STICKY TROZAN..

[RDG]

Hello,
How to kill "mdm.exe" in the Task Manager??
(how to open the task manager??)
I've "svchost.exe" loading in the Startup folder
automatically..Though it doesn't shows up in
MSConfig..I've tried to remove/delete it manually from the
startup folder, but still it reappears on
rebooting..Please suggest How to remove it from there
parmanently??

Thanks in advance..

[Noel Paton]

You may have a virus/spyware hijack

download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://download.nai.com/products/mcafee-avert/stinger.exe

- update your virus scanner and run a full system scan of all files.

Reboot to Safe Mode and run CWShredder - to remove variants of the
CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Use CWShredder, the removal tool:
http://www.merijn.org/files/cwshredder.zip
http://www.merijn.org/files/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe
http://www.zerosrealm.com/downloads/CWShredder.zip

download AdAware from www.lavasoftusa.com, install, update, and run it to
remove spyware, adware,
and other such nasties from your system.

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"RDG" <anon...@discussions.microsoft.com> wrote in message
news:0c1b01c47b22$ec31d5d0$a301...@phx.gbl...

[Mike M]

MDM = Microsoft Debug Manager

If you don't need MDM to debug script problems then I would recommend a)
killing mdm.exe in the Task Manager, b) removing mdm.exe from Startup in
MSConfig, c) in Internet Explorer, go Tools | Internet Options | Advanced and
make certain that "Disable script debugging" is checked in the "Browsing"
section, and d) renaming mdm.exe to something like mdm.old. This can be a
pretty persistent little program and unless one renames the file you will find
it added to startup again behind your back - for example when adding a service
pack to O2K.

One you have killed mdm you can delete all the fff??????{?????}.tmp files it
will have created in your ..\windows folder.

See also MS KB 221438 - "OFF2000: Files Whose Name Begins with "fff" Appear in
Windows Folder" (http://support.microsoft.com?kbid=221438).

I'm not clear why you have cross posted between Win Me and XP. Was there a
reason? What operating system are you running? If you are running XP
svchost.exe is a valid system service although there is at least one trojan
using a file of the same name and placing it in the windows\system folder
(rather than windows\system32).
--
Mike Maltby
mcma...@hotmail.com

[David H. Lipman]

You cross posted to WinME and WinXP.

One of the two News Groups is Off Topic to the post.

Now WHICH OS are you using !

In the mean time...

Please go to one or more of the below online scanners and perform a scan of your platform
then report back your results.

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

Symantec:
http://security.symantec.com/

BitDefender
http://www.bitdefender.com/scan/license.php

Dave

"RDG" <anon...@discussions.microsoft.com> wrote in message
news:0c1b01c47b22$ec31d5d0$a301...@phx.gbl...

[Kelly]

Which trojan?

mdm.exe is a part of Office.

Process File: mdm or mdm.exe
Process Name: Machine Debug Manager
Description: Machine Debug Manager is used for debugging applications by
technically advanced users and developers and is installed by the Microsoft
Script Editor that is included in Microsoft Office.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

To disable:

Right click the My Computer Icon/Properties/Advanced/Startup and
Recovery/Settings/Write debugging information/None. Or
Start/Run/Msconfig/Services/Uncheck Machine Debug Manager.

You may also want to check your settings here:

IE/Tools/Internet Options/Advanced/Disable Script Debugging and Display a
notification about every script error.

Disable the Script Debugger in IE (Line 142)
http://www.kellys-korner-xp.com/xp_tweaks.htm

How to Troubleshoot Script Errors in Internet Explorer
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q181698&

Task Manager: Right click under the clock/Task Manager or Ctrl/Alt/Delete.
Once there, end the process on mdm.exe. To prevent it from running again,
simply rename it.

Added info:

To clean msconfig:

Check for an option to not having the icon load in the System Tray via the
program(s) in question.

Other options for removal:

Go to Start/Run and type in: msconfig. Go to the Startup Tab and uncheck
accordingly. Then run this script to remove the disabled items from the
registry.

Clear Disabled Items from Msconfig Startup (Line 148)
http://www.kellys-korner-xp.com/xp_tweaks.htm

Or...remove the runkeys from here: Start/Run/Regedit

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Troubleshooting, Removing and/or Cleaning Add or Remove Programs
http://www.kellys-korner-xp.com/xp_a.htm#addremove

Troubleshooting the Notification Area
http://www.kellys-korner-xp.com/xp_n.htm#na

--
All the Best,
Kelly

Microsoft-MVP Windows® XP
2004 Windows MVP "Winny" Award

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
http://www.kellys-korner-xp.com/xp_tweaks.htm

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

"RDG" <anon...@discussions.microsoft.com> wrote in message
news:0c1b01c47b22$ec31d5d0$a301...@phx.gbl...