[rshaffer61]

I had virut and per help with malware forum help from essenceboy I did a format, blew away partition, redid partition, reformatted, clean install of Winxp pro. I have all my programs back but since reload this folder opens on every bootup that says System 32. Normally I can fix things but I think I'm having a major bullet in the forehead moment. Hopefully this will be a quick fix. Thank you in advance for your expertise and help.

Ron


I just rebooted and now I get not only System 32 folder I'm now getting C:\Windows folder opening up

Edited by rshaffer61, 11 March 2009 - 11:39 AM.

[Advertisements]

Go to Start>run... type in msconfig, then hit OK.

On the Startup tab of System Configuration Utility, look for entries referring to the two folders that are opening at startup and uncheck them.

Restart your computer. After restart, you will see a warning dialog... put a check in the dialog box and click OK so msconfig won't start up every time you restart your computer.

[makai]

Go to Start>run... type in msconfig, then hit OK.

On the Startup tab of System Configuration Utility, look for entries referring to the two folders that are opening at startup and uncheck them.

Restart your computer. After restart, you will see a warning dialog... put a check in the dialog box and click OK so msconfig won't start up every time you restart your computer.

[rshaffer61]

Here is a snapshot of my msconfig. I don't see anything with those folder names showing.

[makai]

In my signature is a link to HijackThis. Its the stand-alone version so there is no install required, however, you need to create a new folder to run the program from. Once you create the folder, run HijackThis and do a Scan. After the Scan is done, the Scan button will change to "save log". Save the log somewhere and "attach" it in your next reply. Please do not cut and paste the log... just attach it so I can download and view it.

[rshaffer61]

Here is the HJT log you requested. I did have to change it to a txt file to attach it. I hope this works

[makai]

HJT log doesn't list anything (04 start entries) related to these folders either. Do you have entries in Start>All Programs>Startup related to these folders?

[rshaffer61]

The only thing in the startup folder is Office. Normally I can fix such things with some investigating online. This one I have looked at all the regedit ideas but none of them seem to apply . Most say to look for this key and remove the quotation marks around them. None found in any keys they show to check. The funny thing was it started with just the system32 folder opening and now its that and the C:\windows folder also
Both say there are hidden files in them and to click on a button to show them. I have not clicked on anything but just close them down.

[makai]

Unfortunately, I'm not a malware expert. Its possible that when you reinstalled, something you put back on reinfected your system. I would rejuvinate the malware thread or PM essenceboy(?) to have him look at your HJT log again. Since there are no instances for startup pointing directly to these folders, it could be malware. Comidle.exe has many hits as a virus on Google, but again, I don't know what this app is related to, as far as your computer is concerned. For all I know it could be a valid program you're running. Please contact Malware again to verify your system is clean. Sorry we couldn't fix this as normally, its just some malformed registry entry, or messed up startup item. Please let me know what you find out and if it's not malware, I'll continue to hunt for a solution.

Edited by makai, 11 March 2009 - 06:31 PM.

[rshaffer61]

Thank you for your time and I will contact Essence and let him know and hopefully he will look at the new log. I will let you knwo what he finds.

[makai]

Ok, thanks for your patience. Let me know how it goes.

makai

[rshaffer61]

Hi Again Makai. Malware has cleaned everything and says now to come back to you since the problem is still here. Instead of system 32 folder opening tho it is now C:\Windows folder. I have uploaded an image to mediafire if you would like to look at it. The addy is

http://www.mediafire...04e75f6e8ebb871

Here is the thread in malware if you would like to see what everything was we did

http://www.geekstogo...65#entry1486265


At this point he believes its an xp issue and it is not a infection as I am clean and have a clean restore point as of this morning.

Edited by Rorschach112, 14 March 2009 - 09:10 AM.
removed log

[rshaffer61]

I'm not sure if this has anything to do with my problem but I was looking at my eventlog. Everytime I bootup I see these 2 entries with a red circle and white x on them. This happens on every bootup that I see in eventlog. What do you think, could this have something to do with the folder opening up?

The Aspi32 service failed to start due to the following error: The system cannot find the file specified

Right after that this message
The IPSEC services service terminated with the following error:
The crypto systemor checksum function is invalid because a required function is unavailable

[makai]

Hello Ron,
I'm glad you got taken care of in the Malware forum. Hopefully we can fix this pop-up of yours.

There are several options to choose from...
The first thing is running chkdsk /f or chkdsk /r. The latter will take a little longer. I'm really not sure this will solve anything but its worth a try if you haven't already tried it.
The second thing is sfc /scannow. This may require your Windows XP disc, so if you don't have it on hand, don't run this.
The third is a Windows repair. Again you will need your XP disc.

From what I've read, there may be a malformed registry entry causing this, although it may take some time to find it. All indications point to an extra space somewhere in the registry and I do remember having a similar problem that caused havoc with a sound problem years ago. Off the top of my head, I can't remember what that was, or even if it was related to your case. In any event, are you comfortable working in the registry? I'm asking because you may end up having to edit an entry. Working with the registry is not that bad as long as you're careful with what you do.

However, before we do anything else, why don't we work with msconfig first, to see if we can isolate something...

Go to Start>run... type in msconfig, then click ok.
In the System Configuration window>General tab, unselect Process System.INI file and Process Win.INI file... then click Apply, OK. You will be prompted to restart, so do so. After restart, see if the popup still shows up. You will also get a popup from msconfig... just click ok for now, then close the msconfig window.

Edited by makai, 14 March 2009 - 02:16 PM.

[rshaffer61]

Ok I've run the msconfig, chkdsk /f, and chkdsk /r and it still comes up. Although it is taking longer for it to popup now.
I'm going to run the sfc /scannow to run now.
Also got a error message but didn't catch what it said. I'l try to catch it on next bootup after sfc /scannow and let you know.

Ron

[rshaffer61]

Ok ran the sfc program and rebooted when finish
it still pops up.
Next
how about a HJT or some other log u could go thru with a fine tooth comb?