| Forum |
|
|||||||
| Software Q&A Having trouble with software? Find solutions here |
![]() |
|
|
LinkBack | Thread Tools | Display Modes |
|
|
#1 (permalink) |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher |
|
|
| Advertisements. Register and be a member of the community to get rid of them. | |
|
Advertisement
|
|
|
|
#2 (permalink) |
|
In The Zone
Join Date: Sep 2006
Posts: 319
|
Try finding the program in the process bar and close it and delete it.Sheddrers can also do it.
__________________
Visit now www.indiandevs.com - for great free designs www.indiandevs.com/technoworld/ for latest technology news and tricks |
|
|
|
|
#3 (permalink) |
|
Human Spambot
Join Date: Apr 2006
Location: Pune, India
Posts: 2,501
|
Post the HijackThis Log report here.
__________________
Kiran Kumar R |
|
|
|
|
#6 (permalink) |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
@Siddarth- Shredder didn't work. Tried it. @sakumar-Haven't tried out with Safe Mode yet. Will be installing Nod32 and trying out. Will be posting the HijackThis log as well.
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher |
|
|
|
|
#7 (permalink) |
|
Security Exp
Join Date: Apr 2006
Posts: 733
|
To remove this adware program using its uninstall option, do the following:
source SAVENOW
__________________
We Love Once, And When We do We do it Well |
|
|
|
|
#8 (permalink) |
|
Distinguished Member
Join Date: Mar 2005
Location: Pune
Posts: 3,783
|
^ i dont think savenow crfeates slow.exe !? i think its the adware.lop process, but since u know the location of the file, download and use 'delete doctor' from www.diskcleaners.con to delete the malware. then make sure u run ccleaner or something like that. and ya a hjt logfile wud help.
__________________
> www.TheWindowsClub.com < = www.WinVistaClub.com = Microsoft® MVP |
|
|
|
|
#9 (permalink) | |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
Here is my log file:
Quote:
EDIT: CCleaner is not doing such a great job of cleaning up the files. I see from this log that XDrive contents still reside. I'll try with other cleaners. Let's see. Now, NOD32 also didn't detect the malware
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher Last edited by phreak0ut; 14-02-2007 at 11:10 PM. |
|
|
|
|
|
#10 (permalink) |
|
Distinguished Member
Join Date: Mar 2005
Location: Pune
Posts: 3,783
|
dont forget to use delete doctor.
among cleaners, i prefer and use 'ace utilities' and 'tune-up utilities'. logfile appears clean. xcpt that ur ie start page appears to have been hijacked. u can also always get it auto-analysed in detail at www.hijackthis.de btw, does easy eye saver really help, sunil ?
__________________
> www.TheWindowsClub.com < = www.WinVistaClub.com = Microsoft® MVP |
|
|
|
|
#11 (permalink) |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
I used Delete Doctor just now, but it is refusing to get deleted. I've scheduled to remove it on the next system startup. Hopefully it should. I use Tune up utilites as well. Very nice application.
Yes, Easy eye saver are for people who keep staring at the monitor for a loooong time. Every 20 minutes, the monitor goes into standby for a minute and plays soothing sounds.
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher |
|
|
|
|
#13 (permalink) |
|
Human Spambot
Join Date: Apr 2006
Location: Pune, India
Posts: 2,501
|
I don't see any problems in the log report.
Love slow.exe should be located in: C:\Documents and Settings\CLÉMENCE\Application Data\MPEGFR~1\Love Slow.exe Reboot in safe mode and try deleting it.
__________________
Kiran Kumar R |
|
|
|
|
#14 (permalink) | |
|
Security Exp
Join Date: Apr 2006
Posts: 733
|
Quote:
Here is yet another effective solution and free too download moveonboot: It's free and this simple tool allows you to Move, Copy or Delete files before Windows can lock or alter the files. The changes are made to your hard drive before Windows starts, hence it requires a restart of your system after you give MoveOnBoot its instructions. There are no messy boot or DOS commands, just a simple 3-step process. Step 1: Locate the name of the file that is causing your problems. Step 2: Decide if you want to copy, move or delete the file. Step 3. Choose a destination for moving the file, or a new file name for the rename option (this option won't appear if you are deleting a file). Click OK to confirm you want to process. The nice thing is that the program doesn't make you reboot straight away. It's a good idea to reboot ASAP, but if you are in the middle of something and want to wait, the program will simply run next time you start Windows
__________________
We Love Once, And When We do We do it Well |
|
|
|
|
|
#15 (permalink) |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
@anand The doctor didn't do the job. He forgot I guess
@Kiran Actually, the file is located at C:\Documents and Settings\All Users\Application Data\Grim 2 debug cdrom\love slow.exe @Shailesh I've scheduled for the deletion. I still haven't tried out in Safe Mode
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher |
|
|
|
|
#16 (permalink) | |
|
Human Spambot
Join Date: Apr 2006
Location: Pune, India
Posts: 2,501
|
Quote:
Log-in in "safe mode" and try deleting it.
__________________
Kiran Kumar R |
|
|
|
|
|
#17 (permalink) |
|
Distinguished Member
Join Date: Mar 2005
Location: Pune
Posts: 3,783
|
i m surprised deletedoctor failed to delete the file on system restart
disable system restore and try again. else try 'killbox' ...
__________________
> www.TheWindowsClub.com < = www.WinVistaClub.com = Microsoft® MVP |
|
|
|
|
#18 (permalink) |
|
In The Zone
Join Date: Aug 2006
Location: Delhi
Posts: 229
|
It's quite unlikely that the doctor forgot to do his job. The doctor is very particular. Maybe the spyware has more copies which replaced. I remember having a virus similar to your spyware. Try and search for more files which resemble the spyware file.
Or just open your processes tab in Windows Task Manager. If your a regualr process viewer, you might as well know the processes that usually run. If you spot a process with an unusual name (for eg - loveslow.exe), note it's name, search for it and delete it. Also goto run, type msconfig. In the startup tab, usually you should have your antivirus process and a few more usual processes. If over there you notice a program which you haven't installed, or you don't want to be loaded at startup, remove the check from it, and press OK.
__________________
http://apoorvkhatreja.blogspot.com |
|
|
|
|
#19 (permalink) |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
@kiran Yes, it is according to the user profile. In my case, it was in the location which I mentioned.
@anand, @apoorv Even I was surprised that the doctor didn't do his job. Sometimes few stuff is beyond his control I guess @shailesh I tried out MoveOnBoot which you suggested and it worked like a charm!!
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher |
|
|
|
|
#21 (permalink) |
|
The Thread Killer >:)
Join Date: Apr 2006
Location: Bangalore
Posts: 1,182
|
Nope! I would have tried out in Safe Mode if MoveOnBoot hadn't done the job. I'm glad the problem is resolved
__________________
Want to make this world a better place? Then, start seeding and don't be just a leecher |
|
|
![]() |
| Bookmarks |
| Thread Tools | |
| Display Modes | |
|
|