Cannot change startup programs

Discussion in 'Malware Help (A Specialist Will Reply)' started by tskaze, Aug 30, 2005.

  1. tskaze

    tskaze Private E-2

    I can't change any of my startup programs. When i uncheck them in any program (msconfig, spy sweeper, the program by the guy who made process explorer) they either just come back when i restart, or in the case of spy sweeper it alerts me that new startup programs have been added right after i disable them. Ive run various anti-spyware progs. (adaware, spybot, spy sweeper) to no avail. I still think its spyware related but maybe im wrong.
     
    tskaze, Aug 30, 2005
    #1
  2. PhilliePhan

    PhilliePhan Guest

    Last edited by a moderator: Aug 31, 2005
    PhilliePhan, Aug 30, 2005
    #2
  3. tskaze

    tskaze Private E-2

    Just download the startup control panel, when i uncheck an item nothing happens. When i delete one it appears again in the same spot. After a bit even if i disable it another one comes back, checked, and if i try to disable it im told a process of the same name exists, and that i should rename it. Obviously renaming results in another copy of the program.
     
    tskaze, Aug 30, 2005
    #3
  4. PhilliePhan

    PhilliePhan Guest

    It sounds to me like you have an Anti-Spy program (SpyBot's Tea Timer, for example) that is restoring the registry or blocking the changes.

    -- What are you trying to stop from running?

    -- How about attaching a HijackThis log from Normal Windows boot. . . . .

    I have to get back to work, but will check back as time permits.

    PP :)
     
    PhilliePhan, Aug 30, 2005
    #4
  5. tskaze

    tskaze Private E-2

    Im working on disabling various things, but in case i cant find anything heres my hjt log.
     

    Attached Files:

    tskaze, Aug 30, 2005
    #5
  6. PhilliePhan

    PhilliePhan Guest

    Well . . . That is one of the more interesting HJT logs that I have seen. There are some minor cleanup issues there, but it looks (at very quick glance) OK.

    I am not too familiar with a few items, but I would bet some of your "Guard" type apps are restoring your changes.

    Try disabling those and then using Startup Control Panel . . . .

    Gotta run - Will check back as time permits!

    PP :)
     
    PhilliePhan, Aug 30, 2005
    #6
  7. tskaze

    tskaze Private E-2

    ahh got it myself, thanks for leading me down the right path.

    Turns out my lavasoft ad-watch was keeping me from changing the registry entries (i thought it was just warning me when they were changed) so i fixed it now, but thanks for your help.

    edit: also, in case you saw this in the log file and were confused i have iopus actmon on my computer for monitoring purposes.
     
    tskaze, Aug 30, 2005
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hmmm! I see a lot of problems on quick glance.


    C:\WINDOWS\system32\syswin.exe

    What is this next line for:
    C:\Program Files\ByteGems.com\I Hate This Key\IHateThisKey.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

    Is the below Proxy Server required:
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 80.227.56.42:8080

    R3 - URLSearchHook: (no name) - _{0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
    R3 - URLSearchHook: (no name) - _{CC8C8F4F-F2E8-404B-A43D-5CC57876A008} - (no file)
    O2 - BHO: (no name) - {0A24368A-13AD-3B47-E10E-370671C114A7} - (no file)
    O2 - BHO: (no name) - {46473151-B6DF-0BBD-D1FA-C573E864FCDA} - (no file)
    O2 - BHO: (no name) - {54092E74-B8B3-9E6D-BF1D-BEEE85FCBDCB} - C:\WINDOWS\system32\rrkjybnr.dll (file missing)
    O2 - BHO: (no name) - {B81C1D8A-DF70-0840-5668-4AC6E236F24E} - (no file)

    Not sure about this WikiSearch line:
    O3 - Toolbar: &WikiSearch - {44E7EF6C-6F5C-4AAF-A080-7725A27878ED} - C:\PROGRA~1\WikiSearch Toolbar\WikipediaBand.dll

    O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe
    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe

    Again I question the next line:
    O4 - HKCU\..\Run: [IHateThisKey] C:\Program Files\ByteGems.com\I Hate This Key\IHateThisKey.exe
    O4 - HKCU\..\Run: [Fcs] C:\WINDOWS\system32\w?auclt.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
     
    Last edited: Aug 30, 2005
    chaslang, Aug 30, 2005
    #8
  9. PhilliePhan

    PhilliePhan Guest

    MOST of that IS minor cleanup ;)

    Dell insists the MyWay is not spyware . . . Debateable!

    But - as you are always pestering me to do this - I was going to ask tskaze to run through the Read Me First after we figured out what was going on with the startup changes. There are rules to be followed, you know!? . . . . . ;)


    tskaze - Glad to see you got the Startup sorted out!

    Also, Chas is correct, as usual. Those items he posted need to be addressed! Looks like he is on the case now, so you are in good hands!

    PP :)
     
    PhilliePhan, Aug 30, 2005
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Syswin.exe is not really minor = http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irccontact.html

    Neither is MediaPass.

    Easy to clean....yes (normally)!


    Yes Dell does say it is not spyware. The rest of the world does however. They were stupid to associate themselves with it. Why would they want their home pages to be associated with very well know malware? Very very poor choice. Why not associate themselves with bargain buddy and Gain too! :rolleyes:
     
    Last edited: Aug 30, 2005
    chaslang, Aug 30, 2005
    #10
  11. tskaze

    tskaze Private E-2

    First of all I hate this key is a program to disable the windows key so i dont accidently hit it when i play games. I havent dealt with syswin, but mediapassk and many of the others are just shortcuts (the files have been deleted). Im not sure what the proxy server is, so ill assume its unnecessary. The wikisearch is a toolbar so i can search wikipedia easily.

    Ill get syswin and delted those links to no files.
     
    tskaze, Aug 30, 2005
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Here is what you should do.

    Yo should first look to uninstall:
    Media Pass
    SpyHunter

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
    C:\WINDOWS\system32\syswin.exe

    After killing all the above processes, click "Back".
    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 80.227.56.42:8080
    R3 - URLSearchHook: (no name) - _{0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
    R3 - URLSearchHook: (no name) - _{CC8C8F4F-F2E8-404B-A43D-5CC57876A008} - (no file)
    O2 - BHO: (no name) - {0A24368A-13AD-3B47-E10E-370671C114A7} - (no file)
    O2 - BHO: (no name) - {46473151-B6DF-0BBD-D1FA-C573E864FCDA} - (no file)
    O2 - BHO: (no name) - {54092E74-B8B3-9E6D-BF1D-BEEE85FCBDCB} - C:\WINDOWS\system32\rrkjybnr.dll (file missing)
    O2 - BHO: (no name) - {B81C1D8A-DF70-0840-5668-4AC6E236F24E} - (no file)
    O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe
    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
    O4 - HKCU\..\Run: [Fcs] C:\WINDOWS\system32\w?auclt.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\Program Files\Media Pass <---the whole folder
    C:\Program Files\Enigma Software Group <---the whole folder
    C:\WINDOWS\system32\syswin.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

    Now we need to Reset Web Settings:
    1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
    chaslang, Aug 30, 2005
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds