Re: AVG on Win 98 problem starting up

From: "Ike Milligan" <info@xxxxxxxxxxxxxx>

| Well, it's a bit of a long story. An old guy I know had a P 166 with
| Win98 and picked up some viruses, So I downloaded AVG free copied onto a
| CD, and then installed it on his machine. Now it won't boot up
| completely into Win 98, but only shows his wallpaper. The AVG DOS
| message suggests making some rescue disks and using them to boot into
| Win 98, using a clean computer to make them. My main machine is running
| XP. I don't suppose it is possible to use rescue disks from XP but
| somehow booting Win 98 from another disk? I have Win 98 boot disks. Also
| I could dig an old computer out of the storage shed and set it up and
| use that to make rescue disks.
|
| What I think I should have done instead instead of installing AVG, was
| try to manually remove the virus that kept IE from running, that is, the
| secure32.html blue screen, And then tried to surf over to
| Pandasoftware.com and done the free scan. But now I can't seem to boot
| Win 98 except for a blank wallpaper screen. Before I installed AVG
| free, I could at least boot up Windows. Also I might have instructions
| to get rid of Secure32.html virus now that I have learned the name of
| the file that keeps running it, namely according to McAfee,
| paytime.exe. I did print out their information about Start-page IH and
| the associated registry keys. There are other viruses on the machine,
| but I just wanted to run Internet Explorer, as Panda won't run on other
| browsers. 2


Symptoms of a SmitFraud Trojan !

Two part reply..

Perform Part 1 then perform Part 2.

If the first two parts don't work, perform the alternate section.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version...

C:\Program Files\Java\jre1.5.0_06


http://www.java.com/en/download/manual.jsp



Part 1
-----------

Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic43659.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:

Part 1
-----------

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Part 2
-----------

S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


.

Relevant Pages

  • Re: Computer shutting itself down
    ... Events on the last boot in normal mode: ... System and Application logs in Event Viewer relating to the last boot in ... restart in Safe Mode, it only worked with Safe Mode with Networking. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Computer shutting itself down
    ... Events on the last boot in normal mode: ... System and Application logs in Event Viewer relating to the last boot in ... restart in Safe Mode, it only worked with Safe Mode with Networking. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Safe Mode Boot Loop; Normal Boot OK
    ... in normal mode "or" ... I attempted to boot to Safe Mode to run a virus/malware ... load if logged in as Administrator (normal machine login is as a Power ...
    (microsoft.public.windowsxp.general)
  • RE: Drive Errors each time I boot up Windows XP
    ... The computer isn't automatically running CHKDSK on boot any more, ... refers to the problem as ignorable as long as CHKNTFS doesn't report the disk ... My disk gets reported clean. ... I suppose it is possible this is a Windows XP bug? ...
    (microsoft.public.windowsxp.accessibility)
  • Re: XP boot up duration
    ... The XP icon stays for about 2 minutes which is quite long... ... By boot up "icon", I assume you mean the splash screen with animation. ... The Windows XP splash screen animation ... Comparing normal mode and safe mode entries enables you to determine ...
    (microsoft.public.windowsxp.general)