Weeeird windows bug...

[OJay]

Hey,

IM on winXP pro, and im getting such a weird bug. Here is how it started:
one day just of the blue I get an error message 'windows cannot find the fil '/idlist ..etc (some number that keep on changing). My start bar keeps on disappearing and appearing again...:S I ran a spyware scan and it got fixed. Very sweet. 2 days later, it pops up again. Taskbar keeps dis-re-appearing.. very annoying. Can you help me get a round this. I've read many articles concerning this but to no avail...

 

[mechBgon]

Scan for viruses and spyware. What antivirus and antispyware programs do you have installed now?

While you're at it, use this checkup utility to scan for vulnerabilities, too.

 

[Harvey]

Formatting should not be out of the question. Sometimes, virus and spyware infections can get so bad that you can't completely recover the drive, and even if you get all of it, what's left can have crippled functions. It quickly gets to the point where formatting and re-installing Windows is the quickest and surest way back to a clean, well running machine.

If that's what you end up having to do, you can save your critical files by building your new installation on a separate drive. Once you install the system on the new drive and you've installed your AV and anti-spyware software, you can connect the old drive as a slave, use your AV program to scan the files you need and transfer them to your new drive.

Good luck.

 

[OJay]

My anti virus is NOD32, and antispyware is SuperANTISPYWARE. Harvey: thanks for the advice, i will put formatting as my last resort. I would like to give it some chance now..

question: i dont have a real time protection from spyware and malware, could that be the reason why it comes back everytime?

 

[mechBgon]

Originally posted by: OJay

question: i dont have a real time protection from spyware and malware, could that be the reason why it comes back everytime?

Yes. When do you fasten your seatbelt in your car... before the collision, or after the collision?


Well all rightie then

But the reason it comes back also could be something else, such as a website you visit, or an infected MP3 player, digital camera, memory card, etc, so you might want to learn about preventive measures.

Incidentally, what specific malware was removed the first time? Get the names from the antispyware program's logs and tell us.

 

[Harvey]

Originally posted by: OJay
My anti virus is NOD32, and antispyware is SuperANTISPYWARE. Harvey: thanks for the advice, i will put formatting as my last resort. I would like to give it some chance now..

question: i dont have a real time protection from spyware and malware, could that be the reason why it comes back everytime?

Viruses and spyware will infect your restore points, as well as your current files. If you're still intent on trying to remove the problems, instead of doing a clean install, don't forget to turn off your restore points and set the system for 0 bytes to delete all of your old ones.

You can re-enable your restore points IF you're successful in removing the problems.

I still think you'll spend less time doing a fresh installation of Windows, and you'll definitely be more certain a new installation will be free of viruses and spyware.

 

[QueBert]

good luck OJay, if this is any consolation to you, I fix computers for a living, I'd say 95% are Virus/Spyware problems. In my years as a tech I've only encountered one that was so jacked up from them I had to format. With times and patients just about anything can be fixed. Reinstalling can be a pain if you don't have all your software to reinstall, me personally I like to fix things and I don't consider formatting to be fixing Do these things before you format

run these programs
Spybot Spybot

Ad-Aware

Trendmicro free online scan - I know you said you have AV software, but this is free and can't hurt.

Webroot SpySweeper - if you wanna buy it I've seen it for $20 bucks.

Cleanup! - this proggy isn't directly made for virus or spyware. But what it does can get rid of harmful files, it deletes temporary files and I've had luck with it for helping me fix spyware issues


you can disable system restore, crap can hide in your old restore points. if you don't know how...
start - settings - control panel - system - system restore. and uncheck the box


I'm not saying 100% you can fix this without a format, but I always look at a format as a last option. Run the programs I've linked, turn off system restore and see what happens. It can't hurt. Spybot has a real time monitor for background processes that are trying to run when you boot up. VERY useful for finding out what might be causing the problem.

good luck man

 

[bruceb]

And after you get it all fixed, make it a habit to run a backup image using
either Ghost 2003 or Acronis TruImage .. either can make the image to
another hard drive or to cd/dvd's ... do this regularly, say monthly & back up
your personal data files in between .. This way if it craps out again, you have
something to easily and quickly restore from.

Personally I run: AdAaware 2008 ... Spybot SD ... Spyware Blaster .. Windows Defender
I have the XP SP2 firewall ON and am behind a router .. and update the defs on all these
weekly. Also have a good antirvirus .. for me McAfee 8.0 enterprise edition

 

[xtknight]

With a little debugging you could probably avoid a whole format or even reinstall.

explorer /idlist is just something to do with the Windows shell. It could be a shell plugin causing the problem, which includes any of the more invasive software that integrates itself deep into the bowels of Windows, like Yahoo Toolbar, ffdshow, etc. "Branded" software is particularly prone to that. I guess you could call it spyware but not really malware.

Does it happen in safe mode? Does it happen on another user account? (Try "Administrator" assuming you don't use that daily already. Ctrl+Alt+Del at normal WinXP login screen and type Administrator and password.) Does it happen if you eliminate everything from your startup list?

The taskbar is reappearing because Explorer is crashing after failure to start "explorer /idlist" and then restarting itself. You might be able to leave the taskbar in its own process by setting the "Launch folder windows in separate process" (or similar) option in Windows Explorer's Tool->Options (if you can even access that, or it could be set by a registry hack.)

If the spyware software can no longer fix it then it is probably just coincidence it stopped happening before for whatever reason.

Backup your important data before you do anything, but you should already be backing up your most crucial data anyway such that losing the less important stuff isn't as devastating. I don't think you'll incur serious data loss just from debugging unless you do something drastic, and most malware would rather steal your data than delete it, but you never know.

 

[ChAoTiCpInOy]

Try using Windows Defender and see what starts up and what is running. Also try using CClearner.

 

[mechBgon]

Originally posted by: bruceb
Also have a good antirvirus .. for me McAfee 8.0 enterprise edition

Ugh, I personally can't see any McAfee antivirus software as a "good" antivirus, even VirusScan 8.0i. It has its interesting points, but McAfee's actual ability to detect fresh malware has seemed lackluster lately. I used to submit quite a lot of malware to Webimmune (their submission portal), but once I had several hundred samples being ignored at once, and no improvement in detection rates, I had to call it like I saw it :thumbsdown: Kaspersky... 2-hour response time, often faster. McAfee... nevar.

My own defensive strategy is primarily founded upon using non-Admin accounts plus a disallowed-by-default Software Restriction Policy, which doesn't slow the computer down, needs no updates or license renewals, protects other layers of defense from tampering, and is very broad protection all by itself. I still suggest using the other "best-practice" steps, including good antivirus software, patching of all installed software, enabling hardware Data Execution Prevention, etc, but there's SO much that you can do just by using the security capabilities of the OS itself.

 

[xgsound]

Run the A/V and Superantispyware in safe mode because they are more effective at getting everything then.

Another good remover is Malwarebytes that runs in normal mode. http://www.majorgeeks.com/Malw...nti-Malware_d5756.html

Take note of the detected malware. If you have Virtumondo or Smitfraud infections see this site. http://wiki.castlecops.com/Mal...d_Prevention:_Overview If you use Hijackthis, use it to scan only at first and google any entries BEFORE you have Hijack this fix them.


Jim