[chris73]

Anyone ever seen this:



Is my XP all messed up?

[Advertisements]

Items in blue which are underlined are clickable to give more information about the process

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete

Click start, all programmes, accessories, system tools to run disc clean up

Click start, all programmes, accessories, system tools to run disc defragmenter

Click start then run, type sfc /scannow then press enter, you need the XP CD and Windows File Protection will show a blue onscreen progress bar, when the bar goes, reboot

[Retired Tech]

Items in blue which are underlined are clickable to give more information about the process

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete

Click start, all programmes, accessories, system tools to run disc clean up

Click start, all programmes, accessories, system tools to run disc defragmenter

Click start then run, type sfc /scannow then press enter, you need the XP CD and Windows File Protection will show a blue onscreen progress bar, when the bar goes, reboot

[mcpscomp]

Look at the path and the file name. I don't like it.

[chris73]

Items in blue which are underlined are clickable to give more information about the process

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete

Click start, all programmes, accessories, system tools to run disc clean up

Click start, all programmes, accessories, system tools to run disc defragmenter

Click start then run, type sfc /scannow then press enter, you need the XP CD and Windows File Protection will show a blue onscreen progress bar, when the bar goes, reboot

All went well except for the sfc / scannow - it dosen't start. It only flashes the command screen quickly and nothing happens.

[chris73]

Look at the path and the file name. I don't like it.

Don't like it in what way? Spyware?

[Retired Tech]

Right click the taskbar, click task manager, click file, new task, type sfc /scannow then press enter, if no change

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

[mcpscomp]

I think the file you want is REGEDT.EXE not regedit.com. Windows doesn't have that file. Letting that get into your system is not fun no more.
good luck.

[Fenor]

I think the file you want is REGEDT.EXE not regedit.com. Windows doesn't have that file. Letting that get into your system is not fun no more.
good luck.

That is correct. You need to go to C:\Windows\ folder and delete the file regedit.com and any other file that starts with regedit that DOESN'T end in EXE. You may need to View Hidden Files & Folders to see the file to be able to delete it. Afterwards, go to START-->RUN and type regedit and see if the Registry Editor window opens.

Since a problem like this is almost always malware related, I suggest you go to the Malware Forum and run all the steps located in the START HERE. After doing the steps, please post a HiJackThis Log in THAT forum and let an expert check it and make sure there isn't anything else hanging around.

Fenor

Edited by Fenor, 17 June 2006 - 07:35 PM.

[chris73]

Thanks for the advice.
I can't find regedit.com on the system, even if I include hidden folders in the search.

My Hijack This log looks clean to me, but I'm heading to Malware now.

Edited by chris73, 17 June 2006 - 08:31 PM.

[mcpscomp]

look for REGEDIT because the real file named REGEDT. The difference is one with "I" and one without.

Edited by mcpscomp, 17 June 2006 - 10:13 PM.

[wannabe1]

Hi chris73...

Just to clarify something here. There IS a REGEDIT and a REGEDT and both are legitimate Windows applications. REGEDT32 is the advanced registry editor in Windows.

Open "My Documents", click on "Tools", then on "Folder Options...", under the "View" tab, locate and untick the box next to "Hide extensions for known file types". Apply the changes. Now find and delete REGEDIT.COM in C:\Windows.

wannabe1

[Fenor]

Also don't do a search for the file, but rather physically navigate to the folder by opening MY COMPUTER, then Local (C:) and then WINDOWS and then find and delete the REGEDIT.COM file.

Fenor

[Jason62040]

I had the same problem, wierd it went away with deleteing the contents in pretench or what ever first step was

[chris73]

Right click the taskbar, click task manager, click file, new task, type sfc /scannow then press enter, if no change

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

The machine is booting and shutting down VERY slow since I used the prefetch command. Is it because the scannow hasen't been run?

[Jason62040]

a simple approach, try clicking run: type regedit.exe.....