HJT to post ""Dr. Watson (or ZoneAlarm) indicates a problem in OS forum

[vertical]

This is hijcakthis.txt file created for the thread indicated in the Title (OS forum).

Thank you!

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode, under your normal user name. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

Ninja.exe
PowerReg SchedulerV2.exe
regedit.exe

Close task manager.

Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O4 - HKLM\..\Run: [WPA] regedit.exe /s WXMCE_WPA_CRACK.reg

O4 - HKCU\..\Run: [Keyboard Ninja] C:\Documents and Settings\Slava\Desktop\ninja21\Ninja.exe

O4 - Startup: PowerReg SchedulerV2.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Documents and Settings\Slava\Desktop\ninja21\Ninja.exe
PowerReg SchedulerV2.exe You will need to search your system for this file and delete all instances of it.
WXMCE_WPA_CRACK.reg You will need to search your system for this file and delete all instances of it.

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log and let us know how your system is running.


Regards Howard

 

[vertical]

Howard,

Thank you and sorry for the mistake with the file posting.

Oow! That will be quite an accomplishment for a non-technical person like myself.

Please allow me some time to do all this and I will be back with the results.

I am not sure where to post them. Since the HJT file has been posted here, I will post the results here too.

 

[howard_hopkinso]

Yes, post the fresh hjt log into this thread please.

Regards Howard

 

[vertical]

Hi Howard,

Everything was fine so far but I had to interrupt the process because when I opened Task Manager > Process (in Safe Mode) there was none of the processes indicated there:

- Ninja.exe
- PowerReg SchedulerV2.exe
- regedit.exe

I checked "Show processes from all users" but the result is the same.

Should I continue with the rest of the procedure anyway?

Thank you!

 

[vertical]

Not sure whether it could be of any help but I've found out that the same thing happens if I try to open any video (avi) file in any other folder.

 

[howard_hopkinso]

Yes, continue with the instructions.

I did say "Click on the processes tab and end process for(if there)."

Regards Howard

 

[vertical]

Sorry, I did not notice that.

OK, I'll go ahead.

 

[vertical]

Hi Howard,

I've done everything (there was nothing about Ninja21/Ninja.exe) but it is still the same: once I touch a video file like avi, it gives the same message.

Please find the new HJT file attached.

Thank you for your time!

 

[howard_hopkinso]

Your HJT log is clean, so I think we can rule out a virus/spyware infection.

So, you should continue to post in your original thread on this subject.

Try and give as much information as possible. This will help members to help you.

Regards Howard

 

[vertical]

Howard,

Thank you! I do not know what else to post there. It looks like I have decribed anything I noticed about the issue. But I will try anyway.