AdDestroyer in Windows\pss and Windows\Prefetch

Delete the pss folder and the .exe file in Safe Mode, empty recycle bin immediately. Post a new log.

C:\Windows\pss\AdDestroyer.InkStartup

C:\Windows\Prefetch\ADDESTROYER.EXE-3A0389FE

All the best,

Texruss
www.russelltexas.com
Spyware Fighter Wilders Forum
Slyware Warrior Tom Coyote Forum
Expert Malware Responder Dell Forum

Please be aware only the following DellForum members were trained at
TomCoyote.com and SpywareInfo.com to help with Hijackthis logs: Texruss,
Baskar1234, Grinler, ChrisRLG, SpotCheckBilly, and pskelley. (If you are
one of our classmates and not on this list email me for an addition to this
list...we need all the help we can get *;-)
 

I deleted the files and got rid of the entry in the Startup by changing back to Normal Startup and restarting. AdDestroyer was unchecked in the Selective Startup because I did not want it to run. The two files did not show up in the Hijackthis log but I found them by using the Windows Search and AdDestroyer for word.

I cannot post Hijackthis log because I returned computer to friend. I am glad to get rid of it because I have neglected other things this week.

Please tell me why it is so important to be in Safe mode when deleting the exe files? I was not always in Safe mode while deleting files.

I thank you for your help.

Susan

Pastel Artist

volunteer webmaster for www.easternshoreartcenter.com, www.bragart.org

 

>Please tell me why it is so important to be in Safe mode when deleting the exe files? I was not always in Safe mode while deleting files.

Just a good habit to get into...many hostile files won't load in Safe Mode and they can be deleted easier. Plus it's a good idea to teach people here how to enable Safe Mode as it is a skill few people are aware of until they need it when requested by a technician. Certainly many of the files I advise for deletion can be deleted in regular mode, but it's virtually a cinch in Safe Mode.

Enabling Hidden Files option is important because many virus writers automatically give a hidden attribute to their payload. They also like to do a Read Only attribute and in some cases the user must right click on the file, left on Properties and remove the checkmark for Read Only in order to delete it.

All the best,

Texruss