theres no Welcome from this nasty!: Motoring Computer Related forum

Computer Related > theres no Welcome from this nasty!	Miscellaneous
Thread Author: devonite	Replies: 8

View Threaded

Thu 1 Jul 10 18:40

theres no Welcome from this nasty! - devonite

Just been tidying a friends PC up, tried several times to explain to her the importance of doing at LEAST a once weekly update and scan, but it just wont "go in"!

Today got a call, she cant get it to boot, so she brought it round, the thing is riddled! - cleaned it all up, got it running fairly nicely - then found a nasty little virus! which was duly killed with Avast.

However, killing this also killed the "Welcome" screen, and results in having to log-in with cntr-alt-del then enter password, which although more secure is a bit of a bind, especially as shes the sole user.

Entered user logon in control panel, and found that "Client for Netware services" is the rogue at fault, and needs to be deleted before the greyed out selection box for the Welcome screen can be used.

Windows reports that the .exe file cannot be found, therefore cant be uninstalled, i`ve disabled it from startup in the services menu, i`ve googled several "cures" including the official solution from Microsoft, but nothing will shift it!

In the end i`ve installed a (nifty) workaround, a little program that automatically enters your password and kicks the os straight through to the desktop without having to wait for you at the cntrl-alt -del prompt.

So this weeks challenge is: Help me get rid of it!!!! Please!!

Reply to this message | Report message

Thu 1 Jul 10 18:49

theres no Welcome from this nasty! - Zero

Have you tried a system restore from an earlier recovery point prior to the event?

Have you tried unbinding netware out of the network stack

What OS is it? If its a home machine whats it doing with netware on board anyway?

Reply to this message | Report message

Thu 1 Jul 10 20:02

theres no Welcome from this nasty! - Tooslow

d, I can't help with the nasty (sorry) but doesn't Tweak UI help manage logon when there's only one user? I know you've got round that, might help next time?

JH

Reply to this message | Report message

Thu 1 Jul 10 22:16

theres no Welcome from this nasty! - RattleandSmoke

Novel Netware is not a rougue problem unless it is infected via a rootkit but it will disable fast user switching. You simply need to stop the service from running and then enable fast user switching and the problem is solved.

I would also run Malware Bytes as there is a good chance Avast will have missed quite a few things.

Reply to this message | Report message

Fri 2 Jul 10 02:10

theres no Welcome from this nasty! - devonite

Hi chaps! - thanks for the suggestions so far!

The general feeling seems to be that if i go into all the network connections and root about in thier properties, csfn should be there, all i have to do is highlite it and select uninstall. However, it simply isnt there! maybe Avast removed the infected .exe file.
There is no Novel software (i`m aware of) on the computer, although the icon for csfn is shown in control panel, although it is dead.Even deleting the folder manually from the C:program files has no effect! bah! The computer was her brothers from work, so it is possible it has had novell services on it in the past, but that would have been deleted when he passed it over about 2 years ago. In services manager csfn does show up, and highliting it shows that it is stopped, i`ve also changed it to disabled on start up, and rebooted, but nothing changes, both the Welcome and fast user tick boxes are greyed and i get the "uninstall" error message.

I`ve run these programs in safe mode (which is how i found the virus - it didnt show in normal mode)
Avast
Malwarebytes
spybot s/d
system mechanic
OS is Xp Media centre edition.

ps
at least she says shes happy with the workaround!

cheers - but still dont like being beat! :-( oh! and something also turned sys restore off!!

Last edited by: devonite on Fri 2 Jul 10 at 02:15

Reply to this message | Report message

Fri 2 Jul 10 08:58

theres no Welcome from this nasty! - Tooslow

d, is system restore turned off or is it turned on but not running? The latter is not unusual and doesn't imply any infection.

JH

Reply to this message | Report message

Fri 2 Jul 10 09:38

theres no Welcome from this nasty! - rtj70

The Novell client replaces part of the Windows logon GINA. If you could remove it then you'd get back the original GINA. But some of it seems missing. This could be difficult to get rid of because if you delete files manually you could end up not being able to login at all.

If something added the Novell client recently, then restoring to an old restore point might be the easiest option.

www.novell.com/support/viewContent.do?externalId=3979598&sliceId=1

Last edited by: rtj70 on Fri 2 Jul 10 at 09:39

Reply to this message | Report message

Fri 2 Jul 10 23:51

theres no Welcome from this nasty! - devonite

Many thanks for this info rtj, and for taking the time to find it!

At first reading through it, I was quite happy to give it a go! but upon getting to (h) and (I) it starts getting too technical and time consuming to be worth it, especially as she seems happier with the workaround (now she doesn`t even have to click on her icon)!

Time will no doubt come when she will require a reformat, that will cure it! :-) and then i can claim victory. in the meantime thanks!

Reply to this message | Report message

Sat 3 Jul 10 20:02

theres no Welcome from this nasty! - Stuartli

>>..there is a good chance Avast will have missed quite a few things.>>

Avast! (free version) has never missed any potential threat to my systems over several years - in fact it's lightning fast in spotting and dealing with them, even though they might occur only two or three times a year.

Even better for the lazy for whom you've put Avast! on their system but can't be bothered to update regularly is the automatic updating, often a couple of times daily.

Reply to this message | Report message

Forum Version 3.0 - By Khoosys