This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

NEED HELP PLEASE

48 min read

This thread's last reply is from May 10, 2005, 10:49 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Alrighty :)

Couple of ghosts to deal with...
I'll be back in a few with one more registry edit for you
ok. . . thanx a lot . . .
and which anti spyware software is the best . . . ? ?
after all this ,. . i wanna keep my computer free from it . . befor eit picks up such viruses . . . .
whcih software is most secure ?
One thing at a time....;)

You know the drill....copy contents of code box...save as FixReg4.reg
REGEDIT4

[-HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Run/MiniPortRt]

Double click FixReg4.reg and allow to add to registry.

Reboot...to be sure no boot errors.

Then we'll finish this up.
ok perfect . . .NO errors . . . .
jus mmy c:\ is opening up automatically on startup . .
any reason ? ?
u need a new log ?
C:\ is opening at boot?
Is this new...or was it doing that before?

Try another reboot to see if it still opens...and to which folder in C
yupp still opened . .
the main LOCAL DIsk( c:\) opens
. . . yupp its new . . it started last night i remember . . .. but i dint pay much atention .. .
. . .. .
See if anything is lited in these, which shouldn't be.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup.
C:\Documents and Settings\All Users\Start Menu\Programs.
C:\Documents and Settings\All Users\Start Menu.
In addition, substitute the names of users on your computer for the All Users folder and check the startup programs associated with their profiles.

Sounds like explorer is in the boot.ini string
in every folder . . .is a program called desktop.ini
its in every single one of them
That's supposed to be there, it shows now because we did the 'show all files' thing earlier.
You can undo those changes after we are done.

Find boot.ini please. Open with notepad...copy/paste contents please.
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
OK, now WIN.INI
Just the first part...under [windows]
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMCDLLNAME=mapi.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo2
asx=MPEGVideo2
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo2
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo2
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo2
wm=MPEGVideo2
wma=MPEGVideo2
wmv=MPEGVideo2
wmx=MPEGVideo2
wvx=MPEGVideo2
wpl=MPEGVideo
[IRIS_IPE]
menu=1
[Readiris]
Scanner32=Twaino38,23
[DPE]
Toolbar=1
SN75=43011702
Should be a different WIN.INI file...looks something like this

[windows]
load=
run=
NullPort=None
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMCDLLNAME=mapi.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo2
asx=MPEGVideo2
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo2
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo2
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo2
wm=MPEGVideo2
wma=MPEGVideo2
wmv=MPEGVideo2
wmx=MPEGVideo2
wvx=MPEGVideo2
wpl=MPEGVideo
[IRIS_IPE]
menu=1
[Readiris]
Scanner32=Twaino38,23