A little help needed, please

Stumpy

Join Date 04/2001

A little help needed, please

For some strange reason, each time I boot my machine it now displays a window to My Documents which I have to close manually, does anyone know why or how I can stop it ?

I have made sure that it there is no shortcut in the Startup Folder, checked the registry, checked for spyware, all is clean, I just cannot find a reason for this to be happeneing.

Also there is now a search Toolbar that appears on the Taskbar (Toolbar is called Search Assistant), this I also have to close

I have checked with 3 Spyware programs plus an online scan by Symantec, system, is clean.

Any help would be appreciated

Locked Post

Advanced Search

Watch this post

Do not email me updates for this post Email me updates for this post

Successfully updated karma reason!

Yrag: Yes Office 2000 (upgraded to Office XP)

Pixel Pirate: Already checked those locations

Successfully updated karma reason!

Two more, Stumpy

This link has info on wsaupdater and omniscient, both of which are running at startup.

http://www.wilderssecurity.com/showthread.php?t=35120

Successfully updated karma reason!

Stump - Stop 'Office' XP from starting anything at boot (OSA9.EXE). It should be in your Startup folder.

Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

PixelPirate

Join Date 07/2003

+17

Try to hit Win+R and type sysedit and see if there's something going on in the 2 ini files...

BE CAREFUL!

Successfully updated karma reason!

PixelPirate

Join Date 07/2003

+17

Or try Run - MSINFO32, go to Software Environment and Startup Programs and see if theres anything there.

Successfully updated karma reason!

PixelPirate

Join Date 07/2003

+17

Maybe it's this string, remember to take a backup first

Using Regedit, change the following key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENT VERSION\WINLOGON

Change USERINIT from C:\windows\system32\userinit.exe to C:\windows\system32\userinit.exe,

Successfully updated karma reason!

Ok!, Thank You very much guys, all is now solved, my boot is now as it was, all your help is much appreciated

Thanks Guy & Gals

Successfully updated karma reason!

PixelPirate

Join Date 07/2003

+17

How did you resolve it?

Successfully updated karma reason!

Removed all that Pictoratus said, and the Office startup, then all was well

Successfully updated karma reason!

PixelPirate

Join Date 07/2003

+17

Great you got it figured out.

It's a real pain to be bothered with.

In my quest for a possible solution I found the answer to a problem my father was having with Ad-Aware, also a folder that keeps popping up at startup.

Successfully updated karma reason!

The question is where did you get all that adware? Why wasn't it detected? And how do you protect yourself from getting it again?

Successfully updated karma reason!

Great Security Check here

http://security.symantec.com/sscv6/default.asp?productid=symhome&langid=ie&venid=sym

Don't take long to check

Successfully updated karma reason!

I have Spybot and it works for me. I also have NAV and I don't have virus or trojan problems. It is just strange that you said you ran all these spyware programs and they found nothing. It seems to me that they probably weren't working. Just strange, and curious.

Successfully updated karma reason!

werewolf

Join Date 04/2001

+28

I use AVG as my antivirus program and that Symantec checker reported that I had no virus protection running. This is odd, as Zone Alarm as reported that it couldn't find a virus checker either. I have AVG setup so that it is constantly on in the background and I have all the boot scanning options turned on as well.

Maybe that's not a bad thing. I've been reading about some of the latest virus/trojan horses which detect your virus program and turn it off. They couldn't do that if it wasn't detectable. Hmmmm.

Of course, maybe one of those pesky things has already turned it off. Double Hmmmm.

[Message Edited]

Successfully updated karma reason!

werewolf

Join Date 04/2001

+28

Another oddity...the Symantec virus scan said I had an infected Default.css file in c:\windows. That file doesn't exist on C:\ at all.

Successfully updated karma reason!

Hi! If you still having problems with the folder that opens, load this program and execute it and I think your problems will be over!http://www.pekspro.com/cgi-bin/countdown.pl?files/pmfix.zip.
Just download it and let it fix your problems!
Lotta

Successfully updated karma reason!

From the link above...

right... anyone going to download from that link above and run that?

#41 by lotta - 6/27/2004 1:07:37 AM Hi! If you still having problems with the folder that opens, load this program and execute it and I think your problems will be over! LinkJust download it and let it fix your problems!Lotta

Hoppsan!
På ett eller annat sätt har du försökt komma till en sida som inte finns. Gå till Startsidan så hoppas jag du hittar det du söker ändå -).

That is a 404 error, wonder why?

Successfully updated karma reason!

Another oddity...the Symantec virus scan said I had an infected Default.css file in c:\windows. That file doesn't exist on C:\ at all.

have you looked at the log file for NAV?

It will explain what it found and what it did with it...

It is probably zapped by NAV already. One thing though, if you had a Default.css in your Windows Directory then it was probably put in there by a jacked site, jacking site or some other program that was ran which has the infected file inside the compressed installation wrapper...

Successfully updated karma reason!

werewolf: ZA 5's AV monitor was programmed to detect only NAV, McAfee and CA's EZ AV. That's why it doesn't detect AVG. I imagine in time it may add other AV's to monitor. You might want to turn the AV monitor off since it doesn't work with your AV.

Successfully updated karma reason!

werewolf

Join Date 04/2001

+28

Iplural, hope you haven't gone yet

...I can't find that file.

sig101...thanks for that suggestion

Successfully updated karma reason!

I don't use NAV I use AVG, and yes that website check reported that I did not have virus protection, I just ignored that part as I know I'm protected, but the attack loopholes have all been filled, and the window that opens was due to some files from the WINSTART invasion not being removed completely, (I had to do that manually).

All my problems are now over and all attack holes sealed, thank you all for your help.

Successfully updated karma reason!

lets all go drink

Successfully updated karma reason!