Recently invaded by malware. After cleaning I get the above message. When I
click ok start getting trojan and spyware which are blocked, cleaned and
deleted by PC-cillin

Sophos virus analysis: Troj/Krepper-Z:
http://www.sophos.com/virusinfo/anal...jkrepperz.html

- - - - -

The following registry entries are created to run Troj/Krepper-Z on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
run
<Windows>\inet20003\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
xp_system
<Windows>\inet20003\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
xp_system
<Windows>\inet20003\services.exe
- - - - -

--
Ramesh, Microsoft MVP
Windows XP Shell/User

Windows XP Troubleshooting
http://www.winhelponline.com


"PoliceCruiser" <PoliceCruiser@discussions.microsoft.com> wrote in message
newsAD6FC8A-29B2-4845-8589-3EE3816ABC88@microsoft.com...
Recently invaded by malware. After cleaning I get the above message. When I
click ok start getting trojan and spyware which are blocked, cleaned and
deleted by PC-cillin

How do I correct this?

"Ramesh, MS-MVP" wrote:

> Sophos virus analysis: Troj/Krepper-Z:
> http://www.sophos.com/virusinfo/anal...jkrepperz.html
>
> - - - - -
>
> The following registry entries are created to run Troj/Krepper-Z on startup:
> HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
> run
> <Windows>\inet20003\services.exe
> HKCU\Software\Microsoft\Windows\CurrentVersion\Run
> xp_system
> <Windows>\inet20003\services.exe
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> xp_system
> <Windows>\inet20003\services.exe
> - - - - -
>
> --
> Ramesh, Microsoft MVP
> Windows XP Shell/User
>
> Windows XP Troubleshooting
> http://www.winhelponline.com
>
>
> "PoliceCruiser" <PoliceCruiser@discussions.microsoft.com> wrote in message
> newsAD6FC8A-29B2-4845-8589-3EE3816ABC88@microsoft.com...
> Recently invaded by malware. After cleaning I get the above message. When I
> click ok start getting trojan and spyware which are blocked, cleaned and
> deleted by PC-cillin
>
>
>

Do a complete virus scan to be safe. Then, remove the orphaned startup
entries by editing the registry or by using third-party startup manager.

How to manage Windows Startup?:
http://www.winhelponline.com/startup.htm

Common loading points of threats in Windows 2000/XP:
http://service1.symantec.com/SUPPORT...01060517115206

Startup Program Loading:
http://aumha.org/a/loads.htm

Manually Disabling Startup Programs:
http://www.microsoft.com/resources/d...c_str_elqj.asp


Startup managers:

Sysinternals Freeware - Autoruns:
http://www.sysinternals.com/Utilities/Autoruns.html

Autoruns: Hunt down autostart programs wherever they hide
http://www.windowsitpro.com/Articles...rticleID=44089

Startup Control Panel
http://www.mlin.net/StartupCPL.shtml

How to use MSCONFIG: NetSquirrel.com:
http://netsquirrel.com/msconfig/


--
Ramesh, Microsoft MVP
Windows XP Shell/User

Windows XP Troubleshooting
http://www.winhelponline.com


"PoliceCruiser" <PoliceCruiser@discussions.microsoft.com> wrote in message
news:22BFFB01-79B2-441E-8474-5021AA52F496@microsoft.com...
How do I correct this?

"Ramesh, MS-MVP" wrote:

> Sophos virus analysis: Troj/Krepper-Z:
> http://www.sophos.com/virusinfo/anal...jkrepperz.html
>
> - - - - -
>
> The following registry entries are created to run Troj/Krepper-Z on
> startup:
> HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
> run
> <Windows>\inet20003\services.exe
> HKCU\Software\Microsoft\Windows\CurrentVersion\Run
> xp_system
> <Windows>\inet20003\services.exe
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> xp_system
> <Windows>\inet20003\services.exe
> - - - - -
>
> --
> Ramesh, Microsoft MVP
> Windows XP Shell/User
>
> Windows XP Troubleshooting
> http://www.winhelponline.com
>
>
> "PoliceCruiser" <PoliceCruiser@discussions.microsoft.com> wrote in message
> newsAD6FC8A-29B2-4845-8589-3EE3816ABC88@microsoft.com...
> Recently invaded by malware. After cleaning I get the above message. When
> I
> click ok start getting trojan and spyware which are blocked, cleaned and
> deleted by PC-cillin
>
>
>

"Ramesh, MS-MVP" wrote: