Widows Explorer/Dr. Morten

I downloaded what I think was a bad file from a torrent about a month ago and now I can't open the folder I downloaded it in. I use Windows XP. I put it in My Documents>My Videos>My Movies. Sometimes I can open my videos, but most of the time I can't. If I try and delete it or open it I get an error message saying that Windows Explorer has encountered a problem and needs to close. Then it freezes up. A couple time it would came up with a Dr. Morten's Postmortem Debugger error message. Can you help me fix it?

I tried to put a hijackthis log in but it exceded the maximum amount of characters, so I attached it in a text file.

Edit: Also I ran a virus scan with McAfee nothing came up

[getting space - attachment deleted by admin]

You have quiet few bad guys there, but it's getting late, so I'll get back to you tomorrow, unless someone else chimes in.

Did you turn your firewall on, yet?

Yeah the firewall is and has been on.

Let me check your HJT log...

1. Print this post out, since you won't have an access to it, at some point.

2. Download, and install Spybot (if you don't have it) from here: http://www.safer-networking.org/en/download/index.html

3. Close all windows, except for HJT.

4. Put a checkmark next to following HJT entries:

- R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

- O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll (file missing)

- O2 - BHO: XBTBPos00 - {E552EEFC-DE97-45D4-BA1A-F534A1B4A579} - C:\PROGRA~1\MORPHE~1\MORPHE~1.DLL (file missing)

- O3 - Toolbar: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - C:\Program Files\Morpheus Toolbar\morpheustoolbar.dll (file missing)

- O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)

- O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (remove from "msconfig/startup")

- O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus

- O9 - Extra button: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - C:\Program Files\Morpheus Toolbar\morpheustoolbar.dll (file missing)

- O9 - Extra 'Tools' menuitem: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - C:\Program Files\Morpheus Toolbar\morpheustoolbar.dll (file missing)

- O9 - Extra button: Start EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\PROGRA~1\EASYWE~1\easywebcam.exe (file missing)

- O9 - Extra 'Tools' menuitem: &EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\PROGRA~1\EASYWE~1\easywebcam.exe (file missing)

- O22 - SharedTaskScheduler: homina - {df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4} - C:\WINDOWS\system32\oyopu.dll (file missing)


***Is "RIPE Network Coordination Centre" your ISP provider?***


5. Click on "Fix It" button.

6. Restart your computer in Safe Mode (F8)

7. Run Spybot (click on updates, first), and fix whatever it asks you to fix.

8. Open Windows Explorer. Go Tools>Folder Options, put a checkmark next to "Show hidden files, and folders".

9. Delete following files (if they still exist):

nothing to delete, for now

10. Turn off System Restore.

11. Restart in Normal Mode.

12. Turn System Restore on.

13. Run HJT again, and post back its log back here.

I did as you said, but I don't think it did much. I attached the log again.

[getting space - attachment deleted by admin]

I'm not sure what you did, because basically everything is back, nothing was fixed.
Follow EXACT steps from my previous post with couple of extra steps:

While in "Safe Mode", go Start>Control Panel>Add/Remove, and look for:
Acceleration Software, or Stop Sign program
If exist, uninstall.
Then...
Open Windows Explorer, navigate to:
C:\Program Files\Acceleration Software\ directory, right click on Acceleration Software, and click "Delete".

Post new HJT log.

Alright I did as you said here's the new log. It didn't fix the problem I was having though. Also the StopSign and Accelleration wasn't there.

[getting space - attachment deleted by admin]

OK...your HJT log is clean, now, so the culprit must be somewhere else.
Do you still have that "bad" downloaded file on your computer, and still can't delete it?

Yeah I'm pretty sure it's there still I can't get to the file to check though. Also if I try and delete any folder that contains it, it freezes up.

[Moderator]

Remove the offending folder and it's contents in safemode...

I've tried that it doesn't work, the same thing happens.

Does freezing happen in Safe Mode, too?
Did you try to access that folder from Command Prompt?

[Moderator]

Move On Boot...

Make sure to read the tutorial at the bottom of the DLoad page.

He can't open that folder... MoveOnBoot won't remove folder. It removes files only.

I tried all the things you said delete it in safe mode, open from the command prompt (that's one under the start menu right?), and that program. No of them worked.

open from the command prompt (that's rune under the start menu right?)

Did you go Start, typed: cmd, hit Enter, and Command Prompt window opened?
Did you navigate to the folder in question, and were you able to see the file in question?

Yeah that wasn't what I was doing... How do you navigate through the files with the command box?
I know how to open it just not navigate.

To make things simple, you can use "cd" command to walk around your computer. After entering a command, you hit Enter, which will take you to next line. This is an example:



or you can use a whole path, at once:



In the above example, I used dir command to display all files in "Backup 9" folder.
Lower/upper case letters don't matter.

Alright that wasn't what I was doing, but when I did it the right way it was weird. I got to the folder that contained what I think is the bad file, but when I entered dir to see what files were in the folder, the command box just closed out.

Try same thing in Safe Mode.
If this doesn't work, and you don't think, you have any important files in that directory, navigate to that directory, and type in:
del *.*
It'll delete all files in that directory. You may perform it in Safe Mode, as well.

Yeah it did the same thing again, I tried deleting it. That didn't work either.

You tried it in Safe Mode?

Yeah I was in safe mode.

[Moderator]

Unlocker

Make sure to read the Help section.

patio
I've never used this program, but I just got it, and it looks better, then "MoveOnBoot", because apparently it's able to remove whole folder, while MOB is not.

[Moderator]

Yep.
I had forgotten about it until i scanned thru my vast utilities archive...

I didn't have the time to try this out for a while, but I finally did. I can't use this because I can't right click on the file to try to delete it. Windows explorer just freezes.

[Malware Removal Specialist]

What is the path of the folder?

C:\??

I can't tell you for sure, but I think it's:
C:\Documents and Settings\Patrick Crean.THRIDFLOOR\My Documents\My Videos\Movies\Fantastic Four\(something else that I can't remember).

[Malware Removal Specialist]

Need the entire exact path to use a tool that will hopefully work.

I can figure the exact path out. Just tell me the tool and I'll try it out.

patio suggested "Unlocker". Did you try it?

I didn't have the time to try this out for a while, but I finally did. I can't use this because I can't right click on the file to try to delete it. Windows explorer just freezes.

Already posted it up a little while ago. No, it didn't work.

Try Safe Mode.

[Malware Removal Specialist]

Try using Pocket killbox

Killbox Tutorial