System Restore For Spyware?

Question

One of my kids went on a site that she shouldn't have yesterday and we now have some spyware that is causing pop-ups even when we are not running IE7.  Pest Patrol identified them and seemed to delete them but it looks like we still have them.  The ones that are identified are Tagasaurus, Tagasaurus B, YourEnhancement and Abetear A.  We also have a LDCORE.DLL file that I am trying to clean.  Would restoring the system to a restore point before yesterday get rid of these out of the registry?  Or will I need to clean these manually since it doesn't seem that the combination of Pest Patrol and my McAfee Security Suite is controlling these?   Thank you in advance!! Bruce   Dell Dimension 9100 Windows XP Media Center Edition

1972vet · Answer

Message Edited by 1972vet on 02-28-2008 09:45 PM

Rebel9 · Answer

You can try a System Restore, but often these spyware/malware 'applications' have been captured by restore points. A common procedure when cleaning an infected system is to first delete any restore points and then perform a manual cleaning. Try a restore and see what happens.

bvasel · Answer

Thank you very much for the replies.  I did not try the System Restore.  Instead I ran a HijackThis log and posted it to the HijackThis forum.  Any assistance is greatly appreciated!!!   Is there any danger in copying files to an external hard drive at this point?  I'm not sure if these are viruses as well as Adware and Downloaders.  I want to save photos and data files.   I appreciate your repsonses!!   Thanks, Bruce

Bugbatter · Answer

[post deleted] Message Edited by Bugbatter on 12-11-2007 08:05 PM

peasant79 · Answer

Thank you for posting this.  I am having the same problem with ldcore.dll, but worse because I can't use the HijackThis because I can't even run IE.  I have pretty rudimentary computer skills, but can follow directions if someone can help.  Thanks tons.

Bugbatter · Answer

Your log is being processed. I've asked you about a few preliminaries, and look forward to your reply in that thread on the other forum.

Before you copy files, let's wait until we get another diagnostic log so we know the extent of the malware.

1972vet · Answer

Message Edited by 1972vet on 02-28-2008 09:44 PM

Bugbatter · Answer

Can you describe the problem you are having with HijackThis?

peasant79 · Answer

Sorry; I should have been more clear.  The problem is on my other computer, an Inspiron running XP SP2, which is now pretty much disabled.  If I start it in normal mode, I can't run any applications.  When I check in task manager (which takes about five minutes to come up) something, maybe the McAfee, is using almost all of the cpu.  I can start it in safe mode, but don't know what to do from there.  Thanks for your help.

1972vet · Answer

Message Edited by 1972vet on 02-20-2008 04:19 PM

peasant79 · Answer

Thank you so much for the detailed instructions.  I will try this now and will check back with you.  I appreciate your time on this.

peasant79 · Answer

Despite the excellent and clear instructions, a couple of problems executing.  When the files copied to the CD-RW, they were read-only.  Quickly checking on Microsoft's website, seems this is a problem with IE that I have to go into regedit to fix?  But beyond that, I can't get the McAfee to run on the affected computer, so as to disable the anti-virus.  Sigh.  Is this where I should just give up and bring this to a pro to fix?  Thanks again for your help.

Virus & Spyware

Was this post helpful?