in XP, in the registry, theres no 'run services' in windows, current version

Discussion in 'Computer Support' started by Quiz Time, Jun 27, 2004.

  1. Quiz Time

    Quiz Time Guest

    HKEY_LOCAL_MACHINE>Software>Microsoft >
    Windows>CurrentVersion>RunServices

    can't find it in XP,

    hence can't find the entries i am supposed to delete to get rid of an
    annoying trojan Trojan.Win32.Dasmin.b keeps hijacking my homepage and giving
    me pop ups, i deleted the trojan in safe mode but now i still can't seem to
    rid my system of the pop ups and homepage change
     
    Quiz Time, Jun 27, 2004
    #1
    1. Advertisements

  2. Quiz Time

    Patrick Guest

    Have you tried using a program like Adaware or Spybot to get rid of the
    popups and stuff?
     
    Patrick, Jun 27, 2004
    #2
    1. Advertisements

  3. Quiz Time

    Quiz Time Guest

    Yes, normally ad-aware sorts out everything, just updating with todays
    release, see if that helps.

    But I know theres some entries i have to delete, that i just can't find, due
    to the Trojan.Win32.Dasmin.b
     
    Quiz Time, Jun 27, 2004
    #3
  4. Quiz Time

    Brian Guest

    your path is right exept for the last one.. it is just "run" and not "run
    services"
     
    Brian, Jun 27, 2004
    #4
  5. Quiz Time

    Quiz Time Guest

    Ah right, well theres nothing out of the ordinary in there, just a handfull
    of innocent apps such as norton etc

    I did spot a dodgy looking line in the microsoft, windows, current version
    folder

    StartupIDCcount59 REG_SZ on

    This dasmin trojan does some kind of counter to see how many hits i've had
    on a partiucular refferals site where vthe pop ups are coming from, and
    where my home page keeps getting set to, I think.

    Don't know wether to delete that line, and switch off my modem for a while
    to get a new IP address, everytime i leave it off for a hours, ntl seem to
    have given me a new IP when i start it all back up again.
     
    Quiz Time, Jun 27, 2004
    #5
  6. Quiz Time

    Jim Berwick Guest

    Don't delete that line please. If you have been hijacked, please download,
    update and run Spybot, AdAware, CWShredder at minimum.
     
    Jim Berwick, Jun 27, 2004
    #6
  7. Quiz Time

    Brian Guest

    have you read this?
    http://securityresponse.symantec.com/avcenter/venc/data/trojan.poldo.b.html
    or this?
    http://www.sophos.com/support/disinfection/trojan.html
     
    Brian, Jun 27, 2004
    #7
  8. Quiz Time

    Brian Guest

    Brian, Jun 27, 2004
    #8
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.