944,193 Members | Top Members by Rank

Hardware and Software > Microsoft Windows > Viruses, Spyware and other Nasties > Help window keeps popping up
Ad:
You are currently viewing page 1 of this multi-page discussion thread
Permalink
Oct 28th, 2007
0

Help window keeps popping up

Expand Post »
I have the exact same problem as http://www.daniweb.com/techtalkforums/thread45973.html
It seems as if that post, like so many others ended without resolution.

here is my ht log

Logfile of HijackThis v1.99.1
Scan saved at 11:37:40 AM, on 10/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\Ati2evxx.exe
E:\WINDOWS\system32\dlbccoms.exe
E:\Program Files\Spyware Doctor\svcntaux.exe
E:\Program Files\Spyware Doctor\swdsvc.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\wdfmgr.exe
E:\WINDOWS\System32\wltrysvc.exe
E:\WINDOWS\System32\bcmwltry.exe
E:\WINDOWS\System32\alg.exe
E:\Program Files\Spyware Doctor\SDTrayApp.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\BCMSMMSG.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\Microsoft Money\System\mnyexpr.exe
E:\Program Files\Microsoft ActiveSync\wcescomm.exe
E:\Program Files\AIM6\aim6.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
E:\Program Files\LimeWire\LimeWire.exe
E:\PROGRA~1\MICROS~4\rapimgr.exe
E:\Program Files\AIM6\aolsoftware.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\System32\wbem\wmiprvse.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - E:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Try2Find Toolbar - {90BAEB8B-47C2-44B4-A5A6-B99D34F1D4C5} - E:\Program Files\Try2Find\Try2Find.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [xload] "E:\WINDOWS\xload.exe"
O4 - HKLM\..\Run: [2Search] E:\Program Files\2search\main.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "E:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SDTray] "E:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [MoneyAgent] "E:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Aim6] "E:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [DW4] "E:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] E:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: LimeWire On Startup.lnk = E:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: Registration Silent Hunter III.LNK = E:\Program Files\Ubisoft\SilentHunterIII\Support\Register\RegistrationReminder.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.sxload.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: dlbc_device - - E:\WINDOWS\system32\dlbccoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - E:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - E:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - E:\WINDOWS\System32\wltrysvc.exe

Please help!
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
stuckinarut is offline Offline
8 posts
since Oct 2007
Permalink
Oct 28th, 2007
0

Re: Help window keeps popping up

If you had exactly the same problem as the referred post, presumably you re-installed Windows etc like the referral had done.

From the HJT log I don't recognise C:\windows32\xload.exe as a system file. Do you know where it came from? Did you install it? I don't have one of these files. If there is an XFILES[1].exe (and so on) then you have a trojan which has to be removed by usually painful and intricate processes.

You can find from the create date of xload.exe whether or not the date coincides with the start of your problems.

And please, we'd rather have your own problem description with reference to another post as an assist, not the thing WE have to go searching for. It's like we're to be your fixing biatches which is not good manners.
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007
Permalink
Oct 28th, 2007
0

Re: Help window keeps popping up

Sorry, I thought it be best to include the link to include all the previous input that was given regarding the issue. Thanks for the assistance. Per your xload.exe query, I cannot find it anywhere within my system. Any suggestions as to how to find the file? Thanks again.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
stuckinarut is offline Offline
8 posts
since Oct 2007
Permalink
Oct 28th, 2007
0

Re: Help window keeps popping up

The HJT reported:
O4 - HKLM\..\Run: [xload] "E:\WINDOWS\xload.exe"

So what's your setup? Do you have a drive E? is that your system drive?

This is a Registry entry and refers to the RUN at boot up program set; of course if it can't find XLOAD.EXE it won't run it. But if it ever did run, it would have spawned a copy of itself [1] etc. That is if it's a trojan, of course.

A Registry scan and clean would be a good idea.
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007
Permalink
Oct 28th, 2007
0

Re: Help window keeps popping up

Yes E: is my system drive. I have done a registery scan and clean. Is there a way I can check for that xload file now? Please excuse me as I am not too familiar with these things. Thanks again.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
stuckinarut is offline Offline
8 posts
since Oct 2007
Permalink
Oct 28th, 2007
0

Re: Help window keeps popping up

You would need to have your system files visible to you. I presume you know how to unhide protected system files and other hidden files and folders using the explorer Options/View function.

If your anti-spyware didn't clean this out, it'll be in E:\Windows. If it's not there, look also for XLOAD[1].EXE somewhere in your system.

If it's not there, then your registry cleaner should have reported the Registry RUN entry as an orphan. You may care to look at the report. Or run REGEDIT and search for the RUN key and see if the key mentioned in HJT is still there - and report.

If XLOAD was an important file, when you pass your mouse over it, the authoring organisation should be revealed (try it on a known file like WINWORD.EXE). If there's no such signature, the file isn't essential to your system and can be renamed r deleted. First time round I rename files to, say, XLOAD.XXX. Then you can restore it if it was good.

I'm fairly certain this file is bad. Can't guarantee it because you're there and I'm miles away here.

Goodnight till tomorrow (or rather today!).
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007
Permalink
Oct 29th, 2007
0

Re: Help window keeps popping up

Here is the latest HT log.

Logfile of HijackThis v1.99.1
Scan saved at 1:13:04 AM, on 10/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\Ati2evxx.exe
E:\WINDOWS\system32\dlbccoms.exe
E:\Program Files\Spyware Doctor\svcntaux.exe
E:\Program Files\Spyware Doctor\swdsvc.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\wdfmgr.exe
E:\WINDOWS\System32\wltrysvc.exe
E:\WINDOWS\System32\bcmwltry.exe
E:\WINDOWS\System32\alg.exe
E:\Program Files\Spyware Doctor\SDTrayApp.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\BCMSMMSG.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Microsoft IntelliPoint\point32.exe
E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\Microsoft Money\System\mnyexpr.exe
E:\Program Files\Microsoft ActiveSync\wcescomm.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
E:\Program Files\LimeWire\LimeWire.exe
E:\PROGRA~1\MICROS~4\rapimgr.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
E:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - E:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "E:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SDTray] "E:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [MoneyAgent] "E:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Aim6] "E:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: LimeWire On Startup.lnk = E:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.sxload.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: dlbc_device - - E:\WINDOWS\system32\dlbccoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - E:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - E:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - E:\WINDOWS\System32\wltrysvc.exe

I dont see that xload.exe file anymore, yet the problem still persists?
Thanks again for the ongoing support.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
stuckinarut is offline Offline
8 posts
since Oct 2007
Permalink
Oct 29th, 2007
0

Re: Help window keeps popping up

This is the original problem taken from your linked thread:
This has been going on for a while, every time i open up a web page or a program the help window pops up, I close it and then click on the page that I want to see and the window pops up again, it doesn't let me type because it keeps going back the the help window. I have tried reinstalling Windows XP and completely erasing everything from my computer and I still have the same problem. What should I do I can't even browse a page or start a program without having this annoying help window pop up.

Did you rebuild Windows?

Did you find the XLOAD.EXE file? Any spawns?

These Registry keys are a mystery to me. What does Regedit show when you search on the hexadecimal portion of the string?

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Putting this right if you've managesd to get rid of the offending process at boot time probably needs some Rwegistry surgery - and that's a deep subect. Your browser has been hijacked and to my mind the Registry settings that specify behaviour have to be reset. Sometimes this can be achieved via Internet Options/Advanced/reset; but that depends on the backup info for that reset not having been got by the trojan.
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007
Permalink
Oct 29th, 2007
0

Re: Help window keeps popping up

When I do a search in my files for the xload.exe, I find nothing.
Doing a search in the regedit for those hexadecimal strings this it what shows.

Default REG_SZ (value not set)
Count REG_DWORD 0x0000003e (62)
Time REG_BINARY d7 07 0a 00 01 00 1d 00 12 00 20 00 3a 00 4a 00
Type REG_DWORD 0x00000003 (3)

I have no idea what all this means. Am i supposed to get rid of these? How?
Reputation Points: 10
Solved Threads: 0
Newbie Poster
stuckinarut is offline Offline
8 posts
since Oct 2007
Permalink
Oct 29th, 2007
0

Re: Help window keeps popping up

Dunno what they mean either! You should save them first via the Export function. Select the key - by clicking on the hexadecimal string. then File/Export/Selected Branch and provide a memorable file name.

When you've exported them you can delete them by alighting on that key as before and pressing DELETE.

ANWAY - I found something else:
----------------------------------------------------
O15 - Trusted Zone: *.sxload.com
----------------------------------------------------

Find sxload.com and get rid of it. It's the master that keeps this going.
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: Cannot Access Control Panel
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: cant get rid of "backdoor.trojan"





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC