| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 68238 | 2006-04-22 04:57:00 | Locked file... | Mowi (9902) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 448395 | 2006-04-22 04:57:00 | Well, i'm running Windows XP Home SP2, on a Dell Optiplex with 40GB HD and 256MB RAM, on a 512k broadband connection (yeah... me again :) Problem is this, i downloaded a video from Ares, which i couldn't play on WMP (with K-Lite Codec pack... etc), and now i cannot delete it, change its name or move it; it appears to be locked. I rebooted and then could delete it, but after a while it appeared again. Tried MoveOnBoot but it fails. There's nothing that seems weird in the hijackThis log (or i am really noob at it) or the Task Manager, though... any suggestions? Here's teh hjt log: R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: iTunes.lnk = C:\Program Files\iTunes\iTunes.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - spaces.msn.com O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe Thanks in advance! |
Mowi (9902) | ||
| 448396 | 2006-04-22 05:16:00 | Post the whole log. From the start. Where it shows what version of XP and what version of HJT you're using. |
Speedy Gonzales (78) | ||
| 448397 | 2006-04-22 05:20:00 | Sorry, it was a mistake with copy-paste. Logfile of HijackThis v1.99.1 Scan saved at 11:18:23 PM, on 4/21/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Azureus\Azureus.exe C:\Program Files\eMule\emule.exe C:\Program Files\iTunes\iTunes.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: iTunes.lnk = C:\Program Files\iTunes\iTunes.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - spaces.msn.com O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe |
Mowi (9902) | ||
| 448398 | 2006-04-22 05:28:00 | No worries. Run hijackthis again, (close browser/s), tick these entries and tick fix checked. O4 - Startup: iTunes.lnk = C:\Program Files\iTunes\iTunes.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart - This program may install spyware, as part of the install. O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background - run this manually, or put it on the quicklaunch bar. Whats the name of the file that cant be deleted / keeps coming back? |
Speedy Gonzales (78) | ||
| 448399 | 2006-04-22 05:35:00 | Name of the file. That'd be kind of very embarassing since it's a pr0n. Oh, well, someday i had to learn. Could i only say Windows catalogues it as a "movie clip"? Hope you got some laughter with this. :) |
Mowi (9902) | ||
| 448400 | 2006-04-22 05:39:00 | Name of the file. That'd be kind of very embarassing since it's a pr0n. Oh, well, someday i had to learn. Could i only say Windows catalogues it as a "movie clip"? Hope you got some laughter with this. :) Try the program here (ccollomb.free.fr) |
Speedy Gonzales (78) | ||
| 448401 | 2006-04-22 05:44:00 | Thank you very much. Actually I had been looking for a program like that, but none seemed trustworthy. That's why i better ask in a forum. The file deleted itself after unlocking, and i hope it will not come back. Just... thank you very much. |
Mowi (9902) | ||
| 448402 | 2006-04-22 05:45:00 | No worries :) Hopefully, its gone for good! |
Speedy Gonzales (78) | ||
| 1 | |||||