Is closeapp.exe file something to worry about? Part I

Hi, I've follwed the steps from 1 to seven on the READ & RUN ME FIRST tutorial, and the only problem left seems to be the closeapp.exe file.

I'll attach the all the logs, starting with counterspy, bitdefender and panda activescan, so someone experienced can help me.

Thanks.
Cran

 

Continuing with my post I'll post the logs from GetRunKey, ShowNew and HijackThis.

I appreciate the help.
Thanks.
Cran

 

You are using MsConfig to prevent several items from loading at Windows start. MsConfig is a diagnostic tool, and not intended to be used in the manner you are using MsConfig. Enable everthing you used MsConfig to disable. If you are recieving error messages, related to these items, at system start; we can fix this without using MsConfig.

Using Add or Remove Programs in the Control Panel; uninstall the following:

<< Install Java Runtime Environment (JRE) 6 available from Sun Microsystems. >>

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop.

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.


Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

 

Re: Is closeapp.exe file something to worry about?

Hi Shadow, first of all thanks for your assistance.

Ok, I've done everything you told me to, first I, changed the msconfig startup option to normal, then uninstalled old versions of JDK and installed version 6, fixed the registry as you instructed me, used hijack this to fix R3 line, reboot in safe mode, deleted the C:\juegos folder, ran CCleaner and deleted the c:\windows\Prefetch folder and used the cleanmanager.

I'm posting the new HijackThis log.

About the msconfig, well i was using it to prevent some apps to load at startup because i think it makes it slower and i don't need them. If you know a better way to do this, please tell me about it.

There's something else, since I finished with the Read & Run me first tutorial, each time I restart, Windows ask me to finalize manually the eabsrvr and the explorer process. Why do you think this could be happening?

 

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

eabsrvr is realted to HP/Compaq Quick Launch buttons.

Download Blacklight Beta from here:
http://www.majorgeeks.com/F-Secure_BlackLight_d5156.html

* Download blbeta.exe and save it to the Desktop.
* Once saved... double click blbeta.exe to install the program.
* Click accept agreement and Click scan
This app too may fire off a warning from antivirus. Let the driver load.
Wait for it to finish.
* If it displays any items...don't do anything with them yet. Just hit exit (close)
* It will drop a log on Desktop that starts with fsbl....big number

Please post contents of log.

 

Re: Is closeapp.exe file something to worry about?

Ok, I ran blacklight although it didn't find anything I'm posting the log file and also the latest hijackthis log just in case.

Do you think it's safe now to remove counterspy and blacklight?

 

I'm not seeing any Malware in your HijackThis log. Yes, it would be safe to uninstall CounterSpy and removing BlackLight.

You may wan to post in the Software Forum about the other issue.

If you are not having any other malware problems, it is time to do our final steps:

• If we used Pocket Killbox during your cleanup, do the below
  • Run Pocket Killbox and select File, Cleanup, Delete All Backups
• If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
• If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
• If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
• If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
• If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
• You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
• If you are running Windows XP or Windows ME, do the below:
  • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
  • Then reboot and Enable System Restore to create a new clean Restore Point.
• After doing the above, you should work thru the below link:

 

Well shadow I created that clean restore point and everything seems to be working fne.

Thank you for your time and the help.

 

You're welcome.