Re: Still cannot stop Windows "Notebook" from vanishing ... HELP!!

From: Bob McCoy [MSFT] (bobmccoy_at_online.microsoft.com)
Date: 12/22/04 

Date: Wed, 22 Dec 2004 11:35:16 -0600

I have to agree with Malke. While it's very noble of you to think that you
can live with "incessant pop-up stuff ," that's a symptom that your
computer's still seriously disturbed. Get this fixed first. 

-- 
Bob McCoy
* This posting is provided "AS IS" with no warranties, and confers no
rights.
* Please note I cannot respond to email questions. Please use these
newsgroups.
"Malke" <malke@nospoonnotreally.com> wrote in message 
news:enZvaJE6EHA.540@TK2MSFTNGP12.phx.gbl...
> Michael wrote:
>
>> Ok, not such good news here ...
>>
>> I did all the scans and anti-virus stuff in Safe Mode; I also copied
>> the notepad file from my System32 directory to C:\Windows; and after
>> that showed little improvement, I went ahead and obtained the
>> appropriate notepad file from my Windows XP install disk and had that
>> file run from my CD-ROM drive.
>>
>> I still have the disappearing notepad problem, not to mention
>> incessant pop-up stuff when I enter IE, though I could probably live
>> with that ... it's the issue with notepad I really need fixed.
>>
>> Oh, by the way, the first thing I did was that sfc /scannow
>> suggestion.
>>
>> It's a fairly new computer, so I'd be surprised if I had to overhaul
>> something in the hardware. Though, if that's what it takes ...
>>
>> Is there something you can recommend that I can have done to my
>> computer to get it usable again?
>>
>> I run Windows XP home;
>> am on DSL;
>> am a subscriber to Norton anti-virus;
>> never, positively NEVER open suspicious emails or attachments.
>>
> If you are still getting popups in IE, that is a sure sign your computer
> is not completely clean of malware. Even though you have already done
> some scanning, go through the following removal steps. Do all steps
> with updated tools in Safe Mode. In one of your posts you mentioned
> having a popup stopper. Check Eric Howes' rogue antispyware spyware
> warrior site (in the links after the steps) to make sure you haven't
> inadvertently invited betrayalware into your computer.
>
> 1) Scan in Safe Mode with current version (not earlier than 2003)
> antivirus using updated definitions.
>
> 2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
> programs are free, so use them both since they complement each other.
> There is a new version of CWShredder from Intermute. I would not
> install the other Intermute programs, however. Alternately, there are
> CoolWebSearch malware removal steps at SilentRunners.
>
> Be sure to update these programs before running, and it is a good idea
> to do virus/spyware scans in Safe Mode. Make sure you are able to see
> all hidden files and extensions (View tab in Folder Options).
>
> HijackThis is an excellent tool to discover and disable hijackers, but
> it requires expert skill. See below for HijackThis links. A combination
> of HijackThis and About:Buster works well in removing the About:Blank
> homepage hijacker. Again, this is an expert tool and novices should get
> help with it.
>
> 3) If you are running Windows ME or XP, you should disable/enable System
> Restore because malware will be in the Restore Points. With ME, you
> must disable System Restore completely. With XP, you can delete all but
> the most recent (presumably clean) System Restore point from the More
> Options section of Disk Cleanup (Run>cleanmgr).
>
> 4) Make sure you've visited Windows Update and applied all security
> patches. Do not install driver updates from Windows Update.
>
> 5) Run a firewall.
>
> Links to help with malware:
>
> Software/Methods:
> http://www.safer-networking.org - Spybot Search & Destroy
> http://www.lavasoftusa.com - Ad-aware
> http://www.majorgeeks.com - good download site
> http://www.intermute.com/spysubtract/cwshredder_download.html
> http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
>
> HijackThis:
> http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
> Eshelman
> http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
> forum
> http://www.wilderssecurity.com/
> http://forums.tomcoyote.org/
> http://www.spywareinfo.com/forums/
>
> General:
> http://forum.aumha.org/ - look under "Security" for various forums
> http://rgharper.mvps.org/cleanit.htm
> http://mvps.org/winhelp2002/unwanted.htm
> http://www.aumha.org/a/parasite.htm - The Parasite Fight
> http://www.spywarewarrior.com/rogue_anti-spyware.htm
>
> Malke
> -- 
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"