XP Home and IE problem

[Nocturnal]

Any idea what this might be? I had a computer infested with WinFixer and Aurora and many other spyware. I cleaned them out, had them all out, then when I booted into regular mode from safe mode I experienced an error saying ?Internet Explorer has encountered and error and must close.? In Event Viewer there was a notice within the application area. It said that gcdmedia.exe had caused a fault in ?.? And then the addresses of whatever. Now there was nothing in the startup and I even used System Internal?s Process Manager and could not find the specified .exe. I checked the registry and searched it for gcdmedia.exe and found one notice and deleted it. I?m at a lost, right now I?m just reinstalling Windows but I?d like to know why this was happening and how it was happening since there was no gcdmedia.exe file on the computer and it was causing IE to error out constantly.

 

[John]

You were most likely still infected. Aurora is a PITA to remove and causes me grief on occasion.

I use MyPCUninstaller (ABetterInternet tool) and FixBinet (Symantec) in safe mode w/ system restore disabled to remove the Aurora crapware.

Now the big question is how you got the crap on your system to begin with. Does anyone else use your computer?

 

[Nocturnal]

I fix computers for a living so this isn't my unit. This is for a client. I found out the issue at hand however it lead to another thing.

Basically there are two admin accounts on this computer. The account I kept logging onto kept getting that IE error. I searched the computer and could not find the offending file. Suddenly Dr Watson gave me an error in Event Viewer and it said that this directory and this particular file is the one that is giving you a problem. I opened up My Computer, went to Program Files, nothing. I said hmmmmmmmm, let me go ahead and log onto the other account. Sure enough, with that account I could see the file directory that I wasn't able to find with the other account I was logged on to. However, I deleted those files and directories but now I can only boot into safe mode, I can't boot into regular mode. I'm doing a chkdsk as we speak.

 

[John]

chkdsk /r I hope.

Do you get a stop error when booting to normal mode? Have you tried disabling all non-MS services and startup entries? Pull all of the expansion cards out and see if you can get into normal mode.

If that doesn't work try a repair install.

 

[Kernel32]

FYI, there are about a million posts if you search google for "aurora spyware"

i believe you'll also be able to track down an aurora removal tool. i had same thing and the tool fixed it.

 

[Nocturnal]

John, I don't even see a blue screen prior to it restarting. I even attemped an overlay again and what happend was it removed all the files, restored all the files and then when it was about to start the GUI portion of the overlay it just restarts at the Windows XP splash screen all over again. This is driving me bananas. Also, Kernel32, I don't give a damn if there are a million posts about Aurora. This post wasn't about Aurora in general. It was about another spyware that was hiding... it was a dumb user error on my part as I didn't check to see if it was listed under another user account. Anyway, that's besides the point now. I'm having a hell of a hard time trying to get this computer back together without having to format the unit.

 

[John]

Did a repair install allow you to boot to normal mode? BTW are you using SP2 slipstreamed discs?

 

[Nocturnal]

Actually the repair install didn't work lol. I'm using a disc with SP2 slipstreamed. Like I said I attempted to do a repair install and you know how it gets through the text portion of the install. It tells you its going to reboot and then it restarts with the GUI portion of the installation. Well right before it gets to the GUI portion it just reboots continuously. I posted on a NG and someone said it's probably a virus. I'm going to remove the hard drive from the system and I'm going to scan it from another computer today. I'll post back with what happens. Hopefully someone comes across this post and can get some useful info out of it.

 

[John]

See if you can complete a full pass of Memtest86+

 

[Nocturnal]

I'm already backing up the data and going to do a complete reinstallation of the system.