Problem after spyware removal...

[The Computer Valet]

Hi folks,

I have performed dozens of spyware removal procedures. I don't do anything fancy or out of the ordinary, I don't think.

Exactly three spyware removals, however, have not gone well. I hoped that some folks here might be able to give me an idea as to what I'm doing wrong, if anything.

Basically, I see that something is amiss at some point during the removal. Either Windows File Protection launches or processes like Explorer crash. I may not be able to to shut down, either.

When I restart, I find the system racked. What do I mean by that? I find that essential system files are simply gone -- files like hal.dll, agp.sys, etc. The system can't boot at all, of course.

I have thought about those three incidents looking for common events. As far as I know, they are as follows:

They had up-to-date virus protection.
The systems were EXTREMELY over-run with spyware.
Two of the systems were Dell systems.

Another thing I may have done -- but I am nearly 100% sure I've done it on other XP systems with no effect -- is I manually deleted spyware items out of the System32 folder. FWIW, I know what I am deleting -- things like ezula items, for instance.

But that last item is the only thing I can think of that I do that would cause some sort of catastrophic failure.

Can anyone see something wrong in here? Or has anyone else experienced this?

Second Question: Related

I am right in the middle of trying to repair-install XP on this latest spyware-removal system. The main problem right now is that when the system needs keyboard or mouse input, none of the devices work. I can't type or mouse. I've switched from a PS/2 keyboard to a USB keyboard. At some point during hardware installation, the keyboard (and mouse) stops functioning. Yuck.

Help me, Obi Wans, you're my last hope before I call the customer and sing, "F-Disk, Fortmat, Reinstall, Doo-Dah Doo-Dah."

[geoscomp]

What programs are you using to do your spyware removal?

[The Computer Valet]

What programs are you using to do your spyware removal?

Typical stuff...

HiJackThis
CWShredder
Spybot
Adaware
Housecall (Online scanner from Trend Micro)
TheKillBox, if necessary.
SPJHFix, if necessary

That's it. The only regulars are HJT, CWS, Spybot, Adaware, Housecall.

[arch0nmyc0n]

Just a question, did you check to see whether or not adaware or others found viruses? I 've seen adaware pick up the odd virus or two... I suppose I should add if it was up to date virus protection then a lot of the spyware programs would have been picked up as viruses...

[The Computer Valet]

Just a question, did you check to see whether or not adaware or others found viruses? I 've seen adaware pick up the odd virus or two... I suppose I should add if it was up to date virus protection then a lot of the spyware programs would have been picked up as viruses...

Well, TrendMicro would have detected it even if Norton didn't. In this particular instance, Norton wasn't detecting anything other than a trojan. The name I can't quite recall, but it was one I've seen many times before on other systems.

Anyway, there were no "viruses," but there were trojans. By Trojans, of course, I mean spyware/adware/etc.

m

[InTheWayBoy]

I don't have any evidence as to what or why, but similar situations have popped up before for me. I clean at least two spyware PC's every day, and I only alter my process when it's critical to. But just like you're mentioned, every now and then I get a bunk system after a heavy clean. I know there is a variant of CoolWeb that actually 'melts' itself into the Windows Media Player executable, and have often wondered if they went any further. Best action in a case like this I've found is to backup data and format and reinstall. Sucks I know...but you'll see after wasting five hours trying to fix it instead of reloading. I have a feeling that the suspect files are located somewhere in the Documents and Settings folder...you could try renaming that folder to something else...but then you wouldn't be able to do the repair install...