Thanks - not sure why my method didn't work, but it looks like your way has done the trick. I will try to download it later as the forum isn't playing nicely for me at the moment. (I see 3 others have taken a look at that file, though).

I've decided I don't want to be a parrot after all. Mating on the bristles of a brush is not one of my chief desires in life, no matter how soft they are!

What an unusual file that is!
Finally managed to reformat so I could read it. That raised another question which I will get to later.

There's not so much cleaning up to do as I thought there was. Henry will be pleased! Just to make sure, it would help if you could do your thing with the following 3 commands:

dir c:\*norton* /s > c:\N.txt

dir c:\*symantec* /s > c:\S.txt

dir c:\*liveupdate* /s > c:\L.txt

As before, click Start, Run, type cmd in the text box and click OK to open the Command Window. Copy the first command above, go back to the Command Window, right click next to the flashing cursor and select Paste, then press Enter.

When you see the 'C:\Documents and Settings\username>' line pop back, do the same with the second command, then the same with the third.

Type exit and press Enter to close the Command Window.

Attach the 3 files created to your post. They will be found in C: and named N.txt, S.txt and L.txt
If you can't attach all 3 to the same post then just make 3 separate posts.

I can then be sure there's nothing left that needs removing.

Bet you never got this much homework at school!

Thanks for those logs, they are fine. I will add them to the other logs we got to check through. I understood most of the Symantec log but there is a reference to an unusual file that I need to get checked out after cleaning up.

Yes, but I couldn't eat a whole one.
Seriously (now there's a first for me!) we both like all animals and birds. We go to farm parks and safari parks quite often. If that's not an option then we go to a lake or the local canal and feed the birds there. We once went without bread but had a packet of crisps to use up. We almost got away with that until one goose started running up and down, honking at the top of his voice, with large pieces of crisp stuck to his beak. We left quietly ...

Well, that's a rather personal question and I certainly won't be posting any photos


I use the Windows Character Map (Start, All Programs, Accessories, System Tools). Double click on the character required, click Copy then paste in to my reply. You can also get it if you hold the Alt key down, type 0233 on the keypad (not the numbers along the top) and release the Alt key. Or press the right Alt key and 'e'. I can never remember the last 2 though, so I stick with Character Map. There's a list of the codes here - handy if you need it.

I'll get back on the cleaning up and then have a Bank Holiday.
Happy Holiday to you and your friends!

_________________
Never stop learning

Update:

I removed the attachments from your previous post after I downloaded them. They contained personal details (email headers and so on) that, whilst not harmful, don't need to be posted in public. (These entries related to the Anti-Spam module in Norton, something I didn't consider).

When we have finished I will erase them from my machine also.

Well this ought to be quick!

Open My Computer and navigate to C:\Documents and Settings\All Users\Application Data\Symantec. Right click on the folder named ZZLiveUpdate (this is the temporary backup we made), keep the left Shift key pressed down and select Delete in the right click menu. Answer Yes to confirm deletion. This should bypass the Recycle Bin - there are over 5MB of files in there and there is no point filling the trash can up.

One other thing you could do when you have a minute would be to do a search - either from the Command Window as we did before or else using the normal Windows Search (Start, Find Files, All Files) - for thcqbsjq*

That is the file I was concerned about earlier as it looks like a filename produced by malware. It may be nothing serious but if you find it, let me know the location. Then navigate to the file in My Computer, copy it (right click, Copy, right click on a blank bit of the window, Paste). Change the file extension from exe to txt (right click the copy and select Rename) and attach it to your post.

Hiya Mister2,
Thanks for removing my attachments. It's funny as I was only thinking to myself the other day that I hope there is nothing private or whatever in any attachments I do.

Yep that was quick. I didn't blink in case I missed it Deleted ZZLiveUpdate ........ felt good to get rid of it. That was brilliant how it didn't go into my trash can. Another good tip you have given me Thanks a lot.

I have done a search, several in fact, both ways but I can't find it. In the cmd thingy it automatically comes up with

c:\Documents and Settings\The Owner>

I just typed in thcqbsjq at the end but no joy, it doesn't recognise whatever. Did I do that right ? Hope you understand my technical explanations - thingy and whatever

Do you have the facility to enter my computer by any chance.

Lorraine

Nothing private in the other attachments - I checked.

Glad you like missing the Recycle bin out! It's handy for deleting any large files that would otherwise sit there for ever and a day.

I should have explained the cmd thingy a bit better, it's just one of those things I often use without thinking. You were right to get to the 'c:\Documents and Settings\The Owner>' bit, then type this command:

dir c:\thcqbsjq* /s /p

(or copy it and paste into the Command window) and press Enter.

The '/p' bit at the end is to stop the page scrolling up before you have time to read it - if you get the mesage 'Press any key to continue ...' at the bottom of the window then, well, press a key for the next screenful. I don't think that will happen - I would expect the next thing you see will be the 'c:\Documents and Settings\The Owner>' line again. It's just in case it finds a lot of results.

(In case you were wondering, the '/s' tells the search to dig right down into the folders and subfolders to see what's buried deep inside. That's the bit that matters).

As for entering your computer, I couldn't possibly comment. But I like the parrot in the middle of your screensaver - the one with the blue hat.

(Just kidding - I found a screenshot on the web!)

Thanks! I like the way you use the date in the filename - makes things so much easier

I'll ask someone to pop in and check it over. I think there is an entry in there that doesn't look right, but I will defer to the experts.