[jnathan]

Today afterconnecting a thumb drive with this PC, the AV showed and cleaned the backdoor Trojan.
But now a message appears just after the welcome screen and want me to click ok every time I log in to XP.
Whats this "is-B0DS7.exe" image attached. How can I remove this message?

Attached File(s)

•  is_B0DS7_dot_exe.JPG (80.5K)
  Number of downloads: 14

[Sp0iLedBrAt]

Just open msconfig through Start->Run and find the process in the Startup or Services tab. Then untick it and it should solve the problem.

You could also open Regedit through Start->Run and find the process name and delete it, but only if you know what you're doing. A back-up is also recommended.

[jnathan]

Can you locate me the exact entry where its situated in msconfig? I dont seem to find it exactly.
there is no such entry inside msconfig. Any other way? O googled, No result. Strange !!!

[Tripredacus]

You didn't get a result likely because the filename is "randomly" generated. There are two ways to find the program that is starting:

1. MSCONFIG on the Startup Tab.
2. In the Registry "Run"

If you are not comfortable with editing the registry, you can use CCleaner. On the Startup section, it not only shows you things from the Startup Folder, it can also show things that do not appear in MSCONFIG.

[submix8c]

Also, you could download and install SpybotSnD, switch to Advanced Mode, and look at Startup Items. You can disable, delete any extras/unwanted there - suggest disable and see if adverse affects or re-appears. Be aware that it does similar to CCleaner but in a different way, i.e. SpyBot simply "disables" and/or "deletes", whereas CCleaner should backup the entry prior to deletion giving the ability to "reload". Same principle, different method. CCleaner is smaller and does not scan for Spyware, etc.

Look them up to see what is featured and decide... Hope you didn't contract more; I had a recent "drive-by" and had a booger of a time eradicating it.

(should be moved to "malware" section?)

This post has been edited by submix8c: 15 December 2009 - 01:25 PM

[jnathan]

It worked ! Thanks all. I unchecked the entry from Spybot S&D and its working.