Member Avatar for Xtremer360

I have he same problem I have the system 32 folder come up as well as the dwn and done boxes. However I do not have the program hijackthis.

In the start up list of things in system configuration on my Windows XP computer it says the following things:

Realplay
qttask
PSP Networking
Something with no name
CMESys
update
msbb
AHNUX
GNTDKXA
asfkdicj
bargains
winnet
GMQ
Something with no name
wkfud
WksSb
WkDetect
GMTZDJQ
jusched
DKQXEK
BIOVCIP
zzb
lewvkcod
optimize
BIOVF
updmgr
BIOVFLSYF
AKRUBHOU
sysupd
Belt
Loader
View
WebSavingfromEbates
rsinuqzz
zojnlfnk
vizqtqig
dsx
debud
winview2
wupdater
ohtxgzh
alchem
wupdt
lejkzad
ypager
aim
America Online 9.0 Tray Icon
Microsoft Office

What do I do? I don't even know what 98% of those things are.

  • 3 Contributors
  • 3 Replies
  • 185 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

This looks like two related problems: a startup item is launching Explorer on the System32 folder (so the folder window opens at logon) and lightweight popups named “dwn”/“done” — both are classic symptoms of adware/malware creating dodgy Run/Startup entries or shortcuts. ’s long msconfig list and ’s HijackThis mention show there are many unknown entries, so a careful, measured cleanup is required rather than random deletions. ’s suggestion to scan with anti‑spyware is a good start; add the steps below to make the cleanup reliable and reversible.

Stepwise checklist (do these in order):

  1. Disconnect from the network to stop reinfection.
  2. Back up important data and create a System Restore point (or export affected registry keys) before editing anything.
  3. Reboot to Safe Mode (press F8) and run updated full scans with both an antivirus and an anti‑malware scanner.
  4. Use an autorun inspection tool (for example, an Autoruns-type tool) to find startup entries whose command is a plain folder path (this is what causes Explorer to open System32) or entries with random-letter names. Export the list, then uncheck (disable) suspicious items rather than deleting them immediately.
  5. Check the usual places: the Startup folder, Scheduled Tasks, and the Run & RunOnce keys under HKLM and HKCU. If a Run value points to a folder (not an executable), disable or rename it. Always export the registry key first.

Finding the “dwn/done” popup source: observe the process in Task Manager or a process viewer to get the running filename and location. If it lives in Temp, AppData, or has a random name, quarantine it. If a HijackThis log is posted, start a fresh thread (do not piggyback on this old topic) and include the full log text so helpers can advise which entries are safe to remove.

Cautions and final notes: do not remove items that clearly belong to Windows, antivirus, or device drivers. Prefer disabling/renaming over deletion so you can restore if needed. If the machine is heavily compromised or you cannot confidently restore a safe state, the cleanest option is to backup personal files and perform a clean OS install (also consider upgrading from unsupported Windows XP to a supported OS).

Recommended Answers

All 3 Replies

Member Avatar for crunchie

Download & instal Adaware from
& update it B4 scanning.
In settings under 'scanning,' have it set to
'scan within archives,'
'scan active processes,'
'scan registry,'
'deepscan registry'
'scan my IE Favourites for banned URL's,'
'scan my host's file.'
In 'tweaks' under 'scanning engine' set it to 'unload recognised processes during scanning.'
Also in 'tweaks' under 'cleaning engine' set it to 'Automatically try to unregister objects prior to deletion' & 'let Windows remove files in use at next reboot.'
Select 'activate in-depth scan' before starting scan.
When the scan is finished select 'next.'
Remove what it finds by placing a check in the box to the left of the object. Reboot

Download & instal Spybot S&D from Update it B4 scanning. Go into settings & have it check for Beta releases also & download if available.
After the scan is complete, have spybot fix everything marked RED.
On the page that first opens when you start Spybot there is an option to immunise, you should do this. In the immunise section there is also a link to download Spywareblaster. Download that & you can keep it updated by selecting the same link that you use to download it. Reboot

Download HijackThis from & unzip it into it's own, permanent folder, (Not a temporary folder or the desktop & not directly on your hard drive).
If you have anything disabled in MsConfig, please re-enable it/them.
Start HJT & with all browser windows closed, press the scan button. When the scan is finished the scan button will change to save. Save the log to a text file, copy the entire contents of the text file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is harmless & even necessary to the running of your system.

Member Avatar for g_hallan

i also have a system32 folder opening upo at start up. i tried the windows help center but i coundnt find teh registry. please help me... also i had "Thrustin popups" but that was done way with teh help on an antivirus but the name is still displayed in the "add/remove program list" and i am unable to remove it... PLEASE HELP....

Here is my log file of HJT:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\SOLOAN~1\SRNMIC~1\SOLOSENT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.711.1664\GoogleToolbarNotifier.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gaurav\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpoofBHO Class - {07A78AEA-4A54-4967-9A60-4B68592D30C7} - C:\WINDOWS\se_spoof.dll (file missing)
O2 - BHO: ChangerBHO Class - {0D4C7057-EAD2-44C6-AD18-9092905F28F1} - C:\WINDOWS\system32\usbmons.dll (file missing)
O2 - BHO: SpoofBHO Class - {385066e0-23f3-11db-a98b-0800200c9a66} - C:\WINDOWS\se_spoof.dll (file missing)
O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} - C:\WINDOWS\inetloader.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} - C:\Program Files\TrustIn Contextual\trustincontext.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SoloSentry] C:\PROGRA~1\SOLOAN~1\SRNMIC~1\SOLOSENT.EXE
O4 - HKLM\..\RunServices: [Driver32]
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.zdnetindia.com
O16 - DPF: Yahoo! Chess -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) -
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) -
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

Member Avatar for crunchie

Hi g_hallan .

First of all- welcome to Daniweb :).

We ask that members not piggy-back questions on to a thread previously started by another member here in the Viruses, Spyware & other Nasties forum, (regardless of how similar your problem might seem and also because this thread is over two years old). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules


Thanks for understanding.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.