Little-Miss Posted January 28, 2010 Posted January 28, 2010 Oh look! A technical question!! A while back i posted that i'd had a virus which had been cleaned up, but i had been left with a little bit of mess afterwards. The only thing that people could suggest to do was reimage the machines. I hadnt got round to that yet as it was just a few annoying pop-ups on logon which didnt affect anything. But over this time ive noticed a trend, it actually seems to be user related not machine related. I imaged a laptop yesterday and as soon as i logged the user on there they were! (she was one that was originally affected). Is there something i can do about this, i tried deleting the roaming profile and the profile off a machine but it didnt work. But i may have done this in the wrong order etc.... Any ideas? I have screen grabs of errors, just got to gt them on here... 1
Domino Posted January 28, 2010 Posted January 28, 2010 I'd also be concerned that maybe whatever's infected you is still hanging around infecting other machines... what virus is it? got a name from any of the AV vendors? 1
Little-Miss Posted January 28, 2010 Author Posted January 28, 2010 W32/Lurka-A It seemed to be on peoples Memory sticks. I get emails from our sophos telling me its found it and deleted it but dont get any anymore. Will check this out again then. but why only certain profiles?
p858snake Posted January 28, 2010 Posted January 28, 2010 Did you delete all instances of the profile? server and locally? 1
pwds Posted January 28, 2010 Posted January 28, 2010 So I don't spend hours hunting through your seven hundred odd posts for the error- can you point me towards that thread? Error messages when logging on on all profiles is something I just dealt with and might be able to solve for you if it's what I'm thinking of- likewise these didn't actually cause any issues, just concerns for users.
Little-Miss Posted January 28, 2010 Author Posted January 28, 2010 i'm sure i did, but shall try it again....
AngryTechnician Posted January 28, 2010 Posted January 28, 2010 Do you have redirected Application Data directories that are stored outside of the roaming profiles?
Little-Miss Posted January 28, 2010 Author Posted January 28, 2010 Excuse my ignorance....EH!? I think the answer is no. lol Inside the individual profile folders there is an application data folder, but thats not what you asked
Little-Miss Posted January 28, 2010 Author Posted January 28, 2010 So I don't spend hours hunting through your seven hundred odd posts for the error- can you point me towards that thread? Error messages when logging on on all profiles is something I just dealt with and might be able to solve for you if it's what I'm thinking of- likewise these didn't actually cause any issues, just concerns for users. http://www.edugeek.net/forums/windows/46051-errors-leftover-virus-removal.html My errors are as follows! Windows cannot find 'C:\windows\inf\other.exe' make sure you typed the name correctly and then try again...... Windows cannot find 'C:\windows\system32\winsit.exe' make sure you typed the name correctly and then try again...... could not load or run 'C:\windows\inf\other.exe' specified in the registry. make sure the files exist on your computer or remove the reference to it from the registry Windows cannot find 'C:\windows\system32\config\win.exe' make sure you typed the name correctly and then try again...... could not load or run 'C:\windows\system32\config\win.exe' specified in the registry. make sure the files exist on your computer or remove the reference to it from the registry I did check the registry but shall try again as i havent dealt with this for a few weeks so cant really remember.
LosOjos Posted January 28, 2010 Posted January 28, 2010 Can't you just delete them from startup in msconfig? Or maybe even the 'Start Menu -> Startup' folder as it seems to be user related. Or am I missing the point?
pwds Posted January 28, 2010 Posted January 28, 2010 The paths are different but the error messages extremely similar to one I dealt with yesterday- in that case it was a WSUS install of IE7 that hadn't completed correctly. Add-ons were also disabled when running from the embedded desktop icon (although not a shortcut to %ProgramFiles%\Internet Explorer\iexplore.exe). Re-installing IE7 manually resolved the issue. I also updated Windows Update Agent manually at the same time, so it's possible that helped- although I am leaning towards IE as the fix. Might be worth looking at software versions on machines that are affected, obviously IE is a prime candidate to start with but anything deployed by WSUS, requiring a restart and used before the restart may well be corrupt. 1
OutToLunch Posted January 28, 2010 Posted January 28, 2010 Grab a copy of Starter - CodeStuff :: Starter - and work out where they are lurking first, then try and trace it back to figure out what's still adding that to the profile. 1
Little-Miss Posted January 28, 2010 Author Posted January 28, 2010 Can't you just delete them from startup in msconfig? Or maybe even the 'Start Menu -> Startup' folder as it seems to be user related. Or am I missing the point? well no, that didnt cross my mind....i do apologise...
LosOjos Posted January 28, 2010 Posted January 28, 2010 well no, that didnt cross my mind....i do apologise... Not sure if that was directed at me or not, if it was, then apologies for coming across as un-friendly, it wasn't my intention 1
Michael Posted January 28, 2010 Posted January 28, 2010 What I would advise you do is create a new profile for people on the server, but name it jbloggs1 or jbloggs2 for example, make it unique. I suspect users are logging onto infected workstations, then the cached bad profile is being re-uploaded back to the server. Hope this makes sense. I would then proceed and re-image workstations in batches where possible. You're sure to get better results. 1
Little-Miss Posted January 28, 2010 Author Posted January 28, 2010 Not sure if that was directed at me or not, if it was, then apologies for coming across as un-friendly, it wasn't my intention I'm sorry, i misread your tone! lol Sorry...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now