Reply to thread

Message

<blockquote data-quote="sumone" data-source="post: 2261809" data-attributes="member: 551481">Man, I feel the same way...people give up too easily, or maybe I just like to fight.So what do you do when your forwarded to a good **** site? //content.invisioncic.com/y282845/emoticons/wink.gif.608e3ea05f1a9f98611af0861652f8fb.gifSeriously though, lock your system down. Disable all internet (unplug the ethernet). But before you do that, go to sysinternals.com &amp;amp; download <a href="http://www.sysinternals.com/Utilities/ProcessExplorer.html" target="_blank">ProcessExplorer</a>. Kill anything that looks suspicious or non-OS-critical.Nod32 is my anti-virus program of choice.Check the Event Viewer (cpl panel, administrative, event viewer) to see how they were started (what other process spawned it, etc...)...I think that&#039;s the security log.Safe mode as mentioned.Uninstall any crap you don&#039;t need (the normal cpl panel way). Run services.msc &amp;amp; disable anything else (services-wise) you don&#039;t need (set startup type to disabled).After you&#039;ve done that, delete suspicious files (the ones pwnt_by_pat mentioned).Make sure System Restore is disabled completely (I have the service disabled).netstat /a (after running cmd) &amp;amp; see what ports are in a listening state...use process explorer&#039;s tcp/ip tab for each process to see which process is the culprit.</blockquote>

[QUOTE="sumone, post: 2261809, member: 551481"] Man, I feel the same way...people give up too easily, or maybe I just like to fight. So what do you do when your forwarded to a good **** site? [IMG]//content.invisioncic.com/y282845/emoticons/wink.gif.608e3ea05f1a9f98611af0861652f8fb.gif[/IMG] Seriously though, lock your system down. Disable all internet (unplug the ethernet). But before you do that, go to sysinternals.com & download [URL="http://www.sysinternals.com/Utilities/ProcessExplorer.html"]ProcessExplorer[/URL]. Kill anything that looks suspicious or non-OS-critical. Nod32 is my anti-virus program of choice. Check the Event Viewer (cpl panel, administrative, event viewer) to see how they were started (what other process spawned it, etc...)...I think that's the security log. Safe mode as mentioned. Uninstall any crap you don't need (the normal cpl panel way). Run services.msc & disable anything else (services-wise) you don't need (set startup type to disabled). After you've done that, delete suspicious files (the ones pwnt_by_pat mentioned). Make sure System Restore is disabled completely (I have the service disabled). netstat /a (after running cmd) & see what ports are in a listening state...use process explorer's tcp/ip tab for each process to see which process is the culprit. [/QUOTE]

Verification