Whats changing my registry settings?! pls help!

[marquk]

Hey guys,

need your help, I been looking into this for at least a week and now I give up, its driving me crazy.

Every time I log into windows (XP), a load of registry keys get changed that disable the run, the shutdown button, the task manager, firewall, windows updates, etc... I can enable them myself but then on reboot they all get disabled again.

I have run Ad-Aware, and Search & Destroy and Symantec AV and nothing found. Search & Destroy does report that these keys have changed.

Here is my hijack log - any see anything dodgy there?

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and follow the instructions exactly.

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard :wave: :wave:

 

[marquk]

Thanks Howard! all fixed now - it turned out to be a virus:

C:\Program Files\Common Files\Microsoft Shared\Temp\MswService.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen

Learned a lot along the way, and now also have a firewall installed.

A million thanks for giving your free time to help people like me!

 

[howard_hopkinso]

That`s good news.

However, I`d still like you to post a fresh HJT log, so I can check to make sure your system is clean.

Regards Howard

 

[marquk]

Thanks Howard,

here it is, let me know if you see anything suspicious.

 

[howard_hopkinso]

Have HJT fix this entry.

R3 - Default URLSearchHook is missing

Other than the above, your HJT log is clean.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of marquk only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[marquk]

Thanks Howard! for all your help