Dave, have you looked in Services.msc? An abbreviated version of my earlier
post is below:
This is the procedure I used, to deal with the mysterious and onerous delete
flag issue that persistently disables Windows AutoUpdates and Norton
AutoProtect.
Please judge for yourself whether you are comfortable with these operations
through the registry edit. If not, simply disabling the service in
Services-while incomplete- may be enough to get Windows AutoUpdate or
Norton’s AutoProtect running again.
This Trojan can be located in the Windows XP operating system services list
Start> Run> Services.msc
Scroll down the list and look for Network Client
Right click on the Network Client Service and select properties from the
fly-out menu
In the startup field select Disabled (if it is affecting your system it is
probably set to Automatic)
On the General Tab of the properties page locate the path to the executable
The executable file is not necessarily netclnt.exe it may be something
different
On the machine I was working on, the executable was winlongon.exe in the
System folder. Be careful here, there is a legitimate winlogon.exe file in
the in the System32 folder.
Once you have the path you can locate the executable with Search or
Explorer—keeping the above caution about legit files with similar or same
names in mind.
Disabling the service keeps the service from running. Deleteing the
executable kills it—at least in this instance
Removing the service requires hacking the registry
Backup registry or branch and exercise usual cautions e.g. take your time
Navagate to: HKLM> System>CurrentControlSet> Services>Nwclntf
If you don’t see nwclntf you may have to do some sleuthing--the final
letter of Nwclnt maybe F, G or something else, but under the Name column
look for: Display Name and in the Data column look for: Network Client
Delete the key
Paul
|
Similar Threads
Linear Mode
