on my WINXP SP2 Pro machine

 

[Gurck]

No "starter" folder here either in windows\help, xp pro sp1. I'd also delete it. You could also google it for more information.

 

[dbk]

Could it be a trojan?? Did you try scanning for virus in safe mode? I'd run spybot in safemode also.

 

[cohenfive]

Originally posted by: Byung
Could it be a trojan?? Did you try scanning for virus in safe mode? I'd run spybot in safemode also.

i've run spybot and adaware in safe mode multiple times, this just stays put no matter what....

 

[John]

Originally posted by: cohenfive

Originally posted by: Byung
Could it be a trojan?? Did you try scanning for virus in safe mode? I'd run spybot in safemode also.

i've run spybot and adaware in safe mode multiple times, this just stays put no matter what....

It was already suggested that you delete the folder manually while you are in safe mode. You should also run the Panda Activescan while you're in safe mode w/ networking.