This is hijcakthis.txt file created for the thread indicated in the Title (OS forum).
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode, under your normal user name. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
Close task manager.
Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [WPA] regedit.exe /s WXMCE_WPA_CRACK.reg
O4 - HKCU\..\Run: [Keyboard Ninja] C:\Documents and Settings\Slava\Desktop\ninja21\Ninja.exe
O4 - Startup: PowerReg SchedulerV2.exe
Click on the fix checked button.
Locate and delete the following bold files and/or directories(if there).
C:\Documents and Settings\Slava\Desktop\ninja21\Ninja.exe
PowerReg SchedulerV2.exe You will need to search your system for this file and delete all instances of it.
WXMCE_WPA_CRACK.reg You will need to search your system for this file and delete all instances of it.
Reboot into normal mode and turn system restore back on.
Post a fresh HJT log and let us know how your system is running.
Thank you and sorry for the mistake with the file posting.
Oow! That will be quite an accomplishment for a non-technical person like myself.
Please allow me some time to do all this and I will be back with the results.
I am not sure where to post them. Since the HJT file has been posted here, I will post the results here too.
Yes, post the fresh hjt log into this thread please.
Everything was fine so far but I had to interrupt the process because when I opened Task Manager > Process (in Safe Mode) there was none of the processes indicated there:
- PowerReg SchedulerV2.exe
I checked "Show processes from all users" but the result is the same.
Should I continue with the rest of the procedure anyway?
Not sure whether it could be of any help but I've found out that the same thing happens if I try to open any video (avi) file in any other folder.
Yes, continue with the instructions.
I did say "Click on the processes tab and end process for(if there)."
Sorry, I did not notice that.
OK, I'll go ahead.
I've done everything (there was nothing about Ninja21/Ninja.exe) but it is still the same: once I touch a video file like avi, it gives the same message.
Please find the new HJT file attached.
Thank you for your time!
Your HJT log is clean, so I think we can rule out a virus/spyware infection.
So, you should continue to post in your original thread on this subject.
Try and give as much information as possible. This will help members to help you.
Thank you! I do not know what else to post there. It looks like I have decribed anything I noticed about the issue. But I will try anyway.